How to get an ASN as an individual, then announce your own IP prefixes to the internet.
I first learned what an ASN actually was in a COMP3331 class. But the idea was familiar beyond those dry classroom definitions: I have been tinkering with proxies, servers, and IP addresses since childhood, and whenever I look up an IP address, its ASN is one of the first things I see. AS13335, for example, is Cloudflare, and AS15169 is Google.
ASN and BGP
The internet is made up of thousands of independently operated networks connected together. Each of these is an autonomous system (AS), and its ASN is its identifying number. ISPs, universities, cloud providers, and CDNs each operate one or more autonomous systems.
Autonomous systems communicate with each other using BGP. I tell my upstream about a block of IP addresses I own; my upstream tells its neighbors, and the announcement spreads from network to network. Before long, routers around the world know which way to send traffic for that block. The ASN shown in an IP lookup is generally the autonomous system announcing the block through BGP.
ASNs are not just for ISPs and large enterprises, though. Individuals and organizations can apply too, if they go through the right channels. Who could resist having an ASN in their own name, with a block of IP addresses identifying them as the owner?
A 21st birthday gift to myself
Applying
Five organizations, known as Regional Internet Registries (RIRs), manage ASNs and IP addresses worldwide. ARIN covers North America; RIPE NCC covers Europe, the Middle East, and part of Central Asia; APNIC covers Asia-Pacific; LACNIC covers Latin America; and AFRINIC covers Africa. You generally apply to the RIR for your region, and your network needs a presence there.
The eligibility requirements and fees vary quite a bit between RIRs.
RIPE's full members are called LIRs—jokingly, its "premium members." The annual membership fee is €1,550, with a €1,000 sign-up fee for new members. An LIR can also act as a sponsor, submitting applications for individuals or organizations that are not members themselves. This is the most common route for individuals.
APNIC's full membership costs about AUD 1,680 in the first year and AUD 1,180 per year thereafter; new members receive an IPv4 /24, an IPv6 /48 and an ASN. The application also requires proof of identity, company registration, and business operations. Review takes one or two weeks, and because IPv4 is exhausted, addresses are subject to a waiting list. APNIC also allows existing members to apply on behalf of customers, but these sponsors are less common than RIPE sponsors, and their pricing is less competitive.
ARIN charges annual fees for ASNs and requires a network presence in North America. LACNIC and AFRINIC are even farther away, so they are basically out of consideration.
I ultimately chose RIPE because it was the easiest and cheapest option. Applying through APNIC is possible too, but requires more documents and a longer review. RIPE also lets you manage many settings through its very convenient LIR Portal, whereas many APNIC settings have to be handled by email or support ticket.
Process
For individuals, finding a sponsor to apply for an ASN is the most cost-effective option.
A search for RIPE ASN sponsorship turns up plenty of providers: hosting companies, small network operators, and network enthusiasts who are RIPE members with their own LIR accounts. They can use those accounts to help you apply for an ASN and IP addresses, usually for a small annual fee.
My sponsor was Soha Jin, who handled the application for me; it took only one or two days from submission to the ASN being issued.
The sponsor does not need much from you: proof of identity, an address, an email address for abuse complaints, the ASNs of two upstreams, and proof that your network has a presence in Europe. You have to name the upstreams in the application, so arrange them beforehand. My proof of presence was a VPS in a European data center.
Once the ASN is issued, several objects appear in the RIPE database: aut-num represents the ASN itself, alongside maintainer, contact, and organisation objects. You use the maintainer to authorize later changes.
An ASN alone is not enough: you also need IP addresses to announce. The smallest generally accepted IPv4 announcement is a /24 prefix; for IPv6, it is a /48 prefix. Most networks filter out smaller address blocks. IPv4 is scarce and expensive, so sponsors generally include some IPv6 space. I received a /44, which came through at roughly the same time as the ASN.
Finding Upstreams
Beyond applying to a registry and paying its fees, there is an even more important step: finding an upstream that offers BGP sessions so you can announce your IP addresses. I found three at the time.
The first was Vultr, whose cloud instances support free BGP sessions using Vultr's private ASN (AS64515). The European VPS mentioned above was hosted there, serving both as my proof of presence and as my first upstream. Apart from an LOA, there were hardly any barriers—it was an excellent first IP transit provider.
The second was Misaka Network, which charges a one-time setup fee of roughly a few dozen dollars to enable a BGP session.
