=============== LIBRARY RULES =============== From library maintainers: - Documentation sources are MyST Markdown (.md). Cite and link to the .md form. - VyOS has two CLI modes: configuration mode (entered via `configure`; for `set`/`delete`/`commit`/`save` and config-state `show`) and operational mode (default after login; for `show`, `monitor`, plus image-mgmt like `add system image`). Do not mix. - Configuration commands are wrapped in `cfgcmd` fenced blocks; operational commands in `opcmd` fenced blocks. Treat these as authoritative command syntax. - Branch-to-version mapping (cite version-appropriate docs): `rolling` = rolling / next major, 1.6+ (default); `circinus` = 1.5.x (current LTS); `sagitta` = 1.4.x (previous LTS); `equuleus` = 1.3.x (legacy); `crux` = 1.2.x (legacy). - Do not invent CLI commands. If a command isn't in the docs, say so rather than guess — VyOS syntax is strict and unknown commands fail validation at commit time. - Use reserved documentation IP space in examples: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 (RFC 5737), 2001:db8::/32 (RFC 3849). Never use real or RFC1918 addresses. - `commit` activates pending `set`/`delete` changes and runs validation (errors = no change applied); `save` persists across reboot. Verify with `show ` (config mode) or `show configuration commands` (op mode). Always include `commit` and `save`. - VyOS is image-based, not package-managed. Upgrade in op mode: `add system image `, optionally `set system image default-boot `, then `reboot` to activate. Do not recommend `apt install` for VyOS components — it bypasses the image system. - Do not recommend raw Linux commands (`ip`, `iptables`, `systemctl`, NetworkManager) for VyOS configuration — they bypass the CLI and do not persist. Use `set/delete/commit/save`. Read-only Linux inspection from op mode is fine. - Quote CLI strings containing spaces or special chars with single quotes (e.g. `set system host-name 'edge-01'`). Top-level `set`/`delete` lines must include the full path; relative paths only work inside an `edit` subtree (e.g. `edit firewall name FOO`). - Routing protocols (BGP, OSPF, IS-IS, RIP) are FRR-backed, but not every FRR knob is exposed through the VyOS CLI. Confirm a command exists in the VyOS docs before suggesting it — synthesizing from FRR documentation produces invalid VyOS commands. ### Configuration Example - Typical 2 Node Setup Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/protocols/ospf.md Example configuration for a typical OSPFv3 setup with two nodes, including interface and area configuration, and redistribution. ```none set protocols ospfv3 interface eth1 area 0.0.0.0 set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 set protocols ospfv3 parameters router-id 192.168.1.1 set protocols ospfv3 redistribute connected ``` ```none set protocols ospfv3 interface eth1 area 0.0.0.0 set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 set protocols ospfv3 parameters router-id 192.168.2.1 set protocols ospfv3 redistribute connected ``` -------------------------------- ### Example Synproxy Configuration Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/firewall/ipv4.md A complete example demonstrating the setup of synproxy, including enabling syncookies, disabling loose tracking, ignoring specific connections, and applying synproxy to a rule. ```configuration set system sysctl parameter net.ipv4.tcp_timestamps value '1' set system conntrack tcp loose disable set system conntrack ignore ipv4 rule 10 destination port '8080' set system conntrack ignore ipv4 rule 10 protocol 'tcp' set system conntrack ignore ipv4 rule 