VyOS - Configuration Blueprints and Architecture

Deployment-ready VyOS configuration templates for common use cases. Each template is a complete, working configuration that you can adapt to your specific requirements.

How to Use the Templates

Method 1: Through the CLI

# Enter configuration mode
configure

# Copy the commands from the template (set commands)
# Paste them into the CLI

# Apply the configuration
commit

# Save
save

Method 2: Through a config.boot File

# Save the template to a file
sudo vi /config/config.boot.template

# Load the configuration
configure
load /config/config.boot.template
commit
save

Method 3: Through the API

# Use the VyOS API to apply the configuration
# See the "VyOS Automation" section for details

Template 1: SOHO Router (Small Office / Home Office)

Description

A basic router for a small office (up to 50 devices):

WAN interface with DHCP from the ISP
LAN with a DHCP server
NAT for Internet access
Basic firewall
DNS forwarding
NTP
SSH access

Topology

Internet (ISP DHCP)
        |
    [eth0] WAN
     VyOS Router
    [eth1] LAN
        |
   192.168.1.0/24
   (Client devices)

Complete Configuration

configure

# System settings
set system host-name soho-router
set system time-zone Europe/Moscow
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# User login
set system login user admin authentication plaintext-password 'changeme123'
set system login user admin level admin

# SSH service
set service ssh port 22
set service ssh disable-password-authentication

# NTP
set service ntp server 0.ru.pool.ntp.org
set service ntp server 1.ru.pool.ntp.org

# WAN interface (receives an IP from the ISP via DHCP)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN'

# LAN interface
set interfaces ethernet eth1 address 192.168.1.1/24
set interfaces ethernet eth1 description 'LAN'

# DHCP server for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 domain-name internal.local
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 lease 86400
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200

# DNS forwarding
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding cache-size 10000
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

# NAT for Internet access
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall - WAN_LOCAL (protects the router itself from the WAN)
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol icmp

# Firewall - WAN_IN (protects the LAN from the WAN)
set firewall name WAN_IN default-action drop
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 state invalid enable

# Apply the firewall to the interfaces
set interfaces ethernet eth0 firewall local name WAN_LOCAL
set interfaces ethernet eth0 firewall in name WAN_IN

commit
save

Customization

# Change the LAN subnet
set interfaces ethernet eth1 address 10.0.0.1/24
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 default-router 10.0.0.1
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 start 10.0.0.100
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 stop 10.0.0.200
set service dns forwarding listen-address 10.0.0.1
set nat source rule 100 source address 10.0.0.0/24

# Add static DHCP leases
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 static-mapping server1 mac '00:11:22:33:44:55'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 static-mapping server1 ip-address '192.168.1.10'

# Open a port for external access (for example, a web server)
set nat destination rule 100 inbound-interface eth0
set nat destination rule 100 protocol tcp
set nat destination rule 100 destination port 80
set nat destination rule 100 translation address 192.168.1.10
set nat destination rule 100 translation port 80

# Allow forwarding for this port
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 protocol tcp
set firewall name WAN_IN rule 100 destination address 192.168.1.10
set firewall name WAN_IN rule 100 destination port 80

Template 2: Branch Office Router (Branch with VPN)

Description

A router for a company branch office with a VPN connection to the head office:

WAN interface with a static IP
LAN with several VLANs (office, guests, printers)
IPsec site-to-site VPN to the head office
QoS for VoIP prioritization
DHCP with reservations for equipment
Syslog to a central server

Topology

Internet
    |
[eth0] WAN (203.0.113.10/24)
  VyOS Router
    |
[eth1] LAN Trunk
    |
  Switch
    |
    +--- VLAN 10 (192.168.10.0/24) Office
    +--- VLAN 20 (192.168.20.0/24) Guests
    +--- VLAN 30 (192.168.30.0/24) Printers

    IPsec Tunnel to HQ
    192.168.0.0/24 (HQ LAN)

