Routinator 3000 is a free, open-source RPKI Relying Party written in Rust that validates RPKI data and serves it to routers, aimed at network operators and engineers running BGP who need to check route origin authorisations.

What it is

Routinator is RPKI Relying Party software. It runs as a service that periodically downloads RPKI data from the five Regional Internet Registries and verifies it, turning certificates and ROAs into validated payloads that can be used for BGP route origin validation. Written in Rust, it is designed for performance and memory safety, and it ships as a single service with a built-in HTTPS server and a built-in RTR server, so validation and delivery to routers happen in one process.

The concrete problem it solves is trusting which autonomous systems are allowed to originate which prefixes. Without a validator, an operator has no local answer to "is this announcement authorised by the prefix holder?" and must either rely on nothing or build the validating infrastructure alone. Routinator replaces that gap by ingesting RPKI objects published by AFRINIC, APNIC, ARIN, LACNIC and the RIPE NCC, verifying the certificate chain, and exposing the resulting Validated ROA Payloads locally over standard interfaces rather than leaving the operator to write their own fetcher, validator and cache.

Key capabilities

• Built-in RTR server so routers can fetch verified RPKI data directly, with no sidecar process required.
• Built-in HTTPS server providing a user interface, API endpoints for various file formats, logging, status output, and Prometheus metrics.
• Periodic download and verification of RPKI data as a long-running service, rather than a one-off tool.
• Runs on almost any hardware and platform with minimal system requirements, with packages available for most.
• Distributed as binary packages for Debian and Ubuntu, and for RHEL and compatible systems such as Rocky Linux.
• Runnable via Docker image nlnetlabs/routinator, or built from source with Cargo, the Rust package manager.
• Optional separation of concerns: RTR can run as a separate daemon using the RPKI data proxy RTRTR, letting validation be centralised and processed data distributed securely to various locations.

Who uses it and how

• Network operators running BGP who need local origin validation and want the validator and RTR service on one host.
• Teams that centralise validation and use RTRTR to distribute processed RPKI data to several routers or sites.
• Operators on Debian, Ubuntu, RHEL, Rocky Linux or containers who prefer packaged or Docker deployment over building from source.
• Environments that monitor routing infrastructure through Prometheus and need validator status and metrics alongside other network telemetry.
• Smaller operators with modest hardware, since the project targets minimal system requirements and broad platform support.

Getting started

Install a binary package for Debian, Ubuntu, RHEL or a compatible system such as Rocky Linux, or run the nlnetlabs/routinator Docker image, or build from source using Cargo. Full instructions live in the documentation at routinator.docs.nlnetlabs.nl.

How it compares

The facts provided name no paid products that Routinator replaces, so no cost or licence comparison against commercial validators can be made here. The only comparable tool named is RTRTR, NLnet Labs' RPKI data proxy, which is complementary rather than competing: Routinator validates and serves, while RTRTR centralises validation and distributes the processed data to multiple locations. No other RPKI validator appears in the details given for this registry.

When to use it — and when not to

A self-hoster must operate a long-running service that periodically fetches RPKI data over the network and keeps validated output current, and should monitor it through the status endpoint or Prometheus metrics rather than assuming it stays healthy unattended. It is a poor fit for anyone who does not run BGP or RPKI, and the facts name no hosted option, so deployment is self-managed unless professional support and consultancy with a service-level agreement is purchased from NLnet Labs. The BSD 3-Clause licence is clear and permissive, and the README is descriptive rather than deep, so operators should expect to rely on the separate documentation site for configuration detail.