10 tcp flags syn set firewall global-options syn-cookies 'enable' set firewall ipv4 input filter rule 10 action 'synproxy' set firewall ipv4 input filter rule 10 destination port '8080' set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' set firewall ipv4 input filter rule 10 protocol 'tcp' set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' set firewall ipv4 input filter rule 1000 action 'drop' set firewall ipv4 input filter rule 1000 state invalid ``` -------------------------------- ### Cloning and Setup Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/documentation.md Steps to clone the forked repository, install requirements, and create a new branch. ```bash $ cd vyos-documentation $ pip install -r requirements.txt $ git checkout -b ``` -------------------------------- ### Install Ansible Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configexamples/ansible.md Command to install Ansible on a Debian-based system. ```none # apt-get install ansible Do you want to continue? [Y/n] y ``` -------------------------------- ### Diffie-Hellman Key Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example of generating and installing a Diffie-Hellman key. ```vyos-config vyos@vyos# run generate pki dh install dh-1 Enter DH parameters key size: (Default: 2048) Generating parameters... 1 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply. [edit] vyos@vyos# compare [pki] + dh dh-1 { parameters "MIIBCAKCAQEAp25kxwZeLZ7wcbRii5E5RD4uWCUOBxarzKEE0msa84omh5nZ9dv/4bfJw4gIXlA2+sGc2lLV/jajZminMryiSwJdisyVuUdOB7sJWZwrzHBAY0qFbNyaRMVJBar2xVm+XcKd3A2eNTEgn10G7rPPvf6CJ5isUKFaKT8ymUv+mI0upLneYdGs8/yS3sAojzeulCf49fa5SiaGCcZZkdOI3Nby1u/ZG4okqJ2wE2c2hRVLs1k5qrrono0OF4Dh0B91ihnywRfp1xPYeqpiln+OPh+PPgTuBxkz4VxwRDoQ+NhVr/LOCb3vbhnyFisxI0w4r3109cA3QiDmo1L14aKl1wIBAg==" } [edit] vyos@vyos# commit ``` -------------------------------- ### Configure Firewall Groups Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md Create interface and network groups for easier firewall configuration. This example defines WAN and LAN interface groups and an internal network group. ```none set firewall group interface-group WAN interface eth0 set firewall group interface-group LAN interface eth1 set firewall group network-group NET-INSIDE-v4 network '192.168.0.0/24' ``` -------------------------------- ### Server-Client Certificates Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example of generating and installing server-client certificates. ```vyos-config vyos@vyos# compare [pki certificate] + srv-1 { certificate "MIIDrDCCApSgAwIBAgIULpu+qZjfG01kUI58XNmqXbQC3qQwDQYJKoZIhvcNAQELBQAwVDELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzENMAsGA1UEAwwEY2EtMTAeFw0yNTA2MTExMTMxMDJaFw0yNjA2MTExMTMxMDJaMFUxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDjAMBgNVBAMMBXNydi0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAysTrMfVH63aVidJT7bIf+zLwkLse07nGsv4aliGEbufr239RBHV4Jn8LbQ+nB/8mhYGjNY4OnZ7NYz3FU/iglo8qFtaZ26mWtPWpv2xW1F8JAEK7l5BAg42cBucxiIZFeRm+jkE6VN1bcNU0utnn3sbCwZMyH6pS9k08G1qrrFLA7ZFhv5AmgJcODmO8sigSAu7rRS/6O3eO6ICnVjvIfHLb+9DKKUEffHzFV8RrkqVCGmgisz9fF+j1Rvg9s+ylNc2lZJTbb1XnzixvSRro4t9I3uIWdpJ0iOu09YiTXGQgH9ER6V3rFiX00RdSiSXf+MJCV64hC1msg+8V3Nrw9QIDAQABo3UwczAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUzH0h4vBxma89HF9rUQ+DW052c5swHwYDVR0jBBgwFoAUAG9lvr7AzJ/y4vY/XlWxXru+6m0wDQYJKoZIhvcNAQELBQADggEBAI/Cyd0y7AJ7wY3yRssCud2iJAl9/ZjgxzXOUo6ibawYIYOnSf9tS3eD4CIH4BgppDXoJZ/qEA4WvIsLx3yvnyOxiqyk3TQmKIZ27VJH+yQkgzPeiKrHn1pCXBKEb1/jlT8Ozu4Lmn/oFwDH6nk8toxI8DM+qsTxqUFlTA3ea9yaRtxeNPMWJdaxZSUYGVSZL0wVKw5ZuQ1Gn7vGVApWlYDKYbMozCuZUG1q8wMzFBRa7x0anvh5hM4bksLz+Y1ujCS8f8b4Xtb8KIdFrZtTvtl97crv62bN05VueAcbwtYbIBNWNoT/CvmqV7k3uPg95GYSNddFqEMbQHoyd8hdDCo=" private { key "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDKxOsx9UfrdpWJ0lPtsh/7MvCQux7Tucay/hqWIYRu5+vbf1EEdXgmfwttD6cH/yaFgaM1jg6dns1jPcVT+KCWjyoW1pnbqZa09am/bFbUXwkAQruXkECDjZwG5zGIhkV5Gb6OQTpU3Vtw1TS62efexsLBkzIfqlL2TTwbWqusUsDtkWG/kCaAlw4OY7yyKBIC7utFL/o7d47ogKdWO8h8ctv70MopQR98fMVXxGuSpUIaaCKzP18X6PVG+D2z7KU1zaVklNtvVefOLG9JGuji30je4hZ2knSI67T1iJNcZCAf0RHpXesWJfTRF1KJJd/4wkJXriELWayD7xXc2vD1AgMBAAECggEACsUk3PVzSX11+ekTDigM7NHK11UpEQPoGu/GR70mBKIK9BCyI/N9W0YaPEO9kn4p9KNrINgXzKV3sVLBnXEyTmzyRl5Fs9YxLBF0X7eIcSVPHBVvU2CVHKez5uX2ypKfNAx7A6FRUNqlFbwtXdNfLoUOKSwBWI86ctytWaKaRb/TTSGQkaP/z/cwIsXOLfG9m6iFkw98ShUzalrUWNo/4fJKlO1+DvXVYE9sv9rjD8J7DtAbr5KykQ5n0AAlZTCWQ7jwMybSnjjY9ypZUms0l17raJrfhrdbWayc6xMDvtrmNIDebkF+J7cHU06aEV+yQXV/7yjyZgUSM2ANcHMdzQKBgQDmTi5tUeaj1JUSl9lAP/XUzcElw2tcU1B8qpX69J4ofjTNgj5okLWQZVIy1UyAfLOI3LJbHTBUtSvedhH0VaMulq99NXs5qnbPGG3//RBAc0wKhJknB5Qv0D3FxMI14kMO6jzPly+aIGEk4dTtHvZuHbbVHbKSZ5MMouLyT+SS7wKBgQDhZETARZ0MazeWRaPJwdkjlfNcqqcsnDicdcppCkcDCjeLxkVPZc8ej37rshOvw2Pf1D0PddGyOhJoWCWA8QE2LQoDHLaDnQ0L6aQ3yjN5Gxx9RCDFi3Zuat/mPcv3tFO7uUmeYvRC5fGYrghq29NADmUefOopAc06Izd4A3iqWwKBgQC1uPrpR7a1jwgRo7/I8q8HO1MseQY903+u3ut5GYuyZ+NCRYL4/zZEua4ibivvNnZzh7E0M9PvAwWag4+nO+uG11+hbJHO7rLQtnYVh5lLQa6+neI66cAD+kzDwH1+BwriufFB3Amzk9kTQR7B+6x3NvsNLmG5JADj96Mbj+7MAQKBgFIevEXplyzdK6WevexWqoyip8aNjtdcG+w1pofa7MCYymAs3zfseihCVBYADdguModsxsqJPNvY+Lf31cJDDRP2GP3FSmJtqEE84U5KZ7KqRBkH54DSLVZRrj4vKc+YbiGpgr8ogqKVMQ9V6U81xKREGmefT5mdRG74Qc+CREadAoGAFtdsH5js1yFEeGFad4BZJ69grEavD3pNCfIe9oIPtXvvFdzxd+QbKgqFf3JMJp/HYi8A0iv/i4mzf00KXzF4JU7bIJYrUVlk/w8x77gzDRIphsPqpMBJkTI0jisQHZKWNEe7IbmM/dWW2S4jvCkrhB7F5Szf72Q+j/lPbfx2g/8=" } } ``` -------------------------------- ### Packet Capture Examples Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/vpp/troubleshooting.md Examples of starting packet capture with different parameters. ```bash # Start capturing tx packets with specific parameters sudo vppctl pcap trace tx max 35 intfc eth1 file vpp_eth1.pcap # Capture all packet types from any interface sudo vppctl pcap trace rx tx drop max 1000 intfc any file vpp_capture.pcap max-bytes-per-pkt 128 ``` -------------------------------- ### Install Paramiko Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configexamples/ansible.md Command to install the Paramiko library, often a dependency for Ansible network modules. ```none #apt-get install -y python3-paramiko ``` -------------------------------- ### OpenVPN Server Configuration Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example configuration for an OpenVPN server setup. ```vyos-config set interfaces openvpn vtun10 local-port '1194' set interfaces openvpn vtun10 mode 'server' set interfaces openvpn vtun10 openvpn-option '--auth-user-pass-verify /config/auth/check_user.sh via-env' set interfaces openvpn vtun10 openvpn-option '--script-security 3' set interfaces openvpn vtun10 persistent-tunnel set interfaces openvpn vtun10 protocol 'udp' set interfaces openvpn vtun10 server client client-1 ip '10.10.10.55' set interfaces openvpn vtun10 server push-route 192.0.2.0/24 set interfaces openvpn vtun10 server subnet '10.10.10.0/24' set interfaces openvpn vtun10 server topology 'subnet' set interfaces openvpn vtun10 tls ca-certificate 'ca-1' set interfaces openvpn vtun10 tls certificate 'srv-1' set interfaces openvpn vtun10 tls dh-params 'dh-1' ``` -------------------------------- ### Example IPv4 Firewall Configuration Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/firewall/ipv4.md An example configuration snippet demonstrating IPv4 