Network Engineering & BGP

Networking is the layer where small mistakes have large blast radii. A bad prefix-list leaks half the internet. A missing ROA gets your traffic dropped by validating networks. A single-homed transit link turns a maintenance window into an outage.

We have built this for ourselves — our own address space, our own ASN, our own eBGP sessions on BIRD across AWS and Vultr footprints — which means we have made the mistakes on our own infrastructure first.

Address space and routing policy

Owning portable address space changes what is possible: you can move providers without renumbering, announce the same prefix from many locations, and keep reputation attached to you rather than to a shared cloud range.

We handle the RIR application and justification, IRR objects, RPKI ROAs, and the routing policy that decides what you accept and what you originate.

# bird.conf — accept only RPKI-valid routes from transit, originate our /24
roa4 table r4;

protocol rpki rpki_rtr {
    roa4 { table r4; };
    remote "rtr.rpki.example" port 8282;
    retry keep 90;
}

filter transit_in {
    if roa_check(r4, net, bgp_path.last) = ROA_INVALID then reject;
    if net.len > 24 then reject;
    accept;
}

protocol bgp transit_blr1 {
    local as OURASN;
    neighbor 198.51.100.1 as 64500;
    ipv4 {
        import filter transit_in;
        export filter { if net = 203.0.113.0/24 then accept; reject; };
    };
}

Prefix-length filters, RPKI validation, explicit originate lists and max-prefix limits are not optional extras. They are the difference between a routing mistake that affects one session and one that makes the NANOG mailing list.

Multi-site and hybrid

Most of our network work is connecting things that were not designed to be connected: an on-prem rack to three cloud regions, a GPU cluster to a product running in Kubernetes, offices to a private backbone.

• Underlay. Transit mix, IX presence, cross-connects, and where a second provider genuinely buys you independence rather than the same upstream twice.
• Overlay. VXLAN fabrics for L2 adjacency where it is unavoidable, WireGuard or IPsec meshes where it is not, and routed-first designs wherever we can get away with them.
• Addressing. A plan that survives growth — IPv6 from the start, deterministic allocation, and no overlapping RFC 1918 space between acquired networks.

Proving it works

Design reviews catch intent errors. Only tests catch reality errors.

Before handover we withdraw prefixes one POP at a time and measure where traffic lands. We pull a transit link during business hours, under supervision, with a rollback ready. We verify that your monitoring actually noticed. A failover path that has never been exercised is a hypothesis, not a feature.

Who this is for

Platforms where latency, egress cost or sovereignty matter enough to justify running your own edge: media and streaming, gaming, fintech with regional obligations, AI inference with large response payloads, and anyone whose cloud egress bill has started to look like a headcount.