DN42 on NAT VPS – Minimum Specs & Feasibility?

minhoryang · March 24

Hi all,

I’m trying to deploy DN42 on a NAT VPS, but I’m not sure what kind of specs I actually need.

First of all—hi! Recently got laid off, so I have plenty of time but not much budget. Figured this would be a good time to tinker and learn 🙂

What I’m planning to run:

Option A:
1 NAT VPS

1 Tailscale (WireGuard) connection for home connectivity
4~5 simultaneous WireGuard connections for dn42 peering
1 Raspberry Pi 4 at home: brid2 daemon + tailscale

Option B:
1 Nat VPS

1 Tailscale (WireGuard) connection for home connectivity
2~3 simultaneous WireGuard connections for dn42 peering
Bird2 daemon

My questions:

Would all of this run on a 1 vCPU / 512 MB RAM VPS? 1G Mem?
I’m thinking of isolating each component using Docker containers — is that feasible on a NAT VPS?
Since OpenVZ is container-based, does that mean Docker won’t work there?

I’m looking for something very low-cost, preferably with a yearly plan to keep things cheap. If there are providers offering trials, I might test first before committing.

I’ve learned a lot from reading posts here—thanks in advance for any advice or ideas!

oloke · March 24

@minhoryang said: Since OpenVZ is container-based, does that mean Docker won’t work there?

I would generally discourage purchasing OVZ containers in 2026. It's a very outdated technology. (relevant thread)

I think docker would work, but not sure how reliably. To save yourself hassle, go with KVM if you want to use docker.

JohnFilch123 · March 24

@minhoryang said: Since OpenVZ is container-based, does that mean Docker won’t work there?

While Oloke is absolutely right re OVZ, I would just add that sometimes Docker works on OVZ but it depends on the kernel version. Just avoid OVZ altogether and you will not have to ask this question.

minhoryang · March 24

Thank @oloke and @JohnFilch123 for the advice! I think I ended up considering OVZ just because I was digging through the cheapest providers I could find. Based on your feedback, I’ll rule OVZ out.

minhoryang · March 24

To be honest, I’ve been stuck in this loop for the past few hours—finding a super cheap provider, getting excited, then searching on LET and immediately seeing posts telling me to avoid it.

At this point, I’m wondering if I’m approaching this the wrong way. Given the kind of setup I described, could you help me back into a reasonable budget range? I’d rather set my expectations properly and be mentally prepared before pulling the trigger on anything.

Thanks again for the guidance!

JohnFilch123 · March 24

I have never tried DN42 but my feeling is that it will work on 1c/1gb/xxGB ssd machine. Budget is probably something like circa $7-12/y. Maybe try @SKRIME I think they have got a budget machine with unlimited traffic in NL.

oloke · March 24

@minhoryang what would be your expected budget? Often times on LET, you are able to get discounted promo plans at cost well under regular price. (but almost always limited)

At around $20/year I can recommend you:

Beware those are highly discounted promo plans so no trial instances or refunds are possible.

Should be more than enough for your use-case.

Neoon · March 24

any NAT VPS, with a few ports will do.
wireguard and bird run fine with 512MB or even less.

minhoryang · March 25

Thanks everyone for the helpful advice — really appreciate it!

I was originally thinking of a budget around ~$10/year for 2–3 NAT VPSes, but based on your suggestions, I’m starting to realize I probably need to raise that a bit and set more realistic expectations.

I did get a chance to run a few experiments last night before bed, and one thing that surprised me was that disk performance might actually become a bottleneck, especially since I was testing with a Docker-based setup.

Also, Docker seems a bit heavy on memory for what I’m trying to do, so I’m now considering moving to containerd or a lighter approach instead.

Thanks again — this really helped me rethink my approach!

JohnFilch123 · March 25

TierHive maybe try these guys, they have trial.

yoursunny · March 25

@JohnFilch123 said:
I have never tried DN42 but my feeling is that it will work on 1c/1gb/xxGB ssd machine.

