AS213605 · IPv6-first · WireGuard

Free transit for the routing community.

Bring your ASN, sign in with PeeringDB, and get full IPv4 + IPv6 tables over a WireGuard tunnel — link-local addressing, one BGP session, minutes to set up.

4locations

1.05 MIPv4 routes

229 kIPv6 routes

$0forever

How it works

Three steps, no paperwork

Eligibility is your PeeringDB login. Everything else is automated.

Sign in with PeeringDB

No signup forms. Your ASN, organisation and NOC contacts come straight from your PeeringDB record — if you can log in there, you can peer here.

Create a WireGuard tunnel

Pick a POP, paste your WireGuard public key. Tunnels are unnumbered — each side gets an IPv6 link-local address and nothing else. Behind NAT? Leave the endpoint empty and dial out.

Bring up BGP

One MP-BGP session between the tunnel's link-local pair. IPv4 routes ride the same session via extended next-hop (RFC 8950) — full v4 + v6 tables, zero IPv4 addressing.

The wire format

A deliberately small surface

Two addresses, one session, modern capabilities. Here's the whole peer config.

Link-local only

Tunnels carry nothing but fe80::/64. No transfer networks to request, renumber or leak — your LLA is yours, ours is ours.

One session, both families

IPv4 NLRI with an IPv6 next hop per RFC 8950 extended next-hop. A single IPv6 session over the tunnel delivers both full tables.

RPKI + IRR enforced

RPKI-invalid announcements are dropped at ingress. Prefix filters are rebuilt nightly from the as-set on your PeeringDB record.

bird.conf — that's all of it

protocol bgp freetransit {
    local fe80::beef:1 as 64496;
    neighbor fe80::2136:5:1 % 'wg-ft-fra1' as 213605;

    ipv4 {
        import all;
        export where source = RTS_STATIC;
        extended next hop on;   # RFC 8950
    };
    ipv6 {
        import all;
        export where source = RTS_STATIC;
    };
}

Network

Points of presence

Connect to one or all of them — each tunnel and session is independent.

POP	Location	WireGuard endpoint	Router LLA	Status
FRA1	Frankfurt, Germany	fra1.ft.as213605.net:51820	fe80::2136:5:1	Operational
AMS1	Amsterdam, Netherlands	ams1.ft.as213605.net:51820	fe80::2136:5:2	Operational
LAX1	Los Angeles, United States	lax1.ft.as213605.net:51820	fe80::2136:5:3	Operational
SIN1	Singapore, Singapore	sin1.ft.as213605.net:51820	fe80::2136:5:4	Operational

Requirements

What you need to bring

Public ASN + PeeringDB record

Registered routes

RPKI ROAs or IRR route objects covering everything you announce.

A router that speaks LLA BGP

BIRD 2/3, FRR, OpenBGPD or RouterOS v7 — anything that can peer on fe80:: with extended next-hop.

A WireGuard endpoint

A public IP:port — or none at all: passive mode works behind NAT with keepalives.

FAQ

Common questions

Is it really free?

Yes. FreeTransit is a community project run by AS213605. Fair use applies and there is no SLA — it's built for labs, personal ASNs and research networks, not for your production uplink.

Do I get an IPv4 address on the tunnel?

No — and you don't need one. The tunnel is link-local only. Your IPv4 routes are exchanged over the IPv6 session using extended next-hop (RFC 8950), and IPv4 traffic flows through the tunnel like any other payload.

Can I connect from behind NAT?

Yes. Leave the endpoint field empty when creating the tunnel and your side dials out; a PersistentKeepalive of 25 s keeps the mapping open. The session comes up as soon as we see your first handshake.

What do you announce to me?

Full IPv4 + IPv6 tables by default. BGP large communities let you request default-only or regional slices per session.