HEADSCARF175 — network details

Niche detail you usually don't need. The main peering page is /.

Per-POP carve-outs

Each POP originates a more-specific /58 (and a /29 on s1/s2/s3 — s4 is a v6-only origin) via eBGP alongside the /27 and /48 anycast, so traffic to a node-specific address routes directly to that node instead of falling to anycast. Use these for diagnostics or when you want to pin to a single POP:

s1 (Brisbane)	`172.20.159.152/29`	`fdfd:27b9:f174:100::/58`
s2 (Los Angeles)	`172.20.159.136/29`	`fdfd:27b9:f174:200::/58`
s3 (Frankfurt)	`172.20.159.144/29`	`fdfd:27b9:f174:300::/58`
s4 (Tokyo)	— (no v4 carve-out)	`fdfd:27b9:f174:400::/58`

Registry max-lengths: 172.20.159.128/27 → 29, fdfd:27b9:f174::/48 → 58. The carve-outs are ROA-valid and propagate via eBGP to direct peers; the IX route-server export remains stub-only and does not include them. s4 has no v4 carve-out — the /27 is full at /29 granularity, so s4 originates v6 only; its v4 NLRI is carried via RFC 8950 ENH on iBGP for transit purposes.

Nameservers

`ns1.headscarf175.dn42`	`172.20.159.128` · `fdfd:27b9:f174::1`	anycast (whichever POP is closest)
`ns2.headscarf175.dn42`	`172.20.159.136` · `fdfd:27b9:f174:200::1`	s2 (Los Angeles)
`ns3.headscarf175.dn42`	`172.20.159.144` · `fdfd:27b9:f174:300::1`	s3 (Frankfurt)
`ns4.headscarf175.dn42`	`172.20.159.152` · `fdfd:27b9:f174:100::1`	s1 (Brisbane), via its per-POP address

PowerDNS runs on s1 (primary) and s2 / s3 (secondaries via AXFR over the iBGP tunnel) — s4 (Tokyo) does not run authoritative DNS. Zones served: headscarf175.dn42; the ENUM zone 2.4.8.0.0.4.2.4.e164.dn42 (our e164.dn42 number 42400842 — see the peering page); and reverse zones 128/27.159.20.172.in-addr.arpa + 4.7.1.f.9.b.7.2.d.f.d.f.ip6.arpa.

IGP — Babel over the tunnels

Internal only — peers never see it. Babel runs over the iBGP WireGuard tunnels between s1/s2/s3/s4 as a fast-failover IGP: 1 s Hellos give ~3 s tunnel-down detection vs BGP's ~90–240 s hold. Each node redistributes only its own per-POP carve-out(s) (the /58, plus the /29 on s1/s2/s3) — nothing external, no anycast supernet. Babel installs kernel routes at metric 42, below BIRD's iBGP-learned routes (metric 32), so it's a pure standby path: when a direct iBGP link drops, traffic between two nodes' carve-outs reroutes via a third node until BGP reconverges.

Leak prevention

Every node carries unreachable fd00::/8, unreachable 172.20.0.0/14, and unreachable 10.0.0.0/8 at a very high metric. Any DN42 destination not in BIRD's RIB therefore gets an ICMP destination unreachable rather than falling through to the node's clearnet IPv4/IPv6 default and egressing with a public source address. More-specific BIRD routes still win for known DN42 prefixes, and kernel-local routes win for our own anycast / per-POP / LAN addresses — the unreachable entries only ever catch genuinely-unknown DN42 space.

Route validation & import policy

RPKI / ROA: each POP runs its own RTR validator (StayRTR; feed from dn42.burble.com/roa/dn42_roa_46.json) — ROA-invalid routes are rejected on import at every POP independently.
Flap suppression: a FlapAlerted instance watching all four nodes' BGP feeds pulls flapping prefixes out of a second ROA view shared across the POPs; a route that is ROA-valid upstream but currently flap-suspended is also rejected on import.
Sanity guards: routes with an AS-path > 100 hops are dropped (and logged); routes carrying ≥ 100 communities (standard + extended + large combined) have all community lists emptied before further processing. Both are anti-amplification / anti-loop guards — no legitimate DN42 route is affected.
local_pref ladder (highest wins): graceful-shutdown (65535, 0) → 0 · direct peer / 1-hop path → 120 · all-PFS path (64511, 34) → 110 · default → 100 · any cleartext hop (64511, 31) → 90. The encryption tier reflects the worst hop seen in the path.