Complete Configuration

configure

# System settings
set system host-name branch-office
set system time-zone Europe/Moscow
set system domain-name company.local

# Login
set system login user admin authentication plaintext-password 'SecurePass123!'
set system login user admin level admin

# SSH
set service ssh port 22
set service ssh disable-password-authentication

# NTP
set service ntp server ntp1.company.local
set service ntp server 0.ru.pool.ntp.org

# Syslog to a central server
set system syslog host 192.168.0.10 facility all level info
set system syslog global facility all level info

# WAN interface (static IP from the ISP)
set interfaces ethernet eth0 address 203.0.113.10/24
set interfaces ethernet eth0 description 'WAN'

# LAN interface (trunk for the VLANs)
set interfaces ethernet eth1 description 'LAN-TRUNK'

# VLAN 10 - Office
set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 10 description 'Office-VLAN'

# VLAN 20 - Guests
set interfaces ethernet eth1 vif 20 address 192.168.20.1/24
set interfaces ethernet eth1 vif 20 description 'Guest-VLAN'

# VLAN 30 - Printers
set interfaces ethernet eth1 vif 30 address 192.168.30.1/24
set interfaces ethernet eth1 vif 30 description 'Printer-VLAN'

# DHCP server for the Office VLAN
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 default-router 192.168.10.1
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 name-server 192.168.0.10
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 domain-name company.local
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 lease 86400
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 range 0 start 192.168.10.100
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 range 0 stop 192.168.10.200

# Static leases for equipment
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 static-mapping voip-phone1 mac '00:11:22:33:44:01'
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 static-mapping voip-phone1 ip-address '192.168.10.11'
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 static-mapping voip-phone2 mac '00:11:22:33:44:02'
set service dhcp-server shared-network-name OFFICE subnet 192.168.10.0/24 static-mapping voip-phone2 ip-address '192.168.10.12'

# DHCP for the Guest VLAN (short lease)
set service dhcp-server shared-network-name GUESTS subnet 192.168.20.0/24 default-router 192.168.20.1
set service dhcp-server shared-network-name GUESTS subnet 192.168.20.0/24 name-server 8.8.8.8
set service dhcp-server shared-network-name GUESTS subnet 192.168.20.0/24 lease 3600
set service dhcp-server shared-network-name GUESTS subnet 192.168.20.0/24 range 0 start 192.168.20.100
set service dhcp-server shared-network-name GUESTS subnet 192.168.20.0/24 range 0 stop 192.168.20.250

# DHCP for the Printer VLAN
set service dhcp-server shared-network-name PRINTERS subnet 192.168.30.0/24 default-router 192.168.30.1
set service dhcp-server shared-network-name PRINTERS subnet 192.168.30.0/24 name-server 192.168.0.10
set service dhcp-server shared-network-name PRINTERS subnet 192.168.30.0/24 lease 86400
set service dhcp-server shared-network-name PRINTERS subnet 192.168.30.0/24 range 0 start 192.168.30.100
set service dhcp-server shared-network-name PRINTERS subnet 192.168.30.0/24 range 0 stop 192.168.30.200

# DNS forwarding
set service dns forwarding listen-address 192.168.10.1
set service dns forwarding listen-address 192.168.20.1
set service dns forwarding listen-address 192.168.30.1
set service dns forwarding cache-size 10000
set service dns forwarding name-server 192.168.0.10
set service dns forwarding name-server 8.8.8.8

# Default route
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1

# NAT for Internet access
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.10.0/24
set nat source rule 100 translation address masquerade
set nat source rule 101 outbound-interface eth0
set nat source rule 101 source address 192.168.20.0/24
set nat source rule 101 translation address masquerade
set nat source rule 102 outbound-interface eth0
set nat source rule 102 source address 192.168.30.0/24
set nat source rule 102 translation address masquerade

