Routinator 3000

Routinator 3000 is a RPKI relying party software (aka RPKI Validator) written in Rust by the good folks at NLnet Labs. These instructions reflect Routinator 0.8.2 (on Ubuntu 20.04). This mostly follows their own GitHub instructions and documentation.

We use a standard Ubuntu 20.04 installation (selecting the minimal virtual server option), 2 vCPUs, 2GB RAM, 20GB LVM hard drive.

Add the apt repo to the system by creating a file called /etc/apt/sources.list.d/routinator.list with the following contents:

deb [arch=amd64] https://packages.nlnetlabs.nl/linux/debian/ stretch main
deb [arch=amd64] https://packages.nlnetlabs.nl/linux/debian/ buster main
deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ xenial main
deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ bionic main
deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ focal main

Then add the NLNetLabs package key to the system:

sudo apt update && apt-get install -y gnupg2
wget -qO- https://packages.nlnetlabs.nl/aptkey.asc | sudo apt-key add -
sudo apt update

Note that the first apt update will return a bunch of errors. The second update should run without errors, once the key has been added.

We then install the required software:

sudo apt install routinator
sudo routinator-init

Alternatively, if you plan to agree with the ARIN RPA, run:

sudo routinator-init --accept-arin-rpa

By default, Routinator listens only on TCP sockets on 127.0.0.1. If you want other devices to be able to access the service, it needs to listen to the wildcard socket.

If you're running Linux, you can configure Routinator to listen to both ipv4 and ipv6 wildcard sockets using the following configuration lines in /etc/routinator/routinator.conf:

rtr-listen = [ "[::]:3323" ]
http-listen = [ "[::]:8080" ]

If you're running an operating system other than Linux, you'll need separate entries for ipv4 and ipv6:

rtr-listen = [ "127.0.0.1:3323", "[::]:3323" ]
http-listen = [ "127.0.0.1:8080", "[::]:8080" ]

You can then test by running the following command, which prints the validated ROA payloads and increases the log level to show the process in detail:

/usr/bin/routinator --config /etc/routinator/routinator.conf -v vrps

Starting on Boot

To have this service start at boot:

systemctl enable routinator
systemctl start routinator

Monitoring

We add Nagios http checks for port 8080 (HTTP) to our monitoring platform. We also add a check_tcp test for the RPKI-RTR port 3323.

HTTP Interface

The following is copied from Routinator's man page. As a future work fixme, this should be used for better monitoring that just check_tcp above.

HTTP SERVICE
       Routinator  can provide an HTTP service allowing to fetch the Validated
       ROA Payload in various formats. The service does not support HTTPS  and
       should only be used within the local network.

       The service only supports GET requests with the following paths:


       /metrics
              Returns  a  set  of  monitoring  metrics  in  the format used by
              Prometheus.

       /status
              Returns the current status of the Routinator instance.  This  is
              similar  to  the  output  of the /metrics endpoint but in a more
              human friendly format.

       /version
              Returns the version of the Routinator instance.

       /api/v1/validity/as-number/prefix
              Returns a JSON object describing whether the route  announcement
              given  by its origin AS number and address prefix is RPKI valid,
              invalid, or not found.  The returned object is  compatible  with
              that  provided by the RIPE NCC RPKI Validator. For more informa-
              tion, see  https://www.ripe.net/support/documentation/developer-
              documentation/rpki-validator-api

       /validity?asn=as-number&prefix=prefix
              Same as above but with a more form-friendly calling convention.


       In  addition, the current set of VRPs is available for each output for-
       mat at a path with the same name as the output format.  E.g.,  the  CSV
       output is available at /csv.

       These paths accept filter expressions to limit the VRPs returned in the
       form of a query string. The field filter-asn can be used to filter  for
       ASNs  and  the  field filter-prefix can be used to filter for prefixes.
       The fields can be repeated multiple times.

       This works in the same way as the options of the same name to the  vrps
       command.