{"id":385,"date":"2026-06-19T10:04:51","date_gmt":"2026-06-19T10:04:51","guid":{"rendered":"https:\/\/ip4.market\/blog\/385-2\/"},"modified":"2026-07-31T14:10:51","modified_gmt":"2026-07-31T14:10:51","slug":"rpki-routing-security-key-to-protecting-ipv4-networks","status":"publish","type":"post","link":"https:\/\/ip4.market\/blog\/rpki-routing-security-key-to-protecting-ipv4-networks\/","title":{"rendered":"RPKI Routing Security: Key to Protecting IPv4 Networks"},"content":{"rendered":"
\nIn this article:<\/strong><\/p>\n
    \n
  1. What is RPKI and Why Does It Matter for IPv4?<\/a><\/li>\n
  2. The Core Components of RPKI Routing Security<\/a><\/li>\n
  3. Implementing RPKI: Practical Steps for Network Operators<\/a><\/li>\n
  4. RPKI Adoption and Market Impact<\/a><\/li>\n
  5. Common Questions About RPKI<\/a><\/li>\n
  6. How IP4 Market Supports Secure Routing<\/a><\/li>\n<\/ol>\n<\/div>\n

    The IPv4 market is on fire. More and more blocks are changing hands, and naturally, the million-dollar question arises: who is actually authorized to announce them? RPKI<\/strong> is the technical answer we’ve needed for years. A system of cryptographic certificates that ties each IP prefix to its rightful owner. This prevents BGP route hijacking, where an attacker suddenly diverts your traffic. In this text, I’ll explain what RPKI is, how it secures IPv4 address routing, and why if you’re a network operator, you should already be using it.<\/p>\n

    What is RPKI and Why Does It Matter for IPv4?<\/h2>\n

    RPKI (Resource Public Key Infrastructure) is a system that prevents unauthorized BGP announcements. It works by creating a chain of trust for IP blocks. The holder of a prefix\u2014a “resource”\u2014issues a ROA (Route Origin Authorization) declaring: “this AS can originate this prefix.” Routers then validate announcements against this database. And if they don’t match, they discard them.<\/p>\n

    For the IPv4 community, this isn’t a luxury. It prevents traffic theft, service outages, and financial loss. And make no mistake, it happens more often than you think.<\/p>\n

    The route hijacking problem<\/h3>\n

    Without RPKI, BGP operates on faith. Any AS can announce any prefix, and if the route is more specific or the AS path is shorter, the internet propagates it. There have been notorious cases: the Amazon DNS hijack in 2018, the Swiss ISP hijack in 2021. Millions of dollars in damages. RPKI cuts this off at the root by cryptographically linking each prefix to a legitimate origin AS.<\/p>\n

    How it works (the ROA)<\/h3>\n

    A ROA is a digitally signed object. It states: “Prefix X can be announced by AS Y, with a maximum prefix length of Z.” The signature is generated using the private key of the IP holder, which is in turn linked to the public key infrastructure of the RIRs (Regional Internet Registries). Routers performing RPKI validation download these ROAs and cross-reference them with incoming BGP announcements.<\/p>\n

    The Core Components of RPKI<\/h2>\n

    Resource Public Key Infrastructure<\/h3>\n

    RPKI is a hierarchy of certificates that mirrors how IPs are assigned: IANA \u2192 RIR \u2192 NIR \u2192 LIR \u2192 end user. Each certificate includes the prefix and the public key of the next level down. This creates an immutable record of who owns what.<\/p>\n

    The ROA (Route Origin Authorization)<\/h3>\n

    ROAs are the operational heart. They are created by the prefix owner from their RIR’s portal (ARIN, RIPE, APNIC…). They typically specify:<\/p>\n

      \n
    • The IP prefix (e.g., 203.0.113.0\/24)<\/li>\n
    • The AS number (e.g., AS64500)<\/li>\n
    • The maximum prefix length (e.g., \/24, meaning more specific subnets are not allowed)<\/li>\n<\/ul>\n

      Announcements that exactly match or fall within a ROA are Valid<\/strong>. Those without a matching ROA are NotFound<\/strong>. And those that conflict are Invalid<\/strong>.<\/p>\n

      RPKI Validation<\/h3>\n

      To enforce RPKI, you need a validator (Routinator, OctoRPKI, or a cloud service). This periodically downloads global data, verifies signatures, and generates a list of validated ROAs (VRPs). Then, the router, using BGP policies, filters based on that list:<\/p>\n

        \n
      • Reject Invalid<\/strong> routes (the most aggressive approach)<\/li>\n
      • Only accept Valid<\/strong> routes (most secure, but you might lose legitimate NotFound routes)<\/li>\n
      • Prefer Valid over NotFound (a balanced approach)<\/li>\n<\/ul>\n

