Documentation
VyOS Documentation
VyOS Configuration Examples
Firewall with VRF Isolation

Firewall with VRF Isolation

Firewall rules for controlling traffic between VRF instances in multi-tenant deployments.

Scenario

  • Multi-Tenant: Isolating customers with VRF
  • Selective Access: Controlled access to shared services
  • Security: Firewall between VRFs

Configuration

# VRF Creation
set vrf name CUSTOMER-A table '100'
set vrf name CUSTOMER-B table '200'
set vrf name SHARED table '999'

# Firewall for inter-VRF traffic
set firewall ipv4-name VRF-ISOLATION default-action 'drop'
set firewall ipv4-name VRF-ISOLATION rule 10 action 'accept'
set firewall ipv4-name VRF-ISOLATION rule 10 destination address '10.255.0.53'
set firewall ipv4-name VRF-ISOLATION rule 10 destination port '53'
set firewall ipv4-name VRF-ISOLATION rule 10 protocol 'udp'
set firewall ipv4-name VRF-ISOLATION rule 10 description 'Allow DNS to shared'

# Apply to VRF
set vrf name CUSTOMER-A ip protocol all export 'VRF-ISOLATION'
set vrf name CUSTOMER-B ip protocol all export 'VRF-ISOLATION'

References

Reviewed by OpenNix LLC · Last updated on
Zone-Based FirewallBridge with Firewall (L2 Filtering)