Advanced Network¶

Overview¶

The Advanced Network plugin (plugin ID: advanced-network) provides enterprise-grade networking capabilities powered by FRR (Free Range Routing):

BGP (Border Gateway Protocol) peering and route advertisement
GRE and VXLAN tunnels between servers
Keepalived VRRP (virtual IP failover)
Keepalived Virtual Servers (load balancing)
BGP FlowSpec (traffic shaping / DDoS mitigation)
Static routes and loopback IPs
Prefix lists for route filtering

Requires the advanced-network plugin to be enabled. All endpoints require superuser.

FRR Service¶

POST /api/advanced-network/service/install
POST /api/advanced-network/service/start
POST /api/advanced-network/service/stop
POST /api/advanced-network/service/restart
GET /api/advanced-network/service/status

BGP Configuration¶

Basic Config¶

GET /api/advanced-network/bgp/config

POST /api/advanced-network/bgp/config
{
  "asn": 65001,
  "router_id": "10.0.0.1",
  "hold_time": 90,
  "keepalive": 30
}

Auto-Detect¶

POST /api/advanced-network/bgp/auto-detect

Attempts to detect ASN and router ID from the server's network configuration.

BGP Peers¶

GET /api/advanced-network/bgp/peers

POST /api/advanced-network/bgp/peers
{
  "name": "Upstream ISP",
  "neighbor_ip": "203.0.113.1",
  "remote_asn": 64496,
  "description": "Transit peer",
  "password": "bgp-secret"
}

PUT /api/advanced-network/bgp/peers/:id
DELETE /api/advanced-network/bgp/peers/:id

BGP Networks (Announcements)¶

GET /api/advanced-network/bgp/networks

POST /api/advanced-network/bgp/networks
{
  "prefix": "203.0.113.0/24",
  "description": "My IP block"
}

DELETE /api/advanced-network/bgp/networks/:id

BGP Status¶

GET /api/advanced-network/bgp/status
GET /api/advanced-network/bgp/summary
GET /api/advanced-network/bgp/routes
GET /api/advanced-network/bgp/routes-detail
GET /api/advanced-network/bgp/events

BGP FlowSpec¶

FlowSpec is used for traffic shaping and DDoS mitigation by advertising flow rules over BGP:

GET /api/advanced-network/bgp/flowspec
GET /api/advanced-network/bgp/flowspec/supported
GET /api/advanced-network/bgp/flowspec/templates

POST /api/advanced-network/bgp/flowspec
{
  "name": "Block DDoS Source",
  "dst_prefix": "203.0.113.5/32",
  "src_prefix": "198.51.100.0/24",
  "protocol": "tcp",
  "dst_port": 80,
  "action": "discard"
}

PUT /api/advanced-network/bgp/flowspec/:id
DELETE /api/advanced-network/bgp/flowspec/:id

BGP Blackholes¶

Advertise null-route blackholes to upstream peers:

GET /api/advanced-network/bgp/blackholes

POST /api/advanced-network/bgp/blackholes
{
  "prefix": "192.0.2.1/32",
  "community": "65001:666"
}

DELETE /api/advanced-network/bgp/blackholes/:id

Prefix Lists¶

GET /api/advanced-network/prefix-lists
POST /api/advanced-network/prefix-lists
{ "name": "my-prefixes", "description": "..." }

PUT /api/advanced-network/prefix-lists/:id
DELETE /api/advanced-network/prefix-lists/:id

GET /api/advanced-network/prefix-lists/:id/entries
POST /api/advanced-network/prefix-lists/:id/entries
{ "prefix": "203.0.113.0/24", "action": "permit", "le": 32 }

PUT /api/advanced-network/prefix-lists/:id/entries/:eid
DELETE /api/advanced-network/prefix-lists/:id/entries/:eid

# Sync prefix lists to FRR BGP config
POST /api/advanced-network/prefix-lists/sync-bgp

Static Routes¶

GET /api/advanced-network/static-routes

POST /api/advanced-network/static-routes
{
  "destination": "10.0.0.0/8",
  "nexthop": "192.168.1.1",
  "interface": "eth0"
}

PUT /api/advanced-network/static-routes/:id
DELETE /api/advanced-network/static-routes/:id
POST /api/advanced-network/static-routes/:id/toggle