        My advice: start by rejecting Invalid<\/em> routes and monitor for false positives.<\/p>\n

        Implementing RPKI: Practical Steps<\/h2>\n

        Step 1: Obtain a ROA<\/h3>\n

        Log into your RIR account, look for “RPKI” or “ROA Management,” and create one for each prefix you hold. Specify the AS you use to announce that prefix and the maximum length. Review this every quarter, as topologies change.<\/p>\n

        Step 2: Configure the router<\/h3>\n

        Most modern routers (Cisco IOS-XR, Juniper JunOS, Arista EOS, BIRD, FRRouting) support RPKI validation. Here is an example using BIRD on Linux:<\/p>\n

        protocol rpki rpki_global {<\/code>
        \n roa4 { table rpki_table; };<\/code>
        \n remote 10.0.0.1; port 323;<\/code>
        \n retry keep 90;<\/code>
        \n refresh 3600;<\/code>
        \n expire 7200;<\/code>
        \n}<\/code><\/p>\n

        You then apply a BGP import policy that queries the RPKI table.<\/p>\n

        Step 3: Monitor and maintain<\/h3>\n

        Set up alerts for BGP updates flagged as Invalid. Whenever you acquire or transfer IPv4, create a ROA immediately. Some marketplaces\u2014like IP4 Market\u2014require verified ownership. Using RPKI adds a layer of cryptographic proof that you are the legitimate holder.<\/p>\n

        RPKI Adoption and Market Impact<\/h2>\n

        As of today (2024), 40% of announced IPv4 prefixes have a ROA. And major operators (NTT, Cogent, Level 3) are already actively rejecting Invalid routes. This pushes everyone else to secure their prefixes. Here is a quick comparison:<\/p>\n

        \n\n\n\n\n\n\n\n\n
        Factor<\/th>\nWithout RPKI<\/th>\nWith RPKI<\/th>\n<\/tr>\n<\/thead>\n
        Hijacking Risk<\/td>\nHigh \u2013 anyone can announce your prefix<\/td>\nLow \u2013 only the authorized AS<\/td>\n<\/tr>\n
        Ownership Verification<\/td>\nManual, prone to error<\/td>\nCryptographic, automated<\/td>\n<\/tr>\n
        Impact on IPv4 Trading<\/td>\nFrequent disputes, slow transfers<\/td>\nClear provenance, fast transactions<\/td>\n<\/tr>\n
        RIR Compliance<\/td>\nVoluntary<\/td>\nIncreasingly mandatory for transfers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
        \nTip:<\/strong> When buying IPv4 on a marketplace like IP4 Market, always check if the seller has issued ROAs. A block without a ROA might be poorly managed or fraudulent. Verified sellers on IP4 Market provide ROA evidence as part of the transaction.\n<\/div>\n

        Common Questions About RPKI<\/h2>\n
        \n

        Q: Does RPKI affect my outbound traffic?<\/strong>
        \nNo. RPKI only filters inbound<\/em> BGP announcements. Your network can continue announcing prefixes without a ROA (though your transit providers may drop them if they are Invalid).<\/p>\n

        Q: Can RPKI break my current routing?<\/strong>
        \nIf you create accurate ROAs, nothing breaks. Only Invalid routes that conflict with your ROA are rejected. Most networks start with “reject Invalid” and experience no issues.<\/p>\n

        Q: Can RPKI be used for IPv6?<\/strong>
        \nYes, the same infrastructure works for both IPv4 and IPv6. This article focuses on IPv4, but the principles apply equally.<\/p>\n<\/div>\n

        How IP4 Market Supports Secure Routing<\/h2>\n

        At IP4 Market, we take routing security seriously. Every listing goes through a verification process that checks RIR records and, where possible, ROA status. Our platform connects buyers with verified sellers who maintain RPKI-ready addresses, reducing the risk of post-transfer hijacking. We also provide tools so you can generate ROAs as soon as a block is transferred to<\/p>\n","protected":false},"excerpt":{"rendered":"

        In this article: What is RPKI and Why Does It Matter for IPv4? The Core Components of RPKI Routing Security Implementing RPKI: Practical Steps for Network Operators RPKI Adoption and…<\/p>\n","protected":false},"author":1,"featured_media":387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-385","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-redes"],"_links":{"self":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/385","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/comments?post=385"}],"version-history":[{"count":3,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/385\/revisions"}],"predecessor-version":[{"id":807,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/385\/revisions\/807"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/media\/387"}],"wp:attachment":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/media?parent=385"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/categories?post=385"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/tags?post=385"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}