We can run AS200690 full table on 1C1G20G.
DN42 fakenet is much smaller, so you surely can, in terms of RAM.

sunny@ixp8:~$ sudo birdc s r count
BIRD 2.17.1 ready.
4 of 4 routes for 4 networks in table master4
383271 of 383271 routes for 237261 networks in table master6
190158 of 190158 routes for 190158 networks in table rpki6
Total: 573433 of 573433 routes for 427423 networks in 3 tables
sunny@ixp8:~$ sudo birdc s mem
BIRD 2.17.1 ready.
BIRD memory usage
                  Effective    Overhead
Routing tables:     52.1 MB   8710.3 kB
Route attributes:   46.0 MB   6238.1 kB
Protocols:         712.1 kB     42.4 kB
Current config:    126.0 kB   1496.0  B
Standby memory:      0.0  B     48.0 kB
Total:              99.0 MB     14.7 MB

Active pages:       70.7 MB
Kept free pages:    44.0 kB
Cold free pages:   340.0 kB
sunny@ixp8:~$ free -m
               total        used        free      shared  buff/cache   available
Mem:             967         653         247           0         211         313
Swap:            511           0         511

@Neoon said:
any NAT VPS, with a few ports will do.
wireguard and bird run fine with 512MB or even less.

The UDP ports would be a limitation.
DN42 heavily utilizes WireGuard tunnels.

Normally WireGuard VPN server can have multiple peers on the same port, routing via AllowedIPs.
For DN42 usage, the routing is controlled by BGP and you have to set AllowedIPs=::/0, which means each BGP peer needs a separate UDP port.

If you only have 5 UDP ports, you can only have 5 peers.

forest · March 25

@minhoryang said:
Thank @oloke and @JohnFilch123 for the advice! I think I ended up considering OVZ just because I was digging through the cheapest providers I could find. Based on your feedback, I’ll rule OVZ out.

If you want the benefits of OpenVZ without using such outdated technology, there's LXC.

macguy · March 25

https://www.racknerd.com/NewYear/

Pick up the 1GB or 2GB VPS for $18/year, it will be more than enough power. They will also double your bandwidth if you comment in the RackNerd thread on this site.

Why bother with NAT if you can have a dedicated IP address for not much more money.
Keep in mind, not all RackNerd locations have IPv6.

To run a node on DN42, you pretty much just need Bird2 and Wireguard to get started.
Not sure what you're planning on running in docker, but that could possibly turn into a bit of a headache networking wise. Maybe not as bad if you're using "network_mode: host" in docker.

I would just get a cheap VPS and dedicate it to DN42, you can always wipe it and use it for something else if you lose interest.

I'm AS4242422455 if you want to peer or you have any questions.

paul_stewart · March 25

You could try a 1 vCPU and 1GB RAM KVM VPS for a smoother experience, especially if you're using Docker. While 512MB might work, 1GB provides more headroom for the OS and Docker overhead. Docker is perfectly feasible on a KVM NAT VPS.

glueckself · March 25

512MB with Debian 13 definetly works, as one of our routers is such a VPS.
It runs bird2 with 3 eBGP and 4 iBGP+OSPF peers peers, and pdns-auth and pdns-recursor containers.

$ free -h
               total        used        free      shared  buff/cache   available
Mem:           464Mi       170Mi        16Mi       168Ki       289Mi       294Mi
Swap:          2.0Gi       125Mi       1.9Gi

glueckself · March 25

Oh, and if you want to peer, AS4242420142

emperor · March 25

Location matters more than specs. Usually 1G and 512mb are not much different in terms of price, and nowadays its harder to find 512MB ram vms. So for 1GB rams there are more options, just share preferred location.

backtogeek · March 25

Maybe TierHive would be an option for playing with this, I mention it because you get a whole /24 that is already meshed between locations.

If you want to write about your experiences for the wider community and log how the setup goes, I am happy to give you some free credit to play with.

glueckself · March 25

@backtogeek, does TierHive support IPv6? Pretty much everybody runs dual-stack on DN42 anyway

backtogeek · March 25

@glueckself said:
@backtogeek, does TierHive support IPv6? Pretty much everybody runs dual-stack on DN42 anyway

That's a negative captain, it's coming soon though (Not with a tm)

minhoryang · March 27

Thanks again everyone — this has been super helpful and honestly saved me from going down a few bad paths.