The third was BuyVM, and this one was the most affordable. Its cheapest plan costs only $2.50, offers unlimited traffic, and includes a free BGP session; you just need to open a ticket to apply, and manually added prefixes require an LOA.
Many other providers offer BGP sessions. There is a community-maintained list at bgp.services, showing which plans include BGP and what it costs to add a session. It is a useful place to look for a provider that fits your needs.
Announcing with BIRD
Once you have an upstream, run routing software on your server to establish a BGP session with it. Since the IP transit providers in this setup are generally VPS companies, BIRD 2 on Linux is a convenient choice.
BASH
apt install bird2
First, configure the address to be announced on the local machine. For a single server, configuring it on lo is enough; do not configure it on the egress network interface.
BASH
ip addr add 2a0e:aa07:e0a0::1/128 dev lo
Then comes /etc/bird/bird.conf. Below is the minimal configuration for announcing only IPv6; the neighbor address, ASN, and password are all provided by the upstream, and example values are used here.
TEXT
router id 203.0.113.10;
protocol device {
}
protocol static announce_v6 {
ipv6;
route 2a0e:aa07:e0a0::/44 reject;
}
protocol bgp upstream_v6 {
local as 198734;
neighbor 2001:db8:ffff::1 as 64515;
multihop 2;
password "your-password";
ipv6 {
import none;
export where net ~ [ 2a0e:aa07:e0a0::/44+ ];
};
}
protocol static contains the prefix to be announced; using reject makes the route available in the routing table without actually forwarding traffic. protocol bgp describes the BGP session: local as is my ASN, and neighbor gives the upstream's address and ASN. Sessions on cloud instances are usually multihop, so use the parameters supplied by your upstream. I only need to announce my prefix, not receive the upstream's routing table, so I use import none. To receive a default route or a full routing table instead, change import and add protocol kernel.
After making the changes, reload BIRD and then check the session status.
BASH
birdc configure
birdc show protocols
birdc show route export upstream_v6
show protocols showing a session state of Established means the session is connected. show route export shows which routes are actually being sent to the upstream. If the session will not connect, check that you can ping the neighbor, whether the upstream requires multihop, and whether a firewall is blocking port 179.
Upstreams generally also check whether the prefix has a corresponding IRR route6 object and an RPKI ROA; both need to be created in the RIPE database. If you are using an address block provided by the sponsor, you may need to ask the sponsor to handle it.
After the prefix is announced, within a few hours you can search bgp.tools for your own ASN; some upstreams propagate slowly, and it may take several days. After that, when you look up these IPs again, the first thing shown will be your own ASN.
I first learned what an ASN actually was in a COMP3331 class. But the idea was familiar beyond those dry classroom definitions: I have been tinkering with proxies, servers, and IP addresses since childhood, and whenever I look up an IP address, its ASN is one of the first things I see. AS13335, for example, is Cloudflare, and AS15169 is Google.
ASN and BGP
The internet is made up of thousands of independently operated networks connected together. Each of these is an autonomous system (AS), and its ASN is its identifying number. ISPs, universities, cloud providers, and CDNs each operate one or more autonomous systems.
Autonomous systems communicate with each other using BGP. I tell my upstream about a block of IP addresses I own; my upstream tells its neighbors, and the announcement spreads from network to network. Before long, routers around the world know which way to send traffic for that block. The ASN shown in an IP lookup is generally the autonomous system announcing the block through BGP.
ASNs are not just for ISPs and large enterprises, though. Individuals and organizations can apply too, if they go through the right channels. Who could resist having an ASN in their own name, with a block of IP addresses identifying them as the owner?
Applying
Five organizations, known as Regional Internet Registries (RIRs), manage ASNs and IP addresses worldwide. ARIN covers North America; RIPE NCC covers Europe, the Middle East, and part of Central Asia; APNIC covers Asia-Pacific; LACNIC covers Latin America; and AFRINIC covers Africa. You generally apply to the RIR for your region, and your network needs a presence there.
The eligibility requirements and fees vary quite a bit between RIRs.
RIPE's full members are called LIRs—jokingly, its "premium members." The annual membership fee is €1,550, with a €1,000 sign-up fee for new members. An LIR can also act as a sponsor, submitting applications for individuals or organizations that are not members themselves. This is the most common route for individuals.