Loopback IPs (Self IPs)¶

GET /api/advanced-network/loopbacks

POST /api/advanced-network/loopbacks
{ "ip": "203.0.113.100", "mask": "32" }

POST /api/advanced-network/loopbacks/:id/toggle
DELETE /api/advanced-network/loopbacks/:id

Network Interfaces¶

GET /api/advanced-network/interfaces
GET /api/advanced-network/interface-ips

Tunnels (GRE / VXLAN)¶

Check WireGuard Support¶

GET /api/advanced-network/tunnels/check-wireguard
POST /api/advanced-network/tunnels/install-wireguard

List Tunnels¶

GET /api/advanced-network/tunnels
GET /api/advanced-network/tunnels/status

Create a Tunnel¶

POST /api/advanced-network/tunnels
{
  "name": "DC-to-Edge",
  "type": "gre",
  "local_ip": "10.0.0.1",
  "remote_ip": "10.0.0.2",
  "local_tun_ip": "192.168.100.1",
  "remote_tun_ip": "192.168.100.2",
  "auto_pair": true
}

Tunnel types: gre, vxlan, wireguard

Update / Delete / Toggle¶

PUT /api/advanced-network/tunnels/:id
DELETE /api/advanced-network/tunnels/:id
POST /api/advanced-network/tunnels/:id/toggle
POST /api/advanced-network/tunnels/:id/retry-pair

Bridge MAC Table¶

GET /api/advanced-network/tunnels/:id/mac-table

Tunnel Peers (WireGuard)¶

GET /api/advanced-network/tunnels/:id/peers
POST /api/advanced-network/tunnels/:id/peers
{ "public_key": "...", "allowed_ips": "10.0.0.0/24" }

PUT /api/advanced-network/tunnels/:id/peers/:pid
DELETE /api/advanced-network/tunnels/:id/peers/:pid

GET /api/advanced-network/tunnels/:id/peers/:pid/config
GET /api/advanced-network/tunnels/:id/peers/:pid/qr

Remote Subnets (for auto-pairing)¶

GET /api/advanced-network/tunnels/remote-subnets/:ip

Public Subnets (public, no auth)¶

GET /api/advanced-network/public-subnets

Tunnel Auto-Pairing (public, no auth)¶

When auto_pair: true is set, the remote server is contacted at this endpoint to complete the WireGuard handshake:

POST /api/advanced-network/tunnel-pair

Keepalived VRRP¶

GET /api/advanced-network/keepalived/vrrp

POST /api/advanced-network/keepalived/vrrp
{
  "instance": "VI_1",
  "interface": "eth0",
  "virtual_router_id": 51,
  "priority": 100,
  "auth_pass": "secret"
}

PUT /api/advanced-network/keepalived/vrrp/:id
DELETE /api/advanced-network/keepalived/vrrp/:id

# Virtual IPs on a VRRP instance
POST /api/advanced-network/keepalived/vrrp/:id/vips
{ "ip": "203.0.113.100/24", "interface": "eth0" }
DELETE /api/advanced-network/keepalived/vrrp/:id/vips/:vid

Keepalived Virtual Servers¶

GET /api/advanced-network/keepalived/vs

POST /api/advanced-network/keepalived/vs
{
  "address": "203.0.113.100",
  "port": 80,
  "protocol": "TCP",
  "scheduler": "rr"
}

PUT /api/advanced-network/keepalived/vs/:id
DELETE /api/advanced-network/keepalived/vs/:id

# Real servers
GET /api/advanced-network/keepalived/vs/:id/rs
POST /api/advanced-network/keepalived/vs/:id/rs
{ "address": "10.0.0.1", "port": 80, "weight": 1 }

PUT /api/advanced-network/keepalived/vs/:id/rs/:rid
DELETE /api/advanced-network/keepalived/vs/:id/rs/:rid

Keepalived Status & Control¶

GET /api/advanced-network/keepalived/status
POST /api/advanced-network/keepalived/install
POST /api/advanced-network/keepalived/restart
POST /api/advanced-network/keepalived/check-l2

Config Export / Import¶

GET /api/advanced-network/export
POST /api/advanced-network/import
{ "config": "..." }