# NAT exclude for VPN traffic
set nat source rule 10 outbound-interface eth0
set nat source rule 10 source address 192.168.10.0/24
set nat source rule 10 destination address 192.168.0.0/24
set nat source rule 10 exclude

# IPsec site-to-site VPN to the head office
set vpn ipsec ike-group IKE-HQ proposal 1 encryption aes256
set vpn ipsec ike-group IKE-HQ proposal 1 hash sha256
set vpn ipsec ike-group IKE-HQ proposal 1 dh-group 14
set vpn ipsec ike-group IKE-HQ lifetime 28800

set vpn ipsec esp-group ESP-HQ proposal 1 encryption aes256
set vpn ipsec esp-group ESP-HQ proposal 1 hash sha256
set vpn ipsec esp-group ESP-HQ lifetime 3600
set vpn ipsec esp-group ESP-HQ pfs dh-group14

set vpn ipsec site-to-site peer 203.0.113.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret 'VerySecretPSK123!'
set vpn ipsec site-to-site peer 203.0.113.1 ike-group IKE-HQ
set vpn ipsec site-to-site peer 203.0.113.1 local-address 203.0.113.10
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 esp-group ESP-HQ
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 remote prefix 192.168.0.0/24

# QoS for VoIP prioritization
set traffic-policy shaper WAN-OUT bandwidth 100mbit
set traffic-policy shaper WAN-OUT default bandwidth 80%
set traffic-policy shaper WAN-OUT default queue-type fq-codel

# High priority for VoIP
set traffic-policy shaper WAN-OUT class 10 bandwidth 15%
set traffic-policy shaper WAN-OUT class 10 priority 1
set traffic-policy shaper WAN-OUT class 10 match VOIP ip dscp ef
set traffic-policy shaper WAN-OUT class 10 match VOIP-SIP ip destination port 5060
set traffic-policy shaper WAN-OUT class 10 match VOIP-RTP ip destination port 10000-20000

# Apply the QoS policy
set interfaces ethernet eth0 traffic-policy out WAN-OUT

# Firewall - WAN_LOCAL
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol icmp
# Allow IKE and ESP for IPsec
set firewall name WAN_LOCAL rule 40 action accept
set firewall name WAN_LOCAL rule 40 protocol udp
set firewall name WAN_LOCAL rule 40 destination port 500
set firewall name WAN_LOCAL rule 41 action accept
set firewall name WAN_LOCAL rule 41 protocol udp
set firewall name WAN_LOCAL rule 41 destination port 4500
set firewall name WAN_LOCAL rule 42 action accept
set firewall name WAN_LOCAL rule 42 protocol esp

# Firewall - WAN_IN
set firewall name WAN_IN default-action drop
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 state invalid enable

# Firewall - GUEST isolation (block access to the internal networks)
set firewall name GUEST_OUT default-action accept
set firewall name GUEST_OUT rule 10 action drop
set firewall name GUEST_OUT rule 10 destination address 192.168.10.0/24
set firewall name GUEST_OUT rule 11 action drop
set firewall name GUEST_OUT rule 11 destination address 192.168.30.0/24
set firewall name GUEST_OUT rule 12 action drop
set firewall name GUEST_OUT rule 12 destination address 192.168.0.0/24

# Apply the firewall
set interfaces ethernet eth0 firewall local name WAN_LOCAL
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth1 vif 20 firewall out name GUEST_OUT

commit
save

Template 3: Datacenter Edge Router (Datacenter with BGP)

Description

An edge router for a datacenter:

Dual WAN with BGP to two ISPs
Public IP addresses
NAT for internal servers
Destination NAT for public services
High Availability (VRRP)
OSPF for internal routing
Strict firewall

Topology

ISP1 (AS 65001)          ISP2 (AS 65002)
    |                         |
[eth0] 203.0.113.2/30    [eth1] 198.51.100.2/30
        \                   /
         \    VyOS Router  /
          \               /
           [eth2] Internal
              |
         172.16.0.1/24
         (Server Network)

