# Firewall with VRF Isolation

> Inter-VRF firewall rules on VyOS - tenant isolation, route leaking control, security policies, and multi-tenant filtering

Source: https://opennix.org/en/docs/vyos/examples/firewall-vrf/


Firewall rules for controlling traffic between VRF instances in multi-tenant deployments.

## Scenario

- Multi-Tenant: Isolating customers with VRF
- Selective Access: Controlled access to shared services
- Security: Firewall between VRFs

## Configuration

```bash
# VRF Creation
set vrf name CUSTOMER-A table '100'
set vrf name CUSTOMER-B table '200'
set vrf name SHARED table '999'

# Firewall for inter-VRF traffic
set firewall ipv4-name VRF-ISOLATION default-action 'drop'
set firewall ipv4-name VRF-ISOLATION rule 10 action 'accept'
set firewall ipv4-name VRF-ISOLATION rule 10 destination address '10.255.0.53'
set firewall ipv4-name VRF-ISOLATION rule 10 destination port '53'
set firewall ipv4-name VRF-ISOLATION rule 10 protocol 'udp'
set firewall ipv4-name VRF-ISOLATION rule 10 description 'Allow DNS to shared'

# Apply to VRF
set vrf name CUSTOMER-A ip protocol all export 'VRF-ISOLATION'
set vrf name CUSTOMER-B ip protocol all export 'VRF-ISOLATION'
```

## References

- [VyOS VRF](https://docs.vyos.io/en/latest/configuration/vrf/index.html)
- [VyOS Firewall](https://docs.vyos.io/en/latest/configuration/firewall/general.html)