-
Notifications
You must be signed in to change notification settings - Fork 0
VyOS
VyOS uses a JunOS-style configuration command-line interface, with an operational (denoted by the $ prompt) and configuration (denoted by the # prompt) mode. To enter configuration mode, simply run configure, and to exit it run exit or exit discard if the changes can be ignored. Then, browse the configuration tree using show <node>, set configuration keys with set <node> <value>, delete them with delete <node>, and traverse the tree using edit <node>, up to move up one level, and top to return to the top of the tree. Tab-completion can be quite helpful in understanding which nodes are available at each level of the tree. Once changes have been made, run commit to apply them, then save to persist the changes.
If there is a particularly risky procedure that might cause a device lockout, it would be prudent to use the commit-confirm command, which applies the changes, then waits for the confirm command to be run. If the changes are not confirmed within 5 minutes, the entire router will restart, reverting to the previous configuration.
It is recommended to add a virtual serial console to ease administration of the router. VyOS by default supports the serial console, making actions like copying and pasting easier with the VM.
Connect the VyOS installation ISO to the virtual CD-ROM drive. Then, boot up the machine, and VyOS will start automatically in live mode. Once booted, log in with the default credentials vyos/vyos, then run install image and follow the prompts to install to the disk. Once complete, run reboot and eject the CD-ROM, and VyOS will be booted from the disk rather than the live image.
Before configuring services, set the basic system information, including the following steps.
Run set system host-name <name> to set the system hostname.
Create a new account by running set system login user <username> plaintext-password <password>. When the configuration is committed, the password will be properly hashed and stored in system login user <username> encrypted-password. Then, run exit twice (or more if a sub-node is selected) to exit configuration mode and log out, and log in with the new user account.
Once logged back in, reenter configuration mode and run delete system login user vyos to remove the default user.
During first-time setup, browse to the interfaces node with edit interfaces, then configure the ethernets using set ethernet eth<X> address <ip>. Usually, no other options are required, but it is recommended to set a description for the interface. It's also possible to change the MAC address of the interface by setting its hw-id.
For creating VLAN interfaces, simply create a vif <vid> node underneath the related ethernet interface (another way to do this is to create a switch interface and make it VLAN-aware). The vif node supports many of the same options as the ethernet interface does.
To create a GRE tunnel interface, switch to configuration mode and edit interfaces, then begin editing a new tunnel interface with edit tunnel tun0. Configure it with set encapsulation gre, and set a tunnel (inside) address with set address <ip>/<cidr>. Set a description with set description <desc>, then configure the peer address with set remote <ip> and select the source using set source-interface eth<N>.
It is also possible to establish multiple tunnels between the same source and destination using tunnel "keys". These numbers have no cryptographic or security use, they simply differentiate tunnels, and can be set with set ip parameters key <key>. The tunnel can also be configured in GRETAP mode, which supports tunneling of layer 2 traffic over GRE.
If configured correctly, it should be possible to ping the inside address of the other end of the tunnel.