Complete Configuration

configure

# System settings
set system host-name dc-edge-router
set system time-zone Europe/Moscow
set system domain-name dc.company.local

# Login
set system login user admin authentication plaintext-password 'VerySecurePass123!'
set system login user admin level admin

# SSH
set service ssh port 22
set service ssh disable-password-authentication
set service ssh listen-address 172.16.0.1

# NTP
set service ntp server ntp1.yandex.ru
set service ntp server ntp2.yandex.ru

# Syslog
set system syslog global facility all level info
set system syslog host 172.16.0.10 facility all level warning

# WAN1 interface (ISP1)
set interfaces ethernet eth0 address 203.0.113.2/30
set interfaces ethernet eth0 description 'ISP1-WAN'

# WAN2 interface (ISP2)
set interfaces ethernet eth1 address 198.51.100.2/30
set interfaces ethernet eth1 description 'ISP2-WAN'

# Internal interface
set interfaces ethernet eth2 address 172.16.0.1/24
set interfaces ethernet eth2 description 'Internal-Servers'

# BGP configuration
set protocols bgp 64512 parameters router-id 172.16.0.1

# BGP neighbor ISP1
set protocols bgp 64512 neighbor 203.0.113.1 remote-as 65001
set protocols bgp 64512 neighbor 203.0.113.1 description 'ISP1'
set protocols bgp 64512 neighbor 203.0.113.1 address-family ipv4-unicast
set protocols bgp 64512 neighbor 203.0.113.1 address-family ipv4-unicast default-originate
set protocols bgp 64512 neighbor 203.0.113.1 address-family ipv4-unicast soft-reconfiguration inbound

# BGP neighbor ISP2
set protocols bgp 64512 neighbor 198.51.100.1 remote-as 65002
set protocols bgp 64512 neighbor 198.51.100.1 description 'ISP2'
set protocols bgp 64512 neighbor 198.51.100.1 address-family ipv4-unicast
set protocols bgp 64512 neighbor 198.51.100.1 address-family ipv4-unicast default-originate
set protocols bgp 64512 neighbor 198.51.100.1 address-family ipv4-unicast soft-reconfiguration inbound

# Advertise our networks
set protocols bgp 64512 address-family ipv4-unicast network 203.0.113.0/28
set protocols bgp 64512 address-family ipv4-unicast network 198.51.100.0/28

# Prefix filtering for inbound advertisements
set policy prefix-list BGP-IN rule 10 action permit
set policy prefix-list BGP-IN rule 10 prefix 0.0.0.0/0
set policy prefix-list BGP-IN rule 10 le 24

set policy route-map BGP-FILTER rule 10 action permit
set policy route-map BGP-FILTER rule 10 match ip address prefix-list BGP-IN

set protocols bgp 64512 neighbor 203.0.113.1 address-family ipv4-unicast route-map import BGP-FILTER
set protocols bgp 64512 neighbor 198.51.100.1 address-family ipv4-unicast route-map import BGP-FILTER

# OSPF for internal networks (if there are other routers)
set protocols ospf parameters router-id 172.16.0.1
set protocols ospf area 0 network 172.16.0.0/24

# Redistribute BGP into OSPF (default route)
set protocols ospf redistribute bgp

# Source NAT for internal servers (via WAN1)
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 172.16.0.0/24
set nat source rule 100 translation address masquerade

# Source NAT via WAN2 (backup)
set nat source rule 101 outbound-interface eth1
set nat source rule 101 source address 172.16.0.0/24
set nat source rule 101 translation address masquerade

