-
Notifications
You must be signed in to change notification settings - Fork 0
VyOS
VyOS uses a JunOS-style configuration command-line interface, with an operational (denoted by the $ prompt) and configuration (denoted by the # prompt) mode. To enter configuration mode, simply run configure, and to exit it run exit or exit discard if the changes can be ignored. Then, browse the configuration tree using show <node>, set configuration keys with set <node> <value>, delete them with delete <node>, and traverse the tree using edit <node>, up to move up one level, and top to return to the top of the tree. Tab-completion can be quite helpful in understanding which nodes are available at each level of the tree. Once changes have been made, run commit to apply them, then save to persist the changes.
If there is a particularly risky procedure that might cause a device lockout, it would be prudent to use the commit-confirm command, which applies the changes, then waits for the confirm command to be run. If the changes are not confirmed within 5 minutes, the entire router will restart, reverting to the previous configuration.
It is recommended to add a virtual serial console to ease administration of the router. VyOS by default supports the serial console, making actions like copying and pasting easier with the VM.
Connect the VyOS installation ISO to the virtual CD-ROM drive. Then, boot up the machine, and VyOS will start automatically in live mode. Once booted, log in with the default credentials vyos/vyos, then run install image and follow the prompts to install to the disk. Once complete, run reboot and eject the CD-ROM, and VyOS will be booted from the disk rather than the live image.
Before configuring services, set the basic system information, including the following steps.
Run set system host-name <name> to set the system hostname.
Create a new account by running set system login user <username> plaintext-password <password>. When the configuration is committed, the password will be properly hashed and stored in system login user <username> encrypted-password. Then, run exit twice (or more if a sub-node is selected) to exit configuration mode and log out, and log in with the new user account.
Once logged back in, reenter configuration mode and run delete system login user vyos to remove the default user.
During first-time setup, browse to the interfaces node with edit interfaces, then configure the ethernets using set ethernet eth<X> address <ip>. Usually, no other options are required, but it is recommended to set a description for the interface. It's also possible to change the MAC address of the interface by setting its hw-id.
For creating VLAN interfaces, simply create a vif <vid> node underneath the related ethernet interface (another way to do this is to create a switch interface and make it VLAN-aware). The vif node supports many of the same options as the ethernet interface does.
To create a GRE tunnel interface, switch to configuration mode and edit interfaces, then begin editing a new tunnel interface with edit tunnel tun0. Configure it with set encapsulation gre, and set a tunnel (inside) address with set address <ip>/<cidr>. Set a description with set description <desc>, then configure the peer address with set remote <ip> and select the source using set source-address <address>.
It is also possible to establish multiple tunnels between the same source and destination using tunnel "keys". These numbers have no cryptographic or security use, they simply differentiate tunnels, and can be set with set ip parameters key <key>. The tunnel can also be configured in GRETAP mode, which supports tunneling of layer 2 traffic over GRE.
If configured correctly, it should be possible to ping the inside address of the other end of the tunnel.
Unlike other interface types, to create a Wireguard VPN interface, first run generate wireguard named-keypairs <name> in operational mode. This will generate and save a keypair under the given name, which should ideally correspond with a Wireguard interface name. Then, show the keypair with show wireguard keypairs privkey <name>, replacing privkey with pubkey to view the corresponding public key. The public key will need to be shared with peers. Switch to configuration mode and run edit interfaces, then create a new Wireguard interface with edit wireguard wg0.
Before anything else, set the private key generated earlier by running set private-key <name>, specifying the name of the keypair rather than the key itself. Then, set the VPN (inside) address with set address <ip>/<cidr>, and the description with set description <desc>. Set the listening port for this tunnel with set port <port>. Next, begin configuring a peer with edit peer <name>. Run set address <ip> and set port <port> to configure the IP and port of the peer's endpoint. Ask them for their public key and attach it with set pubkey <pubkey>.
Because the VPN will be used to dynamically route traffic, Wireguard must be configured to allow traffic from any IP address to go through the tunnel. The way to do this is to set the tunnel's AllowedIPs to 0.0.0.0/0, which matches all addresses, however Wireguard will not allow multiple peers to have the same or overlapping routes. For this reason, every peer must have its own local wg<N> interface. Run set allowed-ips 0.0.0.0/0 for each interface's peer.
Note that the procedure on VyOS 1.4.x is slightly different, and allows keypairs to be generated and directly installed to an interface with a single command.
Once complete, it should be possible to ping the (inside) IP of the other end of the VPN tunnel.
The simplest possible setup is to use static routing to send traffic over the tunnels. A route can be added simply by running set protocols static route <network>/<cidr> next-hop <endpoint>, providing the inside IP of the other end of the tunnel as the next hop. Optionally, the route distance (used to choose between two equal paths) can be set by adding distance <num> to the end.
BGP is remarkably easy to set up on VyOS. In configuration mode, create a new local Autonomous System (AS) by running edit protocols bgp <asn>. Next, share the local routes by adding them with set address-family ipv4-unicast network <network>/<cidr> (VyOS also supports IPv6 routes). Also, set the router ID to an IP low in the assigned DN42 prefix using set parameters router-id <ip>. Like Cisco, VyOS also supports redistributing routes using set address-family ipv4-unicast redistribute <type>, for example to redistribute routes collected by OSPF.
Then, simply add a neighbor by running set neighbor <endpoint> remote-as <asn>, pointing to the inside address of the established tunnel. It may be necessary to set neighbor <endpoint> ebgp-multihop <hops> to the amount of hops away the host is, if the VPN tunnel goes through multiple hops (since BGP by default uses a TTL of 1). VyOS also supports setting up multiple neighbors with the same ASN, for example to allow redundancy through multiple tunnels.
Back in operational mode, running show ip bgp summary should display the route distribution status.
VyOS fully supports checking RPKI signatures using a cache server. Begin by setting one like GoRTR up, then run set protocols rpki cache <ip> port <port> to connect to it. Also set the preference, which defines which server to prioritize if multiple are defined. Do this by running set protocols rpki cache <ip> preference <priority>. Next, create a route map, which conditionally applies policies to routes, including RPKI validation. Run edit policy route-map <name>, then run the following commands to create a mapping which allows signed routes and routes which are not expected to be signed, and denies routes which must be signed by are not.
set rule 10 action 'permit'
set rule 10 match rpki 'valid'
set rule 20 action 'permit'
set rule 20 match rpki 'notfound'
set rule 30 action 'deny'
set rule 30 match rpki 'invalid'Lastly, apply the route map to all peers by going into each peer with edit protocols bgp <asn> neighbor <endpoint> and running set address-family ipv4-unicast route-map import <name> and set address-family ipv4-unicast route-map export <name> (for IPv6 as well, if necessary). This will filter both incoming and outgoing routes according to the route map.