AS4242420842 - HEADSCARF175

Welcome to the HEADSCARF175 DN42 network — public tunnel peering across eight POPs in Brisbane (AU), Los Angeles (US), New Jersey (US), Frankfurt (DE), Tokyo (JP), Hong Kong, Singapore, and Coventry (GB), plus direct IX presence in Frankfurt and San Jose.

Network Information

POPs

Nodes use geographic names; former sN.headscarf175.net endpoints remain valid permanently as aliases, so existing tunnels need no change.

Per-node WireGuard public keys, tunnel addresses, and assigned ports are shown by the peering portal (below). For au-bne01 (manual only), they are sent in the peering email reply.

Auto-peering

The self-service portal serves us-lax01, de-fra01, jp-tyo01, us-ewr01, hk-hkg01, sg-sin01, and gb-cvt01:

DN42:      https://peer.headscarf175.dn42
clearnet:  https://peer.headscarf175.net

Sign in with your DN42 mntner (OIDC via iedon's auth42 / oauth.dn42 — password, email, PGP, or SSH). Create and remove sessions at any portal POP; the portal shows the node identity, tunnel addressing, peer configuration, and live session status.

Transports: WireGuard is available at every portal POP and remains preferred. Every portal POP also offers IKEv2 route-based XFRM/IPsec and GRE/IPsec. Raw RSA public-key authentication is recommended; pinned certificates, CA validation, and 32-byte PSKs are available for compatibility. Private keys are generated and retained on each router and must never be uploaded.

Ports: portal-managed tunnels use UDP 30001-39999; your exact port is shown on the session page. (The legacy SSH autopeer on port 4242 is retired — existing sessions were migrated unchanged.)

Direct IX peering

Members of Yukisino IX and SVIX can establish a direct bilateral BGP session with us across the shared IX fabric, without a WireGuard tunnel.

MP-BGP over IPv6 with RFC 8950 Extended Next Hop is supported. Email [email protected] with your ASN, IX name, and on-fabric BGP address to request a session.

Manual peering (au-bne01 and OpenVPN)

au-bne01 (Brisbane) is manual-peering only — residential link, no autopeer. WireGuard, OpenVPN, and GRE/Plain are all accepted.

OpenVPN remains email-only. The portal manages WireGuard and supported IPsec transports, plus plain GRE on us-lax01.

GRE/Plain is available through the portal on us-lax01 and by email at other POPs. No encryption — community (64511, 31) is set on routes via that session instead of (64511, 34) for WG. Encrypted GRE/IPsec is available through the portal at every portal POP.

Ports: au-bne01 uses sequential UDP 200xx (we'll assign the next free one). us-lax01, de-fra01, jp-tyo01, us-ewr01, hk-hkg01, sg-sin01, and gb-cvt01 manual WireGuard peers use last 5 digits of your ASN (e.g. AS4242422189 → UDP 22189).

Send the following template to [email protected]:

I would like to peer with AS4242420842.
ASN:
Preferred POP (au-bne01/us-lax01/de-fra01/jp-tyo01/us-ewr01/hk-hkg01/sg-sin01/gb-cvt01/multi):
Transport (WireGuard, OpenVPN, or GRE/Plain):
WireGuard Endpoint:           (if WG)
WireGuard Public Key:         (if WG)
OpenVPN Endpoint + config:    (if OpenVPN)
GRE Public IP:                (if GRE/Plain) -- protocol 47, no port
Tunnel IPv6 Link-Local:       (preferred for BGP session)
Tunnel IPv4 Address:          (if using IPv4 BGP)

Peering Policy

• Open peering — anyone registered in DN42 is welcome
• No tunnel endpoints in mainland China — PRC cross-border-tunnel licensing means we can't terminate a session at an endpoint that geolocates to mainland CN. The restriction is mainland CN only: Hong Kong, Macau, and Taiwan endpoints are all fine, as are offshore (non-CN) POPs of operators registered in CN — just point the tunnel at your non-CN node. The Hong Kong POP enforces this automatically.
• WireGuard preferred; portal IPsec is available on capability-enabled nodes; plain GRE is available in the portal on us-lax01; OpenVPN remains email-only
• MP-BGP over IPv6 link-local preferred
• Geographic best-fit: AU/Pacific peers on au-bne01 · West-coast/Latin-American peers on us-lax01 · US-East/Canadian peers on us-ewr01 · European peers on de-fra01 or gb-cvt01 · JP/Korea peers on jp-tyo01 · HK/Taiwan/South-China peers on hk-hkg01 · SG/SE-Asia peers on sg-sin01. Multi-homed peers across two or more POPs are welcome and routed via per-POP MED.

BGP

• The public BGP nodes au-bne01, us-lax01, de-fra01, jp-tyo01, de-fra02, us-ewr01, hk-hkg01, sg-sin01, and gb-cvt01 exchange routes through the full-mesh core (next-hop-self)
• Core POPs announce the IPv4 /27 and IPv6 /48 anycast aggregates. Per-node IPv6 /58s are advertised externally with home-aware steering; per-node IPv4 /32s stay inside our iBGP/Babel underlay and are never advertised externally. jp-tyo01 has no per-node v4 origin, but carries v4 NLRI via RFC 8950 ENH for transit. See /details.html
• RPKI/ROA validated locally on every POP; invalids dropped
• Registry max-lengths: /27 → 27, /48 → 58
• Supported RFCs: 1997, 4724, 4760, 6811, 7311, 7313, 7911, 7947, 7999, 8092, 8326, 8654, 8950, 9003, 9072, 9494, 9687

Communities tagged on announce

We also stamp our own informational large communities at ingress (in our import filters); they pass through unchanged on re-export, so peers and looking glasses see them:

Telephony (tel.dn42)

We have a DN42 phone number via the registry-managed tel.dn42 ENUM project — +04240842 (formatted +042-4-0842: the +042- prefix, the 424242xxxx block digit, plus the last four digits of our ASN).

Any PBX doing ENUM lookups against tel.dn42 can dial 04240842, or call sip:[email protected] directly. Quick check: dig 2.4.8.0.4.2.4.0.tel.dn42 NAPTR.

No one’s home — the number answers with a short recorded greeting and hangs up.

Resources

• GeoFeed
• Looking glass — live routes and protocols across all eleven public BGP nodes
• Flap dashboard — live BGP route-flap monitor (FlapAlerted)
• Whois: whois -h whois.headscarf175.dn42 AS4242420842 — serves our local clone of the DN42 registry (refreshed hourly). whois42d, anycast from au-bne01 + de-fra01 + sg-sin01 + nl-ams01 + us-lax02.
• Network details — per-POP carve-outs, nameservers