# Destination NAT for public services
# Web server at 172.16.0.20
set nat destination rule 100 inbound-interface eth0
set nat destination rule 100 protocol tcp
set nat destination rule 100 destination address 203.0.113.10
set nat destination rule 100 destination port 80
set nat destination rule 100 translation address 172.16.0.20
set nat destination rule 100 translation port 80

set nat destination rule 101 inbound-interface eth0
set nat destination rule 101 protocol tcp
set nat destination rule 101 destination address 203.0.113.10
set nat destination rule 101 destination port 443
set nat destination rule 101 translation address 172.16.0.20
set nat destination rule 101 translation port 443

# Mail server at 172.16.0.21
set nat destination rule 110 inbound-interface eth0
set nat destination rule 110 protocol tcp
set nat destination rule 110 destination address 203.0.113.11
set nat destination rule 110 destination port 25
set nat destination rule 110 translation address 172.16.0.21
set nat destination rule 110 translation port 25

set nat destination rule 111 inbound-interface eth0
set nat destination rule 111 protocol tcp
set nat destination rule 111 destination address 203.0.113.11
set nat destination rule 111 destination port 587
set nat destination rule 111 translation address 172.16.0.21
set nat destination rule 111 translation port 587

# Firewall - WAN1_LOCAL
set firewall name WAN1_LOCAL default-action drop
set firewall name WAN1_LOCAL rule 10 action accept
set firewall name WAN1_LOCAL rule 10 state established enable
set firewall name WAN1_LOCAL rule 10 state related enable
set firewall name WAN1_LOCAL rule 20 action drop
set firewall name WAN1_LOCAL rule 20 state invalid enable
set firewall name WAN1_LOCAL rule 30 action accept
set firewall name WAN1_LOCAL rule 30 protocol icmp
# Allow BGP
set firewall name WAN1_LOCAL rule 40 action accept
set firewall name WAN1_LOCAL rule 40 protocol tcp
set firewall name WAN1_LOCAL rule 40 source address 203.0.113.1
set firewall name WAN1_LOCAL rule 40 destination port 179

# Firewall - WAN2_LOCAL (same as WAN1)
set firewall name WAN2_LOCAL default-action drop
set firewall name WAN2_LOCAL rule 10 action accept
set firewall name WAN2_LOCAL rule 10 state established enable
set firewall name WAN2_LOCAL rule 10 state related enable
set firewall name WAN2_LOCAL rule 20 action drop
set firewall name WAN2_LOCAL rule 20 state invalid enable
set firewall name WAN2_LOCAL rule 30 action accept
set firewall name WAN2_LOCAL rule 30 protocol icmp
set firewall name WAN2_LOCAL rule 40 action accept
set firewall name WAN2_LOCAL rule 40 protocol tcp
set firewall name WAN2_LOCAL rule 40 source address 198.51.100.1
set firewall name WAN2_LOCAL rule 40 destination port 179

# Firewall - WAN1_IN (inbound traffic)
set firewall name WAN1_IN default-action drop
set firewall name WAN1_IN rule 10 action accept
set firewall name WAN1_IN rule 10 state established enable
set firewall name WAN1_IN rule 10 state related enable
set firewall name WAN1_IN rule 20 action drop
set firewall name WAN1_IN rule 20 state invalid enable
# Allow HTTP/HTTPS to the web server
set firewall name WAN1_IN rule 100 action accept
set firewall name WAN1_IN rule 100 protocol tcp
set firewall name WAN1_IN rule 100 destination address 172.16.0.20
set firewall name WAN1_IN rule 100 destination port 80
set firewall name WAN1_IN rule 101 action accept
set firewall name WAN1_IN rule 101 protocol tcp
set firewall name WAN1_IN rule 101 destination address 172.16.0.20
set firewall name WAN1_IN rule 101 destination port 443
# Allow SMTP to the mail server
set firewall name WAN1_IN rule 110 action accept
set firewall name WAN1_IN rule 110 protocol tcp
set firewall name WAN1_IN rule 110 destination address 172.16.0.21
set firewall name WAN1_IN rule 110 destination port 25
set firewall name WAN1_IN rule 111 action accept
set firewall name WAN1_IN rule 111 protocol tcp
set firewall name WAN1_IN rule 111 destination address 172.16.0.21
set firewall name WAN1_IN rule 111 destination port 587