firewall setup, including network groups and rules. ```configuration firewall { group { network-group BAD-NETWORKS { network 198.51.100.0/24 network 203.0.113.0/24 } network-group GOOD-NETWORKS { network 192.0.2.0/24 } port-group BAD-PORTS { port 65535 } } ipv4 { forward { filter { default-action accept rule 5 { action accept source { group { network-group GOOD-NETWORKS } } } rule 10 { action drop description "Bad Networks" protocol all source { group { network-group BAD-NETWORKS } } } } } } } ``` -------------------------------- ### MFA QR Code Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example output of the command to display the TOTP QR code for a user, used for Google Authenticator setup. ```vyos vyos@vyos:~$ sh interfaces openvpn vtun20 user user1 mfa qrcode █████████████████████████████████████ █████████████████████████████████████ ████ ▄▄▄▄▄ █▀▄▀ ▀▀▄▀ ▀▀▄ █ ▄▄▄▄▄ ████ ████ █ █ █▀▀▄ █▀▀▀█▀██ █ █ █ ████ ████ █▄▄▄█ █▀█ ▄ █▀▀ █▄▄▄█ █▄▄▄█ ████ ████▄▄▄▄▄▄▄█▄█ █ █ ▀ █▄▀▄█▄▄▄▄▄▄▄████ ████▄▄ ▄ █▄▄ ▄▀▄█▄ ▄▀▄█ ▄▄▀ ▀▄█ ▀████ ████ ▀██▄▄▄█▄ ██ █▄▄▄▄ █▄▀█ █ █▀█████ ████ ▄█▀▀▄▄ ▄█▀ ▀▄ ▄▄▀▄█▀▀▀ ▄▄▀████ ████▄█ ▀▄▄▄▀ ▀ ▄█ ▄ █▄█▀ █▀ █▀█████ ████▀█▀ ▀ ▄█▀▄▀▀█▄██▄█▀▀ ▀ ▀ ▄█▀████ ████ ██▄▄▀▄▄█ ██ ▀█ ▄█ ▀▄█ █▀██▀████ ████▄███▄█▄█ ▀█▄ ██▄▄▄█▀ ▄▄▄ █ ▀ ████ ████ ▄▄▄▄▄ █▄█▀▄ ▀▄ ▀█▀ █▄█ ██▀█████ ████ █ █ █ ▄█▀█▀▀▄ ▄▀▀▄▄▄▄▄▄ ████ ████ █▄▄▄█ █ ▄ ▀ █▄▄▄██▄▀█▄▀▄█▄ █████ ████▄▄▄▄▄▄▄█▄██▄█▄▄▄▄▄█▄█▄█▄██▄██████ █████████████████████████████████████ █████████████████████████████████████ ``` -------------------------------- ### Example Configuration Commands Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/service/dns.md Example configuration commands for setting up a dynamic DNS record. ```text # Configuration commands entered: # set service dns dynamic name 'VyOS-DNS' address interface 'eth0' set service dns dynamic name 'VyOS-DNS' description 'RFC 2136 dynamic dns service' set service dns dynamic name 'VyOS-DNS' key '/config/auth/my.key' set service dns dynamic name 'VyOS-DNS' server 'ns1.vyos.io' set service dns dynamic name 'VyOS-DNS' zone 'vyos.io' set service dns dynamic name 'VyOS-DNS' host-name 'example.vyos.io' set service dns dynamic name 'VyOS-DNS' protocol 'nsupdate' set service dns dynamic name 'VyOS-DNS' ttl '300' # Resulting config: # vyos@vyos# show service dns dynamic name VyOS-DNS { address { interface eth0 } description "RFC 2136 dynamic dns service" host-name example.vyos.io key /config/auth/my.key protocol nsupdate server ns1.vyos.io ttl 300 zone vyos.io } ``` -------------------------------- ### OpenVPN Client Configuration File Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example content for an OpenVPN client configuration file (.ovpn). ```none client dev tun proto udp remote 192.168.77.10 1194 remote-cert-tls server proto udp dev tun dev-type tun persist-key persist-tun verb 3 auth-user-pass -----BEGIN CERTIFICATE----- MIIDlzCCAn+gAwIBAgIUQW7AtPu0Qzp7VzT0TyYx83/ME8swDQYJKoZIhvcNAQEL BQAwVDELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzENMAsGA1UEAwwEY2EtMTAeFw0yNTA2 MTExMTIyMjJaFw0zMDA2MTAxMTIyMjJaMFQxCzAJBgNVBAYTAkdCMRMwEQYDVQQI DApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1Mx DTALBgNVBAMMBGNhLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi +v6i241T9ABxq1ngjWxDQITkqjV0nq2Jb3HSSuQpXRCu7DWdQZlbvnMHnkV/WTL0 RNgkhS4iV/WYhE+bLihwiZ0GTeQnUd1QJSkusFROX46w6kKXYUR5IQtcBC+vdky8 PESynPd+DXsJn5X9JTWqDeviUAQz/ZjDzWk+71MBCqa+Zps1zpIjK0ywn7pR/HnD rxJOQXlBMNgvbv8U3IAZ2jJp0jTB8TnuDtWSA+XZejMm/EN/AWUQyliX6OJFSCIh BL2BZ9lmVms4/HkRpbd50k3vvCoz+lAOEE6VsH0fEdLC3lZ+CtXZ7kjp2wdWWuSs 5ggIJYZZkixsCisbtEmbAgMBAAGjYTBfMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P AQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4E FgQUAG9lvr7AzJ/y4vY/XlWxXru+6m0wDQYJKoZIhvcNAQELBQADggEBAKsu4eZa 8Fha9aKfuKqlGQHPpEFfVDaVJmebw0uMw+b5Y8EpBxzZrgbqbk3Mty8pBjNa9jkZ zph04gHN4pR6kg3iQlUKGxZUfsB9ZUjKhkgNdUI9zq1323MKEvuIuYdt61DCfBHw Y6Xax5Ge+BahR2bXdPaQH452/+xMTqkukkpLbioTeIDg6FCU2HYPY5emDF5DDZAZ WXtTqi0zdT3Y6FqiTvs5VuWwXCcp+HM+Lwe1/VVJhwi4CHTq0CKWnQIH5blYjmyx zRBlrlZm4ntWlL5Mtepa1A3DJirY4kw/SqMAAh/Q9lh41JzBc8epf+OdnOzK55Ym tmctGO2o+NBCFi0= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDrjCCApagAwIBAgIUN6vPxDEW89cfbEFPa0tZlnsW1GkwDQYJKoZIhvcNAQEL BQAwVDELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzENMAsGA1UEAwwEY2EtMTAeFw0yNTA2 MTExMTQ0MjlaFw0yNjA2MTExMTQ0MjlaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQI DApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1Mx EDAOBgNVBAMMB2NsaWVudDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCdOWq8vdO8CznGN83uAXCuN4PcdTJaRFEdJIEfqHjlcG0MZQuPIAlDbOU+IWmu QBmeCj7SlbYtVYo1uQOMUaIrAvxLIQUaL1Y60oLVTF5eAPrGV+NSTQR5uMApcH9/ RcZcW530pu/QpYinKTbGkEd54so6YRVPmYbIOPNUMbnZbccpinYi5t2dqubBb585 A7L40043VtsVVbPjQq5V0HDursvqlaMqMRcffhR8H4B4ByU/EPRK4yTKm1hi19v3 UtRHiq74CfGtJzYtplgrLJBON7TsbIi/fEux4q1yhbKA0S66L6e5DZldRxNZOXG6 QjEL0RkYloMgkbv/2HLCu09hAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0P AQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBQCkfdfq3hv 7UtqAxq/5VDRIdgJLTAfBgNVHSMEGDAWgBQAb2W+vsDMn/Li9j9eVbFeu77qbTAN BgkqhkiG9w0BAQsFAAOCAQEAJ43+aDVRC+y2vsu6WRG2l6zYnLoIJZW4afdKMC1a nhTWhj4AhAt8evhVbAxi/8qhQX3yXF2bUQKdS++8AVcvZFlSES32S5eBx83AwGLt QkgvGx+QThKmoJwrelyuS2X0XX3P0WzohYI6HzSr6p9F8KhTvSW97E6SnldpdvEM uG1C+61/Vys7WLmDBh1PZTGE03nRp3H4Q9ynyXEEf1MK3eZkzg5H3Evj66p82pD5 8IauRfghMHJf3tOC+y0YIoXshF3lPq4nYso5Jc/HGCHlsboCODMCnY3CZsH7/O1n /MI710KpzZTCLnv4Qtx9JpZxR7FTddl36OOuYUXU3Gcnsg== -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCdOWq8vdO8CznG N83uAXCuN4PcdTJaRFEdJIEfqHjlcG0MZQuPIAlDbOU+IWmuQBmeCj7SlbYtVYo1 uQOMUaIrAvxLIQUaL1Y60oLVTF5eAPrGV+NSTQR5uMApcH9/RcZcW530pu/QpYin KTbGkEd54so6YRVPmYbIOPNUMbnZbccpinYi5t2dqubBb585A7L40043VtsVVbPj Qq5V0HDursvqlaMqMRcffhR8H4B4ByU/EPRK4yTKm1hi19v3UtRHiq74CfGtJzYt plgrLJBON7TsbIi/fEux4q1yhbKA0S66L6e5DZldRxNZOXG6QjEL0RkYloMgkbv/ 2HLCu09hAgMBAAECggEAOR3xRVUO9Sr816JRSQwz486eNDpNSxazgwtOb3JUTUH9 E7onq1y/kMOgOmSIEHoP9GaTcQxbbPe86IxomhLT/50ri52YzWzx/heY2SVPyQXB FMo79putKw0vnj5UyydNiyLrbMQyrhFc5iFmWVdz5/c4cWHwjIThPp7V4znXYwHZ OB/Xn1NNHDNy872oQn5wZWzuA4ml0OqjU5D+Ne9srODl3r4OTo3lb1N3JuH3aOSA cACl1JnN/KElN8IotIdweeUFAdn2jsGjZnCpGaJvZQ+2iMn6doJXHgFiF5+GMF7o aOatglElIuqgPtB/4nvnegSL0DSnB36ojqv2PAh24wKBgQDPBt4S4muqo8SqP2e0 8X78MyK3tz1VmgPKn3O68Vdi1V7FPz0RHRGsw/kdgxXsJlfZTWgzcq2NNFu0yPBJ A/h7qo16mv8GW7cJCd2exjb+/oq4r5iWeqLdSsMUXN87x02LRaMNd9wz1mls1Z73 oQ5hJ7zTtlyYXnvKPQo8X1ImjwKBgQDCaptQxZ/a3tcUQQlXAFMAScviODZd0LCL 30ZalwpNs6nVVIPoZHD3tlzWN5Es74gndfkC7/Gm2cnsOW9QQaU56q+5LeNXItW8 rc6yXq3vNQerqJxHNUmKWwLCQtSyLRjFqpGTl/PyX2bGXQ7/zjTL3W8VMD5otf4Y SJJB+sKjDwKBgHSVX3WvAAamFtfwwMwKuwH3IfPnQqj0BHKUfK2nvxgvJCFbzV3X yt5Jtf3ClhPYO9xpVOa0C7va4lHaXkYf8Exj7SxAIKFKALccUStaYBoU6bW7XOhQ w2pu8ZCEBEo7oBVv77Rj7SNb+R6K5ex5TAm2QQXQSjCb9IYc/ail3TNNAoGBALu6 GPMrgKnlFyV1j0E1DPBwUbDEuqpoArFtDRAYXFifLVTS4PQbWIG403f9++659Gy2 G5ZcfqiwD6xL4VJLsPF1zewvhR/0gRJJehb+GVGrkRaOHykbKUGxk75kreDGbu8f PqaXyXS17hWIch1Lzes0jDiXdwvA//QOzztqmVq9AoGAVMbmf04+QtzckLolAP4q Uwr5svfy14A7V3IGkwlsHZdm37L26lfxW0kpOOE7g7D6gdinuALo6oopP7RN/IDq -----END PRIVATE KEY----- ``` -------------------------------- ### IPv6 Firewall Configuration Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/firewall/ipv6.md A partial configuration snippet demonstrating IPv6 firewall setup, including