DOCSEARCHbyAlgolia
Submit Docs

VyOS Documentation

repository·rolling·Indexed 42 days ago

https://github.com/vyos/vyos-documentation

User documentation for VyOS, including configuration guides for the IPoE server, RADIUS authentication, IPv4/IPv6 pool management, and the VyOS API for system automation and configuration retrieval.

Tokens
287.2K
Snippets
904
Records
1.1K
Agent score
52%

What's inside VyOS

  1. Overview of OpenVPN in VyOS

    rolling

    OpenVPN is a software-based VPN solution available in VyOS that supports both remote-access and site-to-site connections.

    Advantages:

    • Works through double NAT (uses a single TCP or UDP connection).
    • Flexible split tunneling configuration.
    • Wide availability of client GUI frontends.

    Disadvantages:

    • Higher protocol overhead compared to IPsec.
    • Slower performance because it runs in user mode, whereas IPsec runs in kernel mode.

  2. Configure VPP Dataplane features

    rolling

    VPP settings are organized into main sections. You can configure main dataplane settings, internal VPP interfaces, and specific features.

    Available feature categories for the VPP Dataplane include:

    • Main Dataplane & Interfaces: Core settings and internal VPP interface configuration.
    • ACL: Access Control Lists.
    • IPFIX: IP Flow Information Export.
    • IPsec: IP Security.
    • NAT: Network Address Translation.
    • sFlow: Flow sampling.

  3. Understand the VPP Configuration structure

    rolling

    VPP (Vector Packet Processing) settings in VyOS are organized into several functional sections. Configuration is divided between core dataplane/interface settings and specific feature sets that can be enabled on the VPP Dataplane.

    Core Settings:

    • Dataplane: Main settings for the VPP dataplane.
    • Interfaces: Configuration for internal VPP interfaces.

    Enabled Features: When using the VPP dataplane, you can enable specific features including:

    • acl (Access Control Lists)
    • ipfix (IP Flow Information Export)
    • ipsec (IP Security)
    • nat (Network Address Translation)
    • sflow (Sampled Flow)

  4. Overview of IS-IS (Intermediate System to Intermediate System)

    rolling
    IS-IS is a link-state Interior Gateway Protocol (IGP) that runs directly on the data link layer (Layer 2). It uses the Dijkstra shortest-path first (SPF) algorithm to build a network topology database and determine the lowest-cost paths to destinations. Routers in an IS-IS network are referred to as Intermediate Systems. Addressing uses Network Entity Titles (NETs), which are typically 10 bytes long (ranging from 8 to 20 bytes).

  5. What is L2TPv3 and how does it work?

    rolling

    L2TPv3 (Layer 2 Tunneling Protocol version 3) interfaces allow you to establish tunnels to transport Layer 2 traffic (such as Ethernet, Frame Relay, or HDLC) over IP networks. It serves as a simpler alternative to MPLS by operating over basic IP connectivity.

    L2TPv3 supports two encapsulation types:

    • Direct IP: Encapsulates tunnel data directly inside IP packets (Protocol 115). This offers lower overhead.
    • UDP: Encapsulates tunnel data inside a UDP datagram. This is recommended when the tunnel must traverse NAT devices.

    L2TPv3 tunnels can be established over both IPv4 and IPv6 underlying networks.

  6. What is NAT64 and SNAT64

    rolling

    NAT64 (IPv6-to-IPv4 Prefix Translation) is a stateful translation mechanism that enables IPv6-only clients to communicate with IPv4 servers using unicast UDP, TCP, or ICMP. It translates IPv6 addresses to IPv4 addresses and vice versa.

    SNAT64 (IPv6-to-IPv4 Source Address Translation) is a specific stateful mechanism that translates IPv6 source addresses to IPv4 addresses.

    This process typically uses the well-known prefix 64:ff9b::/96 to represent IPv4-embedded IPv6 addresses. In this format, the IPv4 address is encoded in the low-order 32 bits of the IPv6 address, while the high-order 32 bits are set to the 64:ff9b::/96 prefix.

  7. What is a bonding interface in VyOS

    rolling

    A bonding interface aggregates multiple physical network interfaces into a single logical interface. This logical interface is also referred to as a bond, LAG (Link Aggregation Group), EtherChannel, or port-channel.

    Bonding is used to provide:

    • Fault tolerance: Redundancy if one or more member interfaces fail.
    • Load balancing: Distributing traffic across multiple interfaces.
    • Link integrity monitoring: Detecting the status of underlying physical links.

  9. Understand BGP Capability Advertisement

    rolling

    BGP speakers use capability advertisement (RFC 5492) in the OPEN message to negotiate supported features. This allows the protocol to support extensions like multiprotocol capabilities, route refresh, 4-byte ASN support, graceful restart, and ADD-PATH.

    Behavior:

    • Sessions are established using the intersection of capabilities supported by both peers.
    • If no common capabilities are found, the session is terminated with an Unsupported Capability error.
    • If a peer is configured strictly as an IPv4 unicast neighbor without other optional features, VyOS may not send any capability advertisements.

  10. Configure OpenVPN operation modes

    rolling

    OpenVPN interfaces in VyOS can be configured in one of three modes using the mode option:

    • site-to-site: Establishes a permanent VPN connection between two fixed sites.
    • client: Operates as a client in a server-client relationship.
    • server: Operates as a server to accept incoming client connections.

    Note that certain configuration options are mode-specific. For example, remote-host is used in client mode, while server subnet is mandatory in server mode.

    set interfaces openvpn <interface> mode <site-to-site | server | client>

  11. Configure RADIUS bandwidth shaping and attributes

    rolling

    RADIUS attributes take precedence over CLI configuration.

    Bandwidth Shaping:

    • rate-limit enable: Enables bandwidth shaping via RADIUS.
    • rate-limit attribute <attribute>: Specifies which attribute contains rate limit info (default: Filter-Id).
    • rate-limit vendor: Specifies the vendor dictionary (must be in /usr/share/accel-ppp/radius).

    Client IP Allocation via RADIUS:

    • Framed-IP-Address: Overrides default-pool to assign a specific IP.
    • Framed-Pool: Assigns an IP from a pool matching the attribute value.
    • Stateful-IPv6-Address-Pool: Assigns an IPv6 address from a pool named in the attribute (RFC6911).
    • Delegated-IPv6-Prefix-Pool: Assigns an IPv6 prefix delegation from a pool named in the attribute (RFC6911).

  12. How flowtables work in VyOS firewalls

    rolling

    Flowtables allow you to define a Fast Path for network traffic, bypassing the classic IP forwarding path and Netfilter hooks after the initial connection is established.

    The Lifecycle of a Flow

    1. First Packet (Flowtable Miss): The first packet of a connection must traverse the standard IP forwarding path and be evaluated by your firewall ruleset. You must explicitly accept this initial packet.
    2. Offloading: Once a connection is established (e.g., via a rule with state established), you can use a firewall rule with the action offload to add the connection to a specific flowtable.
    3. Subsequent Packets (Flowtable Hit): Once the flow is in the flowtable, subsequent packets are transmitted directly to the output netdevice via the Fast Path. These packets are not seen by Netfilter hooks after ingress.

    Key Requirements

    • Protocols: Supports IPv4, IPv6, TCP, and UDP.
    • Interface Registration: You must register the interfaces used by the flowtable. If a packet matches a flowtable entry, it bypasss the classic forwarding path.
    set firewall flowtable <flow_table_name> interface <iface>
set firewall [ipv4 | ipv6] forward filter rule <1-999999> action offload
set firewall [ipv4 | ipv6] forward filter rule <1-999999> offload-target <flowtable>