IRR Route Objects and AS-SET: Build Filters With bgpq4

An IRR route object is a public database record that says "this prefix may be originated by this ASN," and an AS-SET is a named group of ASNs that an upstream expands into a list of allowed prefixes. Together they drive most BGP prefix filtering on the internet, and bgpq4 is the tool that turns them into router configuration. If either one is missing or stale, your announcement is likely to be filtered even when your BGP session is up.

This guide covers what these objects look like, how to generate filters with bgpq4, and why a clean customer AS-SET matters if you have downstream networks or announce through someone else's infrastructure.

What the IRR Is

The Internet Routing Registry (IRR) is a set of distributed databases. Examples include RIPE, RADB, ARIN, and others. Operators publish routing policy objects there, and other operators read them to build filters. Three object types matter most for day-to-day work:

• route / route6: binds a prefix to an origin ASN.
• aut-num: describes an ASN and, optionally, its policy.
• as-set: lists ASNs and/or other AS-SETs.

IRR data is not proof of ownership by itself. Some databases authenticate against the RIR, and some accept objects with weaker checks. That is why many networks now combine IRR data with RPKI. See our article on RPKI and ROA concepts if you have not created ROAs yet. In practice, you want both: ROAs for origin validation and IRR objects for filter generation.

Route Objects

A route object for an IPv4 prefix, using documentation values:

route:      192.0.2.0/24
origin:     AS64496
descr:      Example network
mnt-by:     EXAMPLE-MNT
source:     RIPE

IPv6 uses route6:

route6:     2001:db8::/32
origin:     AS64496
mnt-by:     EXAMPLE-MNT
source:     RIPE

Points to check:

• The origin must be the ASN that actually announces the prefix. If you announce from AS64496, the object needs origin: AS64496.
• Create both route and route6 objects if you run dual stack. IPv6 is the one people forget.
• Each IRR has its own authorization rules. For space registered with an RIR, create the object in that RIR's database where possible.
• If you announce a covering prefix and more-specifics, each one you announce needs its own route object, unless your upstream's filter allows more-specifics up to a limit.

AS-SETs

An AS-SET is a name that stands for a group of ASNs. Upstreams ask for it so they do not have to ask you for a prefix list every time something changes.

as-set:     AS64496:AS-CUSTOMERS
descr:      AS64496 and its downstream customers
members:    AS64496
members:    AS64497
members:    AS64500:AS-DOWNSTREAMS
mnt-by:     EXAMPLE-MNT
source:     RIPE

Use the hierarchical form (AS64496:AS-CUSTOMERS). Names like AS-CUSTOMERS with no ASN prefix live in a flat namespace, so anyone can register a clashing name in another database. Hierarchical names can only be created by the holder of the parent ASN, which makes them harder to hijack by accident or on purpose.

An AS-SET can contain other AS-SETs. When a tool expands it, it follows every nested reference recursively and collects the route objects of every ASN it finds.

Generating Filters With bgpq4

bgpq4 queries IRR databases, expands the AS-SET, collects route objects, and prints a prefix list in the format your router speaks. Install it from your distribution's packages (apt install bgpq4 on Debian and Ubuntu) or build from source.

Basic IPv4 and IPv6 prefix lists (Cisco-style output, which FRRouting also accepts):

bgpq4 -4 -A -m 24 -l CUST-V4-IN AS64496:AS-CUSTOMERS
bgpq4 -6 -A -m 48 -l CUST-V6-IN AS64496:AS-CUSTOMERS

What the flags do:

• -4 / -6 selects the address family.
• -A aggregates the result where possible, which keeps lists smaller.
• -m 24 / -m 48 sets a maximum prefix length, so a /25 or /26 from a customer's route object is not accepted.
• -l sets the list name.

Restrict the sources to the registries you trust:

bgpq4 -4 -A -m 24 -S RIPE,RADB -l CUST-V4-IN AS64496:AS-CUSTOMERS

Other output formats exist: -b for BIRD, -J for Junos, and -j for JSON that you can feed into automation. Check bgpq4 -h for your version.

For BIRD, a minimal flow looks like this:

bgpq4 -b -4 -A -m 24 -l CUST_V4 AS64496:AS-CUSTOMERS > /etc/bird/cust_v4.conf

Include the generated file, then reference the set in an import filter:

filter CUST_IN_V4 {
    if net ~ CUST_V4 then {
        if roa_check(r4, net, bgp_path.last) = ROA_INVALID then reject;
        accept;
    }
    reject;
}

Review the generated file's syntax against your BIRD version before you reload, since the output format has varied between bgpq releases. Our BIRD 2 configuration guide covers the filter and policy side in more detail.

Automate and Refresh

IRR data changes. A new customer is added, a route object is deleted, a prefix is sold. Filters generated once and never updated will start dropping valid routes. A simple approach is a daily cron job that:

1. Runs bgpq4 into a temporary file.
2. Checks that the file is not empty and the prefix count is sane.
3. Moves it into place and reloads the routing daemon.

Never let an empty result replace a working filter. Depending on how your policy is written, an empty prefix list can reject everything or, in a poorly written policy, accept more than you meant.

Check What the World Sees

Before opening a ticket with your upstream, query the databases yourself:

whois -h whois.radb.net -- '-i origin AS64496'
whois -h whois.ripe.net -- '-T as-set AS64496:AS-CUSTOMERS'
whois -h whois.radb.net '!iAS64496:AS-CUSTOMERS,1'

The first lists route objects with your ASN as origin. The second shows the AS-SET object in the RIPE database. The third expands the AS-SET recursively. Compare the output with the prefixes you actually announce. After the announcement, you can verify propagation from several locations with a public looking glass such as lg.nixconllc.com.

Why Your Customer AS-SET Matters

If you only ever announce your own prefixes, your ASN alone is enough. Once you carry other networks' routes, the AS-SET becomes the control point:

• Upstreams build filters from it. They expand your AS-SET and accept only what it resolves to. A customer who is not in the set, or has no route object, is dropped at the edge.
• It limits blast radius. A well-maintained set means a customer mistake, such as announcing a prefix they do not hold, does not pass through your upstream's filter.
• It speeds up onboarding. Adding a customer is one members: line plus a verified route object, not an email chain.
• It is your reputation. A set that includes unrelated or unverified ASNs, or an overly broad nested set, can pull in prefixes you never intended to vouch for.

Rules to follow:

1. Add a customer only after you have verified they hold the ASN and the prefix (RIR records, ROA, or a signed letter of authorization).
2. Remove customers promptly when service ends.
3. Avoid nesting AS-SETs you do not control. Their owners can change them without telling you.
4. Keep the set under a hierarchical name and protect it with a strong mnt-by maintainer.

Nixcon Group LLC operates AS40368 and applies the same model. When you bring your own ASN and IP block to a BGP-enabled VDS, ownership of the ASN and prefix is checked automatically against RPKI ROAs and official RIR/IRR records. Your ASN is then added to the AS-NIXCON AS-SET. That is what lets upstream filters accept your announcement without manual list updates.

Common Mistakes and Fixes

Summary

Route objects tell the world which ASN may originate each prefix. AS-SETs group the ASNs you speak for. bgpq4 converts both into filters your routers can enforce. Keep the objects accurate, use hierarchical AS-SET names, generate filters on a schedule, and combine IRR data with RPKI. If you also need DDoS-protected transit for your own prefixes, see DDoS protection and firewall.