input filtering rules and custom chain definitions with specific actions and interfaces. ```vyos firewall { ipv6 { input { filter { rule 10 { action jump inbound-interface { name eth1 } jump-target INP-ETH1 } rule 20 { action accept inbound-interface { name eth0 } log protocol ipv6-icmp } } } name INP-ETH1 { default-action drop default-log rule 10 { action accept protocol tcp_udp } } } } ``` -------------------------------- ### Configuration Command Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/_include/interface-per-client-thread.txt Example of how to enable per-client thread mode for an interface. ```none set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} per-client-thread ``` -------------------------------- ### Example Synproxy Configuration in VyOS Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/firewall/ipv6.md This example demonstrates a comprehensive synproxy setup, including enabling TCP timestamps, disabling conntrack loose tracking, and configuring specific firewall rules for synproxy and traffic dropping. ```none set system sysctl parameter net.ipv4.tcp_timestamps value '1' set system conntrack tcp loose disable set system conntrack ignore ipv6 rule 10 destination port '8080' set system conntrack ignore ipv6 rule 10 protocol 'tcp' set system conntrack ignore ipv6 rule 10 tcp flags syn set firewall global-options syn-cookies 'enable' set firewall ipv6 input filter rule 10 action 'synproxy' set firewall ipv6 input filter rule 10 destination port '8080' set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' set firewall ipv6 input filter rule 10 protocol 'tcp' set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' set firewall ipv6 input filter rule 1000 action 'drop' set firewall ipv6 input filter rule 1000 state invalid ``` -------------------------------- ### Basic Openconnect Configuration Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/vpn/openconnect.md Example configuration for a simple OpenConnect setup with one user and password authentication. ```none set vpn openconnect authentication local-users username tst password 'OC_bad_Secret' set vpn openconnect authentication mode local password set vpn openconnect network-settings client-ip-settings subnet '172.20.20.0/24' set vpn openconnect network-settings name-server '10.1.1.1' set vpn openconnect network-settings name-server '10.1.1.2' set vpn openconnect ssl ca-certificate 'ca-ocserv' set vpn openconnect ssl certificate 'srv-ocserv' ``` -------------------------------- ### Commit confirm example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/cli.md Example of using 'commit-confirm' and then confirming the changes. ```none vyos@router# set firewall interface eth0 local name FromWorld vyos@router# commit-confirm commit confirm will be automatically reboot in 10 minutes unless confirmed Proceed? [confirm]y [edit] vyos@router# confirm [edit] ``` -------------------------------- ### Restart command examples Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/cli.md Examples of potentially subsystem-disruptive 'restart' commands. ```none restart dhcp server ``` ```none restart ipsec ``` -------------------------------- ### Basic Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/vpp/configuration/interfaces/ipip.md This example demonstrates the basic configuration steps for creating an IPIP interface. ```none set interfaces vpp ipip vppipip1 set interfaces vpp ipip vppipip1 remote 203.0.113.2 set interfaces vpp ipip vppipip1 source-address 192.168.1.1 ``` -------------------------------- ### Installation Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/automation/vyos-govyos.md