# Firewall - WAN2_IN (same as WAN1_IN)
set firewall name WAN2_IN default-action drop
set firewall name WAN2_IN rule 10 action accept
set firewall name WAN2_IN rule 10 state established enable
set firewall name WAN2_IN rule 10 state related enable
set firewall name WAN2_IN rule 20 action drop
set firewall name WAN2_IN rule 20 state invalid enable

# Apply the firewall
set interfaces ethernet eth0 firewall local name WAN1_LOCAL
set interfaces ethernet eth0 firewall in name WAN1_IN
set interfaces ethernet eth1 firewall local name WAN2_LOCAL
set interfaces ethernet eth1 firewall in name WAN2_IN

# Conntrack optimization for high load
set system conntrack table-size 262144
set system conntrack timeout tcp established 432000
set system conntrack timeout tcp close 10

commit
save

Template 4: Service Provider Edge Router (ISP)

Description

An edge router for a service provider (ISP):

BGP with upstream providers
BGP with clients
PPPoE server for clients
RADIUS authentication
Per-client traffic shaping
IPv6 dual-stack

Topology

Upstream Provider (AS 65000)
           |
       [eth0] 203.0.113.2/30
           |
      VyOS Router (AS 64600)
           |
       [eth1] PPPoE Server
           |
    10.0.0.0/8 (PPPoE pool)
           |
      DSL Clients

Basic Configuration (simplified)

configure

# System settings
set system host-name isp-edge-router
set system time-zone Europe/Moscow

# Login
set system login user admin authentication plaintext-password 'ISPSecurePass123!'
set system login user admin level admin

# SSH
set service ssh port 22
set service ssh disable-password-authentication

# NTP
set service ntp server ntp1.yandex.ru
set service ntp server ntp2.yandex.ru

# Upstream interface
set interfaces ethernet eth0 address 203.0.113.2/30
set interfaces ethernet eth0 description 'Upstream-Provider'

# PPPoE server interface
set interfaces ethernet eth1 description 'PPPoE-Clients'

# PPPoE server
set service pppoe-server interface eth1
set service pppoe-server authentication mode radius
set service pppoe-server authentication radius server 192.168.100.10 key 'radius-secret'
set service pppoe-server gateway-address 10.0.0.1
set service pppoe-server client-ip-pool start 10.0.0.10
set service pppoe-server client-ip-pool stop 10.255.255.254

# BGP with the upstream provider
set protocols bgp 64600 parameters router-id 203.0.113.2
set protocols bgp 64600 neighbor 203.0.113.1 remote-as 65000
set protocols bgp 64600 neighbor 203.0.113.1 description 'Upstream-Provider'
set protocols bgp 64600 neighbor 203.0.113.1 address-family ipv4-unicast

# Receive the full table or a default route
set protocols bgp 64600 neighbor 203.0.113.1 address-family ipv4-unicast default-originate

# Advertise our networks
set protocols bgp 64600 address-family ipv4-unicast network 10.0.0.0/8

# Traffic shaping for clients (example)
set traffic-policy shaper CLIENT-100M bandwidth 100mbit
set traffic-policy shaper CLIENT-100M default bandwidth 100%
set traffic-policy shaper CLIENT-100M default queue-type fq-codel

