Bird2 BGP Routing Daemon

Log in to your VPS and ensure all packages are current before installing Bird2.

apt update && apt upgrade -y

Bird2 is available in the default repositories for Debian 12 and Ubuntu 22.04.

apt install bird2 -y

Verify the installation:

bird --version

You should see output similar to BIRD version 2.x.x. The service starts automatically — check its status:

systemctl status bird

Bird2 uses a single configuration file located at /etc/bird/bird.conf. Unlike Bird 1.x, which had separate IPv4 and IPv6 daemons, Bird2 handles both address families in a unified process.

The configuration is organized around three core concepts:

• Protocols — define routing sources and sinks (BGP, OSPF, static routes, kernel routing table, etc.).
• Tables — hold routing information. Bird2 has a built-in master4 table for IPv4 and master6 for IPv6.
• Filters — functions written in Bird's filter language that control which routes are accepted or exported at each protocol boundary.

Back up the default configuration, then create your own:

cp /etc/bird/bird.conf /etc/bird/bird.conf.bak
nano /etc/bird/bird.conf

Below is a minimal working configuration for a VPS that announces a static route over BGP to an upstream provider. Replace the placeholder values with your own ASN, IP addresses, and prefix.

# /etc/bird/bird.conf

# Router ID - typically your primary VPS IPv4 address
router id 203.0.113.1;

# Log to syslog
log syslog all;

# Kernel protocol - syncs Bird routes into the OS routing table
protocol kernel {
    ipv4 {
        export all;
    };
}

# Device protocol - required to detect interfaces
protocol device {}

# Static route for your IP block
protocol static {
    ipv4 {
        export all;
    };
    route 198.51.100.0/24 blackhole;
}

# BGP session with upstream provider
protocol bgp upstream {
    local 203.0.113.1 as 65001;
    neighbor 203.0.113.254 as 65000;

    ipv4 {
        import none;
        export filter {
            if net = 198.51.100.0/24 then accept;
            reject;
        };
    };
}

Bird2 includes a built-in syntax checker. Always validate before reloading:

bird --parse-only -c /etc/bird/bird.conf

A successful validation produces no output. If there are errors, the parser will print the line number and a description.

Once validation passes, reload Bird2 without restarting the service (no session downtime):

birdc configure

Or restart the service entirely if needed:

systemctl restart bird

The birdc command-line client connects to the running Bird2 daemon and lets you inspect state, run diagnostics, and reload configuration interactively.

birdc show protocols

birdc show route

birdc show protocols all upstream

birdc show route protocol upstream

birdc configure

Bird2 handles IPv6 natively. Add a parallel set of blocks to your configuration for ipv6:

protocol kernel {
    ipv4 { export all; };
    ipv6 { export all; };
}

protocol static {
    ipv4 { export all; };
    route 198.51.100.0/24 blackhole;

    ipv6 { export all; };
    route 2001:db8::/48 blackhole;
}

protocol bgp upstream6 {
    local 2001:db8::1 as 65001;
    neighbor 2001:db8::ffff as 65000;

    ipv6 {
        import none;
        export filter {
            if net = 2001:db8::/48 then accept;
            reject;
        };
    };
}

BFD (Bidirectional Forwarding Detection) detects link failures in milliseconds, much faster than BGP hold timers alone. Enable it by adding a BFD protocol block and referencing it in your BGP session:

protocol bfd {
    interface "*" {
        min rx interval 100ms;
        min tx interval 100ms;
    };
}

protocol bgp upstream {
    local 203.0.113.1 as 65001;
    neighbor 203.0.113.254 as 65000;
    bfd on;

    ipv4 {
        import none;
        export filter {
            if net = 198.51.100.0/24 then accept;
            reject;
        };
    };
}

A few practices that matter for production Bird2 deployments on any VPS:

Restrict the Bird control socket

By default, birdc is accessible to root only. Verify socket permissions:

ls -la /run/bird/bird.ctl

Use prefix filters to prevent route leaks

Never export a full default-free zone to a peer unless you intend to act as a transit provider. Filter aggressively on both import and export.

Set BGP timers conservatively for stability

protocol bgp upstream {
    hold time 90;
    keepalive time 30;
    ...
}

Enable MD5 authentication if your upstream supports it

protocol bgp upstream {
    password "your-shared-secret";
    ...
}

Bird2 should already be enabled at boot after installation, but confirm:

systemctl enable bird