# Firewall with VRF Isolation

> Межсетевые правила между VRF на VyOS - изоляция тенантов, контроль утечки маршрутов, политики безопасности и мультитенантная фильтрация.

Source: https://opennix.org/docs/vyos/examples/firewall-vrf/


Firewall rules для контроля traffic между VRF instances при multi-tenant deployments.

## Сценарий

- Multi-Tenant: Изоляция customers через VRF
- Selective Access: Контролируемый доступ к shared services
- Security: Firewall между VRF

## Configuration

```bash
# VRF Creation
set vrf name CUSTOMER-A table '100'
set vrf name CUSTOMER-B table '200'
set vrf name SHARED table '999'

# Firewall для inter-VRF traffic
set firewall ipv4-name VRF-ISOLATION default-action 'drop'
set firewall ipv4-name VRF-ISOLATION rule 10 action 'accept'
set firewall ipv4-name VRF-ISOLATION rule 10 destination address '10.255.0.53'
set firewall ipv4-name VRF-ISOLATION rule 10 destination port '53'
set firewall ipv4-name VRF-ISOLATION rule 10 protocol 'udp'
set firewall ipv4-name VRF-ISOLATION rule 10 description 'Allow DNS to shared'

# Apply к VRF
set vrf name CUSTOMER-A ip protocol all export 'VRF-ISOLATION'
set vrf name CUSTOMER-B ip protocol all export 'VRF-ISOLATION'
```

## Ссылки

- [VyOS VRF](https://docs.vyos.io/en/latest/configuration/vrf/index.html)
- [VyOS Firewall](https://docs.vyos.io/en/latest/configuration/firewall/general.html)