# Firewall for protection
set firewall name UPSTREAM_LOCAL default-action drop
set firewall name UPSTREAM_LOCAL rule 10 action accept
set firewall name UPSTREAM_LOCAL rule 10 state established enable
set firewall name UPSTREAM_LOCAL rule 10 state related enable
set firewall name UPSTREAM_LOCAL rule 20 action drop
set firewall name UPSTREAM_LOCAL rule 20 state invalid enable
set firewall name UPSTREAM_LOCAL rule 30 action accept
set firewall name UPSTREAM_LOCAL rule 30 protocol icmp
set firewall name UPSTREAM_LOCAL rule 40 action accept
set firewall name UPSTREAM_LOCAL rule 40 protocol tcp
set firewall name UPSTREAM_LOCAL rule 40 destination port 179

set interfaces ethernet eth0 firewall local name UPSTREAM_LOCAL

commit
save

Template 5: Multi-WAN Load Balancing

Description

A router that balances load across several WAN links:

2-3 WAN interfaces
Load balancing with weights
Failover when a link goes down
Policy-based routing for critical traffic

Topology

WAN1 (100 Mbps)    WAN2 (50 Mbps)
       |                 |
   [eth0]            [eth1]
        \             /
         \   VyOS   /
          \ Router /
             [eth2]
               |
          LAN Network
        192.168.1.0/24

Complete Configuration

configure

# System settings
set system host-name multi-wan-router
set system time-zone Europe/Moscow

# Login
set system login user admin authentication plaintext-password 'MultiWAN123!'
set system login user admin level admin

# SSH
set service ssh port 22

# NTP
set service ntp server 0.pool.ntp.org

# WAN1 interface (primary, 100 Mbps)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN1-Primary'

# WAN2 interface (backup, 50 Mbps)
set interfaces ethernet eth1 address dhcp
set interfaces ethernet eth1 description 'WAN2-Backup'

# LAN interface
set interfaces ethernet eth2 address 192.168.1.1/24
set interfaces ethernet eth2 description 'LAN'

# DHCP server for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200

# DNS forwarding
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

# Load balancing configuration
set load-balancing wan interface-health eth0 failure-count 3
set load-balancing wan interface-health eth0 success-count 1
set load-balancing wan interface-health eth0 nexthop dhcp
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health eth1 failure-count 3
set load-balancing wan interface-health eth1 success-count 1
set load-balancing wan interface-health eth1 nexthop dhcp
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 8.8.4.4

# Load balancing rule (2:1 weight for WAN1:WAN2)
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 source address 192.168.1.0/24
set load-balancing wan rule 10 interface eth0 weight 2
set load-balancing wan rule 10 interface eth1 weight 1

# Sticky connections for established sessions
set load-balancing wan sticky-connections inbound

# NAT for both WANs
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 101 outbound-interface eth1
set nat source rule 101 source address 192.168.1.0/24
set nat source rule 101 translation address masquerade

# Firewall for the WAN interfaces
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol icmp

set firewall name WAN_IN default-action drop
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 state invalid enable

set interfaces ethernet eth0 firewall local name WAN_LOCAL
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth1 firewall local name WAN_LOCAL
set interfaces ethernet eth1 firewall in name WAN_IN

commit
save

Monitoring Load Balancing

# Check the status of the WAN interfaces
show load-balancing wan

# Check the health checks
show load-balancing wan interface-health

# Per-rule statistics
show load-balancing wan rule

Template 6: High Availability (VRRP) Pair

Description

A pair of routers in an HA configuration for critical services:

VRRP for failover
Conntrack synchronization
Identical configuration (except the VRRP priority)

Topology

        Internet
           |
     [eth0 WAN]
           |
   VyOS Router 1 (MASTER)
   VRRP Priority: 200
           |
   VyOS Router 2 (BACKUP)
   VRRP Priority: 100
           |
     [eth1 LAN]
           |
    192.168.1.0/24
    (Virtual IP: 192.168.1.1)

Router 1 (MASTER) Configuration

configure

# System settings
set system host-name ha-router-1
set system time-zone Europe/Moscow

# Login
set system login user admin authentication plaintext-password 'HASecure123!'
set system login user admin level admin

# SSH
set service ssh port 22

# WAN interface
set interfaces ethernet eth0 address 203.0.113.10/24
set interfaces ethernet eth0 description 'WAN'

# LAN interface with a real IP
set interfaces ethernet eth1 address 192.168.1.2/24
set interfaces ethernet eth1 description 'LAN'