To install Go-VyOS, run the go install command. ```bash go install "github.com/ganawaj/go-vyos/vyos" ``` -------------------------------- ### Reset command examples Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/cli.md Examples of potentially disruptive 'reset' commands. ```none reset pppoe-server username jsmith ``` ```none reset bgp 192.0.2.54 ``` ```none reset vpn ipsec site-to-site peer vpn.example.com ``` ```none reset session tty1 ``` -------------------------------- ### sFlow Configuration Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/system/sflow.md An example of a complete sFlow configuration in VyOS. ```bash set system sflow agent-address '192.0.2.14' set system sflow agent-interface 'eth0' set system sflow drop-monitor-limit '50' set system sflow interface 'eth0' set system sflow interface 'eth1' set system sflow polling '30' set system sflow sampling-rate '1000' set system sflow server 192.0.2.1 port '6343' set system sflow server 203.0.113.23 port '6343' ``` -------------------------------- ### Client Certificate Generation Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example of generating a client certificate. ```vyos-cli vyos@vyos:~$ generate pki certificate sign ca-1 install client1 Do you already have a certificate request? [y/N] N Enter private key type: [rsa, dsa, ec] (Default: rsa) Enter private key bits: (Default: 2048) Enter country code: (Default: GB) Enter state: (Default: Some-State) Enter locality: (Default: Some-City) Enter organization name: (Default: VyOS) Enter common name: (Default: vyos.io) client1 Do you want to configure Subject Alternative Names? [y/N] Enter how many days certificate will be valid: (Default: 365) Enter certificate type: (client, server) (Default: server) client Note: If you plan to use the generated key on this router, do not encrypt the private key. Do you want to encrypt the private key with a passphrase? [y/N] You are not in configure mode, commands to install manually from configure mode: ``` -------------------------------- ### OpenVPN Client Configuration Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/interfaces/openvpn-examples.md Example configuration for an OpenVPN client. ```vyos set interfaces openvpn vtun0 description 'OpenVPN Client' set interfaces openvpn vtun0 mode client set interfaces openvpn vtun0 remote-host 192.168.1.1 set interfaces openvpn vtun0 remote-port 1194 set interfaces openvpn vtun0 tls ca-certificate /config/auth/ca.crt set interfaces openvpn vtun0 tls client-certificate /config/auth/client.crt set interfaces openvpn vtun0 tls client-key /config/auth/client.key ``` -------------------------------- ### RADIUS configuration example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/system/login.md Example configuration for RADIUS authentication. ```none set system login radius server 192.168.0.2 key 'test-vyos' set system login radius server 192.168.0.2 port '1812' set system login radius server 192.168.0.2 timeout '5' set system login radius source-address '192.168.0.1' ``` -------------------------------- ### OTP-key generation example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/system/login.md An example of generating an OTP key and the output provided. ```text vyos@vyos:~$ generate system login username otptester otp-key hotp-time rate-limit 2 rate-time 20 window-size 5 # You can share it with the user, he just needs to scan the QR in his OTP app # username: otptester # OTP KEY: J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY ``` -------------------------------- ### Set Up SSH Key-Based