After reading all your replies, I think I’ve got a much clearer picture now:

stick with KVM and containerd
1C/1GB seems like the “safe baseline” — 512MB might work, but probably not worth squeezing that hard
UDP port limits on NAT VPS are something I hadn’t fully considered — that’s a really important constraint for DN42 peering

I'll choose to go minimal with multiple cheap nodes from the beginning

Also @Macguy and @glueckself — I might actually take you up on the peering offer once I get things up and running.
Appreciate all the insights — this definitely helped me reset my expectations in a good way.

glueckself · March 27

I actually want to try if I can manage to get WG+Bird running stable on a 128M/1G/low-perf (the one for 0.1$/month) instance at TierHive.
apk install gets OOM killed without swap, so...

JohnFilch123 · March 27

@glueckself said: 128M

Ouch! I am running alpine on 386MB

glueckself · March 27

Well, can confirm, DN42 is doable with 128M + 256M swap (mostly for apk adds, and I'm not sure if the BGP sessions would survive an apk upgrade )
No IPv6 yet, but the v4 table is ~300kB per peer, so it should be able to support a few peerings.

edge04:/etc/bird/bird.conf.d# free -h
total        used        free      shared  buff/cache   available
Mem:          91.3M       38.5M       31.1M        1.5M       21.7M       46.4M
Swap:        256.0M        4.0M      252.0M
edge04:/etc/bird/bird.conf.d# birdc show proto
BIRD 2.17.3 ready.
Name       Proto      Table      State  Since         Info
device1    Device     ---        up     2026-03-27 21:14:06
kernel1    Kernel     vrf_dn42_6 up     2026-03-27 21:14:06
kernel2    Kernel     vrf_dn42_4 up     2026-03-27 21:14:06
static1    Static     vrf_dn42_4 up     2026-03-27 21:14:06
static2    Static     vrf_dn42_6 up     2026-03-27 21:14:06
int_ospf   OSPF       vrf_dn42_4 up     2026-03-27 21:14:06  Alone
int_ospf6  OSPF       vrf_dn42_6 up     2026-03-27 21:14:06  Alone
i_edge03   BGP        ---        up     2026-03-27 21:14:10  Established
edge04:/etc/bird/bird.conf.d# ip route list vrf vrf-dn42 | wc -l
1100

sshbox · March 27

@glueckself said:
Well, can confirm, DN42 is doable with 128M + 256M swap (mostly for apk adds, and I'm not sure if the BGP sessions would survive an apk upgrade )

Here's the relevant guide for paring down Alpine memory consumption, so that apk runs without swap:

https://tierhive.com/blog/tierhive-howto/how-to-run-alpine-with-just-23mb-ram

minhoryang · March 28

@glueckself said:
I actually want to try if I can manage to get WG+Bird running stable on a 128M/1G/low-perf (the one for 0.1$/month) instance at TierHive.
apk install gets OOM killed without swap, so...

Yesterday, I failed to docker build in 1G machine with 4 wireguard containers.

minhoryang · March 28

@sshbox said:

@glueckself said:
Well, can confirm, DN42 is doable with 128M + 256M swap (mostly for apk adds, and I'm not sure if the BGP sessions would survive an apk upgrade )

Here's the relevant guide for paring down Alpine memory consumption, so that apk runs without swap:

https://tierhive.com/blog/tierhive-howto/how-to-run-alpine-with-just-23mb-ram

OMG, that's very helpful. thank you!

glueckself · March 28

@minhoryang said:

Yesterday, I failed to docker build in 1G machine with 4 wireguard containers.

What do you mean with "with 4 wireguard containers"? Do you run one container for each peer?

minhoryang · March 28

@glueckself said:

@minhoryang said:

Yesterday, I failed to docker build in 1G machine with 4 wireguard containers.

What do you mean with "with 4 wireguard containers"? Do you run one container for each peer?

Yes, ... am I doing it wrong?

glueckself · March 28

Maybe, depending if you're just trying to get it running, or messing around/have other goals/...

If each peer is in its own container/namespace, how do you route between peers?

Howdy, Stranger!

Categories

In this Discussion

DN42 on NAT VPS – Minimum Specs & Feasibility?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

DN42 on NAT VPS – Minimum Specs & Feasibility?

Comments