BGP (Border Gateway Protocol)

Border Gateway Protocol (BGP) is the standardized exterior gateway protocol that lets independently operated networks — autonomous systems (AS) — tell each other which blocks of IP address space they can reach. It is a path-vector protocol: rather than computing a shortest path by link cost the way interior routing protocols do, BGP advertises full AS-path lists and lets every network apply its own policy when choosing among routes. Each participating network holds a unique Autonomous System Number (ASN) assigned through the regional internet registries, and the public internet is, at the routing layer, nothing more than the sum of these AS-to-AS announcements. There is no central routing authority — which makes BGP one of the largest functioning examples of decentralized coordination in existence, with all the strengths and fragilities that implies.

eBGP, iBGP, and route selection

When BGP runs between routers in two different autonomous systems it is external BGP (eBGP); when it distributes those learned routes among routers inside one AS it is internal BGP (iBGP). Through peering sessions, routers exchange prefixes — say, 203.0.113.0/24 — together with attributes including the AS-path required to reach them. Best-path selection walks a policy-driven decision ladder: local preference (the operator's own ranking) outranks AS-path length, which outranks finer tie-breakers. That policy freedom is the point — a network can prefer a cheaper transit provider over a shorter path — but it is also the weakness: routers largely believe what they are told. Misconfigured or malicious announcements can hijack or black-hole traffic for whole prefixes, as several famous incidents have demonstrated, which is why prefix filtering between peers and RPKI origin validation — cryptographic attestation of which ASN may announce a prefix — have become baseline hygiene.

Why it matters for sovereignty

BGP is the layer at which a network stops being a customer and becomes a peer. Everything below it — your ISP account, your public IP, your ability to accept inbound connections — is rented. Operating your own ASN and provider-independent address space, then announcing it via BGP through multiple upstreams, removes dependence on any single provider's allocation and goodwill: if one upstream fails or cuts you off, your addresses remain yours and traffic reroutes through the others. This is the foundation for genuinely resilient self-hosted infrastructure and for anycast deployments, where the same prefix is announced from multiple locations at once. It is also where internet censorship and de-platforming become visible as routing events rather than abstractions — a network that cannot be un-announced by someone else's decision is sovereign in a sense no amount of application-layer cleverness can match.

The realistic on-ramp

For a self-hoster, BGP is the deep end of the pool, but the ladder into it is real: ASNs and small IPv6 allocations are inexpensive through regional registries and their sponsoring LIRs, several VPS providers will speak BGP with hobbyists, and communities of amateur network operators run exactly this stack for learning and for keeping small services genuinely multi-homed. Most operators sensibly begin further down: a solid firewall, sane subnetting, port forwarding done deliberately, and perhaps a reverse proxy in front of services. But it is worth knowing what the top of the ladder looks like: a Bitcoin node, a relay, or a mining operation announced from address space you control, reachable as long as any one of your upstreams is honest — the routing-layer expression of the same principle that has you running the node in the first place.

Even if you never announce a prefix yourself, BGP literacy pays: looking-glass servers and public route collectors let anyone inspect how the internet reaches their network, which upstreams sit in the path, and whether their prefixes are covered by RPKI. Verifying the route to your own node is the network-layer cousin of verifying your own blocks.