VyOS: Installation and Configuration Guide

VyOS: Installation and Configuration

VyOS is an open-source router OS built on Linux, and it's one of my favorite ways to build serious routing labs without a room full of routers. It does routing (static, OSPF, BGP), a stateful firewall, NAT, and VPNs, and it runs just as happily on an old mini PC as it does in a VM or the cloud. If you've used Juniper, the configure / set / commit style will feel familiar.

These are my notes on getting a basic router running.

Heads up about versions: the commands here use the older 1.3-style syntax. VyOS changed a lot in 1.4, especially the firewall, QoS, and certificate commands. If you're running something newer, the ideas are the same but check the docs for your version before you paste anything.

Installing it

Grab an ISO from vyos.io. (The rolling builds are free; the stable LTS images are the ones you have to pay or contribute for.) Then make a bootable USB stick. On Linux or macOS:

sudo dd if=vyos.iso of=/dev/sdX bs=4M status=progress

Triple-check that /dev/sdX is the USB stick and not your actual disk. dd will not ask.

Boot from it, log in as vyos / vyos, and run install image. Then:

Accept the defaults for partitioning unless you have a reason not to.
Set a real password when it asks.
Reboot and pull the USB stick.

In a VM, just attach the ISO and do the same thing.

The basics

The one thing to remember: commit makes changes live, save makes them survive a reboot. Forgetting save is a rite of passage.

Hostname and time zone

configure
set system host-name vyos-router
set system time-zone UTC
commit
save

Interfaces

set interfaces ethernet eth0 address 192.168.1.1/24
set interfaces ethernet eth1 address dhcp
commit
save

Here eth0 is the LAN with a static address, and eth1 is the WAN and gets its address from the ISP over DHCP.

SSH

set service ssh
commit
save

Once it's on, consider set service ssh listen-address 192.168.1.1 so it's only listening on the LAN side.

NAT

To let everything on the LAN share the one public IP, use source NAT (masquerade):

set nat source rule 10 description "Outbound NAT"
set nat source rule 10 outbound-interface eth1
set nat source rule 10 source address 192.168.1.0/24
set nat source rule 10 translation address masquerade
commit
save

Anything from 192.168.1.0/24 going out eth1 gets rewritten to the WAN address.

Firewall

VyOS has a proper stateful firewall. In 1.3, you make named rule sets and attach them to an interface in one of three directions:

in — traffic coming in that interface and passing through the router
out — traffic leaving through that interface
local — traffic aimed at the router itself

That last one trips people up. If you want to protect the router itself (SSH, DNS, etc.), that's local, not in.

A basic home setup: drop everything unsolicited from the Internet, and only let the LAN reach the router for SSH and ping.

set firewall name WAN_IN default-action drop
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable

set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable

set firewall name LAN_LOCAL default-action drop
set firewall name LAN_LOCAL rule 10 action accept
set firewall name LAN_LOCAL rule 10 state established enable
set firewall name LAN_LOCAL rule 10 state related enable
set firewall name LAN_LOCAL rule 20 action accept
set firewall name LAN_LOCAL rule 20 source address 192.168.1.0/24
set firewall name LAN_LOCAL rule 20 protocol icmp
set firewall name LAN_LOCAL rule 30 action accept
set firewall name LAN_LOCAL rule 30 source address 192.168.1.0/24
set firewall name LAN_LOCAL rule 30 protocol tcp
set firewall name LAN_LOCAL rule 30 destination port 22

set interfaces ethernet eth1 firewall in name WAN_IN
set interfaces ethernet eth1 firewall local name WAN_LOCAL
set interfaces ethernet eth0 firewall local name LAN_LOCAL
commit
save

From the Internet, only replies to connections you started are allowed in, both through the router and to it.
From the LAN, the router itself only answers ping and SSH.
LAN traffic heading out to the Internet isn't filtered here, so it just works.

If the router is also your DHCP or DNS server, add rules to LAN_LOCAL for UDP 67 and UDP/TCP 53, or your clients are going to have a bad day. And do firewall changes from the console, or use commit-confirm, so a mistake doesn't lock you out.

Home and small office extras

Dynamic DNS

If your ISP changes your IP now and then, have VyOS keep a hostname updated:

set service dns dynamic interface eth1 service dyndns host-name yourhostname.dyndns.org
set service dns dynamic interface eth1 service dyndns login yourusername
set service dns dynamic interface eth1 service dyndns password yourpassword
commit
save

Traffic shaping

A shaper on the WAN can keep one kind of traffic from starving everything else. This one shapes the uplink to 10 Mbit and guarantees SSH 20% of it:

set traffic-policy shaper SHAPER bandwidth 10mbit
set traffic-policy shaper SHAPER default bandwidth 80%
set traffic-policy shaper SHAPER class 10 bandwidth 20%
set traffic-policy shaper SHAPER class 10 match SSH ip destination port 22
set interfaces ethernet eth1 traffic-policy out SHAPER
commit
save

Set the shaper bandwidth a little below your real upload speed so the queue builds up on your router, where you control it, instead of in the ISP's modem.

OpenVPN for remote access

set interfaces openvpn vtun0 mode server
set interfaces openvpn vtun0 server subnet 10.8.0.0/24
set interfaces openvpn vtun0 server push-route 192.168.1.0/24
set interfaces openvpn vtun0 tls cert-file /config/auth/server.crt
set interfaces openvpn vtun0 tls key-file /config/auth/server.key
set interfaces openvpn vtun0 tls ca-cert-file /config/auth/ca.crt
set interfaces openvpn vtun0 tls dh-file /config/auth/dh.pem
commit
save

You'll need to generate the certificates first and put them in /config/auth. Anything under /config survives upgrades. Honestly, these days I'd look at WireGuard first. It's built in and a lot less fiddly. There's more on that in VPNs and Tunneling.

Checking on things

show interfaces
show nat source translations
show firewall
show ip route
monitor traffic interface eth0

monitor traffic is tcpdump under the hood, and you can add a filter like filter "port 53". And since it's Linux underneath, the normal Linux tools are all there if you need them.

Why I like it

For learning, it's hard to beat. It's free, runs anywhere, and the routing features are the real thing, so the OSPF and BGP you practice in a VyOS lab carry straight over to production gear. It's also a perfectly good router for a home or small office if you're comfortable with a command line.

Last Modified: October 12, 2026, 11:41 am