APNIC's full membership costs about AUD 1,680 in the first year and AUD 1,180 per year thereafter; new members receive an IPv4 /24, an IPv6 /48 and an ASN. The application also requires proof of identity, company registration, and business operations. Review takes one or two weeks, and because IPv4 is exhausted, addresses are subject to a waiting list. APNIC also allows existing members to apply on behalf of customers, but these sponsors are less common than RIPE sponsors, and their pricing is less competitive.
ARIN charges annual fees for ASNs and requires a network presence in North America. LACNIC and AFRINIC are even farther away, so they are basically out of consideration.
I ultimately chose RIPE because it was the easiest and cheapest option. Applying through APNIC is possible too, but requires more documents and a longer review. RIPE also lets you manage many settings through its very convenient LIR Portal, whereas many APNIC settings have to be handled by email or support ticket.
Process
For individuals, finding a sponsor to apply for an ASN is the most cost-effective option.
A search for RIPE ASN sponsorship turns up plenty of providers: hosting companies, small network operators, and network enthusiasts who are RIPE members with their own LIR accounts. They can use those accounts to help you apply for an ASN and IP addresses, usually for a small annual fee.
My sponsor was Soha Jin, who handled the application for me; it took only one or two days from submission to the ASN being issued.
The sponsor does not need much from you: proof of identity, an address, an email address for abuse complaints, the ASNs of two upstreams, and proof that your network has a presence in Europe. You have to name the upstreams in the application, so arrange them beforehand. My proof of presence was a VPS in a European data center.
Once the ASN is issued, several objects appear in the RIPE database: aut-num represents the ASN itself, alongside maintainer, contact, and organisation objects. You use the maintainer to authorize later changes.
An ASN alone is not enough: you also need IP addresses to announce. The smallest generally accepted IPv4 announcement is a /24 prefix; for IPv6, it is a /48 prefix. Most networks filter out smaller address blocks. IPv4 is scarce and expensive, so sponsors generally include some IPv6 space. I received a /44, which came through at roughly the same time as the ASN.
Finding Upstreams
Beyond applying to a registry and paying its fees, there is an even more important step: finding an upstream that offers BGP sessions so you can announce your IP addresses. I found three at the time.
The first was Vultr, whose cloud instances support free BGP sessions using Vultr's private ASN (AS64515). The European VPS mentioned above was hosted there, serving both as my proof of presence and as my first upstream. Apart from an LOA, there were hardly any barriers—it was an excellent first IP transit provider.
The second was Misaka Network, which charges a one-time setup fee of roughly a few dozen dollars to enable a BGP session.
The third was BuyVM, and this one was the most affordable. Its cheapest plan costs only $2.50, offers unlimited traffic, and includes a free BGP session; you just need to open a ticket to apply, and manually added prefixes require an LOA.
Many other providers offer BGP sessions. There is a community-maintained list at bgp.services, showing which plans include BGP and what it costs to add a session. It is a useful place to look for a provider that fits your needs.
Announcing with BIRD
Once you have an upstream, run routing software on your server to establish a BGP session with it. Since the IP transit providers in this setup are generally VPS companies, BIRD 2 on Linux is a convenient choice.
First, configure the address to be announced on the local machine. For a single server, configuring it on lo is enough; do not configure it on the egress network interface.
Then comes /etc/bird/bird.conf. Below is the minimal configuration for announcing only IPv6; the neighbor address, ASN, and password are all provided by the upstream, and example values are used here.
protocol static contains the prefix to be announced; using reject makes the route available in the routing table without actually forwarding traffic. protocol bgp describes the BGP session: local as is my ASN, and neighbor gives the upstream's address and ASN. Sessions on cloud instances are usually multihop, so use the parameters supplied by your upstream. I only need to announce my prefix, not receive the upstream's routing table, so I use import none. To receive a default route or a full routing table instead, change import and add protocol kernel.
After making the changes, reload BIRD and then check the session status.
show protocols showing a session state of Established means the session is connected. show route export shows which routes are actually being sent to the upstream. If the session will not connect, check that you can ping the neighbor, whether the upstream requires multihop, and whether a firewall is blocking port 179.
Upstreams generally also check whether the prefix has a corresponding IRR route6 object and an RPKI ROA; both need to be created in the RIPE database. If you are using an address block provided by the sponsor, you may need to ask the sponsor to handle it.
After the prefix is announced, within a few hours you can search bgp.tools for your own ASN; some upstreams propagate slowly, and it may take several days. After that, when you look up these IPs again, the first thing shown will be your own ASN.