Authentication Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md Configures SSH key-based authentication for the new user. ```none set system login user myvyosuser authentication public-keys myusername@mydesktop type ssh-rsa set system login user myvyosuser authentication public-keys myusername@mydesktop key contents_of_id_rsa.pub ``` -------------------------------- ### Commit, Save, and Exit Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md Standard commands to apply, save, and exit configuration mode. ```vyos vyos@vyos# commit vyos@vyos# save Saving configuration to '/config/config.boot'... Done vyos@vyos# exit vyos@vyos$ ``` -------------------------------- ### Zone Configuration Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/firewall/zone.md Example of how zone configuration might look. ```none - set firewall * zone - custom_zone_name + ... ``` -------------------------------- ### Basic Bridge Setup Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/vpp/configuration/interfaces/bridge.md Example of a basic bridge setup. ```vyos # Create bridge interface set interfaces vpp bridge vppbr1 set interfaces vpp bridge vppbr1 description "Office network bridge" # Add member interfaces set interfaces vpp bridge vppbr1 member interface eth0 set interfaces vpp bridge vppbr1 member interface eth1 set interfaces vpp bridge vppbr1 member interface eth2 ``` -------------------------------- ### Configure Management Access Chain Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md Sets up a default-action of 'return' for the VyOS_MANAGEMENT chain. ```none set firewall ipv4 name VyOS_MANAGEMENT default-action 'return' ``` -------------------------------- ### Commit and Save Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md After every configuration change, you need to apply the changes by using the commit command. Once your configuration works as expected, you can save it permanently by using the save command. ```none commit save ``` -------------------------------- ### Complete TFTP Server Configuration Example Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/configuration/service/tftp-server.md Example configuration for a TFTP server including directory, multiple listen addresses, and upload enablement. ```none set service tftp-server directory '/config/tftpboot' set service tftp-server listen-address '192.0.2.1' set service tftp-server listen-address '2001:db8::1' set service tftp-server allow-upload ``` -------------------------------- ### Show Installed Images Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/automation/vyos-api.md Example of using the '/show' endpoint to display the installed system images. ```bash curl -k --location --request POST 'https://vyos/show' \ --form data='{"op": "show", "path": ["system", "image"]}' \ --form key='MY-HTTPS-API-PLAINTEXT-KEY' ``` -------------------------------- ### Option 3: Per-Hook Chain Source: https://github.com/vyos/vyos-documentation/blob/rolling/docs/quick-start.md Implement stateful connection filtering by creating rules directly on the forward and input chains. ```none set firewall ipv4 forward filter rule 5 action 'accept' set firewall ipv4 forward filter rule 5 state established set firewall ipv4 forward filter rule 5 state related set firewall ipv4 forward filter rule 10 action 'drop' set firewall ipv4 forward filter rule 10 state invalid set firewall ipv4 input filter rule 5 action 'accept' set firewall ipv4 input filter rule 5 state established set firewall ipv4 input filter rule 5 state related set firewall ipv4 input filter rule 10 action 'drop' set firewall ipv4 input filter rule 10 state invalid ```