# VRRP for the LAN (Virtual IP)
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN virtual-address 192.168.1.1/24
set high-availability vrrp group LAN priority 200
set high-availability vrrp group LAN preempt true
set high-availability vrrp group LAN authentication type simple
set high-availability vrrp group LAN authentication password 'vrrp-secret'

# VRRP for the WAN (Virtual IP)
set high-availability vrrp group WAN vrid 20
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN virtual-address 203.0.113.1/24
set high-availability vrrp group WAN priority 200
set high-availability vrrp group WAN preempt true
set high-availability vrrp group WAN authentication type simple
set high-availability vrrp group WAN authentication password 'vrrp-secret'

# Conntrack synchronization
set high-availability vrrp sync-group SYNC member LAN
set high-availability vrrp sync-group SYNC member WAN

# DHCP server (uses the virtual IP)
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200

# DNS forwarding
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding name-server 8.8.8.8

# Default route
set protocols static route 0.0.0.0/0 next-hop 203.0.113.254

# NAT (uses the virtual WAN IP)
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol icmp
# Allow VRRP
set firewall name WAN_LOCAL rule 40 action accept
set firewall name WAN_LOCAL rule 40 protocol vrrp

set interfaces ethernet eth0 firewall local name WAN_LOCAL

commit
save

Router 2 (BACKUP) Configuration

# Identical to Router 1, but with the following parameters changed:

set system host-name ha-router-2

# Real IP on the LAN
set interfaces ethernet eth1 address 192.168.1.3/24

# Real IP on the WAN
set interfaces ethernet eth0 address 203.0.113.11/24

# Lower VRRP priority (BACKUP)
set high-availability vrrp group LAN priority 100
set high-availability vrrp group WAN priority 100

# Everything else is identical to Router 1

Verifying HA Status

# Check the VRRP status
show vrrp

# Detailed information
show vrrp detail

# Check conntrack synchronization
show high-availability sync

Testing and Validating the Templates

Basic Tests After Applying a Template

# 1. Check the configuration
show configuration

# 2. Check the interfaces
show interfaces
show interfaces addresses

# 3. Check routing
show ip route

# 4. Check NAT
show nat source statistics

# 5. Check the firewall
show firewall

# 6. Test connectivity
ping 8.8.8.8
ping -c 3 google.com

# 7. Check DNS
nslookup google.com

# 8. Check the services
show service dhcp-server statistics
show service ssh

Performance Testing

# Check throughput with iperf3
# On the server (LAN)
iperf3 -s

# On the client (through the router)
iperf3 -c <server-ip> -t 60

# Check latency
ping <target> -c 100
# Look at avg/stddev

# Check the router load
show system cpu
show system memory

Best Practices When Using the Templates

Always back up before applying

save /config/config.boot.before-template

Roll out gradually in a test environment

# Test on a staging router first

Document your changes

# Create a README describing the specifics of your deployment

Use commit-confirm for critical changes

commit-confirm 10
# Test
confirm  # If everything is OK

Adapt to your requirements

# Change the IP addresses
# Change the interface names
# Add rules specific to your setup

Monitor after applying

# Use monitor log
# Check the metrics
# Test all functions

Keep the templates under version control

git init
git add config-templates/
git commit -m "Added SOHO template"

Conclusion

These templates provide a solid foundation for common VyOS deployment scenarios:

SOHO Router: A simple router for a small office
Branch Office: A branch with VPN and VLANs
Datacenter Edge: A datacenter with BGP dual-homing
Service Provider: An ISP edge with PPPoE
Multi-WAN: Load balancing
High Availability: VRRP failover

Adapt these templates to your requirements, test thoroughly, and document every change for future reference.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Troubleshooting WireGuard VPN on VyOS - Setup and Examples