-
Notifications
You must be signed in to change notification settings - Fork 0
VyOS
VyOS uses a JunOS-style configuration command-line interface, with an operational (denoted by the $ prompt) and configuration (denoted by the # prompt) mode. To enter configuration mode, simply run configure, and to exit it run exit or exit discard if the changes can be ignored. Then, browse the configuration tree using show <node>, set configuration keys with set <node> <value>, delete them with delete <node>, and traverse the tree using edit <node>, up to move up one level, and top to return to the top of the tree. Tab-completion can be quite helpful in understanding which nodes are available at each level of the tree. Once changes have been made, run commit to apply them, then save to persist the changes.
If there is a particularly risky procedure that might cause a device lockout, it would be prudent to use the commit-confirm command, which applies the changes, then waits for the confirm command to be run. If the changes are not confirmed within 5 minutes, the entire router will restart, reverting to the previous configuration.
It is recommended to add a virtual serial console to ease administration of the router. VyOS by default supports the serial console, making actions like copying and pasting easier with the VM.
Connect the VyOS installation ISO to the virtual CD-ROM drive. Then, boot up the machine, and VyOS will start automatically in live mode. Once booted, log in with the default credentials vyos/vyos, then run install image and follow the prompts to install to the disk. Once complete, run reboot and eject the CD-ROM, and VyOS will be booted from the disk rather than the live image.
Before configuring services, set the basic system information, including the following steps.
Run set system host-name <name> to set the system hostname.
Create a new account by running set system login user <username> plaintext-password <password>. When the configuration is committed, the password will be properly hashed and stored in system login user <username> encrypted-password. Then, run exit twice (or more if a sub-node is selected) to exit configuration mode and log out, and log in with the new user account.
Once logged back in, reenter configuration mode and run delete system login user vyos to remove the default user.
During first-time setup, browse to the interfaces node with edit interfaces, then configure the ethernets using set ethernet eth<X> address <ip>. Usually, no other options are required, but it is recommended to set a description for the interface. It's also possible to change the MAC address of the interface by setting its hw-id.
For creating VLAN interfaces, simply create a vif <vid> node underneath the related ethernet interface (another way to do this is to create a switch interface and make it VLAN-aware). The vif node supports many of the same options as the ethernet interface does.
To create a GRE tunnel interface, switch to configuration mode and edit interfaces, then begin editing a new tunnel interface with edit tunnel tun0. Configure it with set encapsulation gre, and set a tunnel (inside) address with set address <ip>/<cidr>. Set a description with set description <desc>, then configure the peer address with set remote <ip> and select the source using set source-address <address>.
It is also possible to establish multiple tunnels between the same source and destination using tunnel "keys". These numbers have no cryptographic or security use, they simply differentiate tunnels, and can be set with set ip parameters key <key>. The tunnel can also be configured in GRETAP mode, which supports tunneling of layer 2 traffic over GRE.
If configured correctly, it should be possible to ping the inside address of the other end of the tunnel.
Unlike other interface types, to create a Wireguard VPN interface, first run generate wireguard named-keypairs <name> in operational mode. This will generate and save a keypair under the given name, which should ideally correspond with a Wireguard interface name. Then, show the keypair with show wireguard keypairs privkey <name>, replacing privkey with pubkey to view the corresponding public key. The public key will need to be shared with peers. Switch to configuration mode and run edit interfaces, then create a new Wireguard interface with edit wireguard wg0.
Before anything else, set the private key generated earlier by running set private-key <name>, specifying the name of the keypair rather than the key itself. Then, set the VPN (inside) address with set address <ip>/<cidr>, and the description with set description <desc>. Set the listening port for this tunnel with set port <port>. Next, begin configuring a peer with edit peer <name>. Run set address <ip> and set port <port> to configure the IP and port of the peer's endpoint. Ask them for their public key and attach it with set pubkey <pubkey>.
Because the VPN will be used to dynamically route traffic, Wireguard must be configured to allow traffic from any IP address to go through the tunnel. The way to do this is to set the tunnel's AllowedIPs to 0.0.0.0/0, which matches all addresses, however Wireguard will not allow multiple peers to have the same or overlapping routes. For this reason, every peer must have its own local wg<N> interface. Run set allowed-ips 0.0.0.0/0 for each interface's peer.
Note that the procedure on VyOS 1.4.x is slightly different, and allows keypairs to be generated and directly installed to an interface with a single command.
Once complete, it should be possible to ping the (inside) IP of the other end of the VPN tunnel.