# VyOS Configuration Examples

> Production-ready VyOS configuration examples - VPN (Azure, Cisco, Palo Alto), IPv6, BGP/OSPF, Inter-VRF, L3VPN, DMVPN, and firewall setups

Source: https://opennix.org/en/docs/vyos/examples/


A complete collection of production-ready VyOS configuration examples for a wide range of use cases. Each example includes a full working configuration, network topology, explanations, and integration with cloud platforms (Yandex Cloud and VK Cloud where applicable).

## Configuration Blueprints (Autotest)

[Configuration Blueprints](/docs/vyos/examples/vyos-blueprints/) - automatically tested configuration examples with a full validation lifecycle on the EVE-NG platform. Every blueprint is tested automatically, which guarantees that the configuration works on the specified VyOS versions.

**Available Blueprints**:
- **DHCP Relay through GRE-Bridge** - DHCP relay over a GRE tunnel
- **Tunnelbroker.net IPv6** - IPv6 connectivity via Hurricane Electric
- **L3VPN EVPN** - Multi-tenant datacenter L3VPN
- **WireGuard VPN** - Modern high-performance VPN
- **OpenVPN with LDAP** - Enterprise Remote Access VPN

[More about Configuration Blueprints →](/docs/vyos/examples/vyos-blueprints/)

## Example Structure

### VPN Scenarios

#### Site-to-Site VPN
- [VPN to Microsoft Azure](/docs/vyos/examples/vpn-azure/) - Route-Based VPN with BGP over IKEv2
- [Redundant VPN to Azure](/docs/vyos/examples/vpn-azure-redundant/) - Dual-tunnel HA setup
- [VPN to Cisco ASA](/docs/vyos/examples/vpn-cisco/) - Policy-Based IPsec
- [VPN to Palo Alto](/docs/vyos/examples/vpn-paloalto/) - Route-Based IPsec
- [FlexVPN to Cisco](/docs/vyos/examples/vpn-flexvpn/) - Modern IKEv2-based VPN

#### Advanced VPN
- [DMVPN Dual HUB](/docs/vyos/examples/dmvpn/) - Dynamic Multipoint VPN
- [OpenVPN with LDAP](/docs/vyos/examples/openvpn-ldap/) - Enterprise authentication

### IPv6 Scenarios

- [Tunnelbroker.net Setup](/docs/vyos/examples/tunnelbroker-ipv6/) - IPv6 via Hurricane Electric
- [PPPoE IPv6 Home Setup](/docs/vyos/examples/pppoe-ipv6/) - Dual-stack for a home network
- [PPPoE over L2TP](/docs/vyos/examples/pppoe-l2tp/) - PPPoE encapsulation

### Advanced Routing

- [BGP IPv6 Unnumbered](/docs/vyos/examples/bgp-ipv6-unnumbered/) - Extended nexthop
- [OSPF Unnumbered with ECMP](/docs/vyos/examples/ospf-unnumbered-ecmp/) - Equal-Cost paths
- [Inter-VRF Routing](/docs/vyos/examples/inter-vrf-routing/) - VRF Lite configuration

### L3VPN Scenarios

- [L3VPN Hub-and-Spoke](/docs/vyos/examples/l3vpn-hub-spoke/) - Centralized topology
- [L3VPN EVPN](/docs/vyos/examples/l3vpn-evpn/) - Ethernet VPN for the datacenter

### Firewall Examples

- [Zone-Based Firewall](/docs/vyos/examples/firewall-zones/) - Security zones
- [VRF + Firewall](/docs/vyos/examples/firewall-vrf/) - Firewall with VRF isolation
- [Bridge + Firewall](/docs/vyos/examples/firewall-bridge/) - L2 filtering

### Service Provider

- [DHCP Relay through GRE-Bridge](/docs/vyos/examples/dhcp-relay-gre/) - DHCP over a tunnel

### Automation

- [Ansible for VyOS](/docs/vyos/examples/ansible/) - Automated deployment

---

## Categories by Difficulty

### Beginner
- PPPoE IPv6 Home Setup
- Tunnelbroker IPv6
- VPN to Azure (basic)

### Intermediate
- VPN to Cisco/Palo Alto
- OSPF Unnumbered
- Zone-Based Firewall
- Inter-VRF Routing

### Advanced
- BGP IPv6 Unnumbered
- L3VPN EVPN
- DMVPN Dual HUB
- Ansible Automation

### Expert
- FlexVPN
- L3VPN Hub-and-Spoke
- DHCP Relay through GRE-Bridge

---

## Categories by Use Case

### Enterprise Networks
- VPN to Azure/Cisco/Palo Alto
- Inter-VRF Routing
- Zone-Based Firewall
- OpenVPN with LDAP
- Ansible Automation

### Service Provider
- DMVPN Dual HUB
- PPPoE over L2TP
- DHCP Relay through GRE
- L3VPN Hub-and-Spoke

### Datacenter
- BGP IPv6 Unnumbered
- OSPF Unnumbered with ECMP
- L3VPN EVPN
- VRF + Firewall

### Cloud Integration
- VPN to Azure (Yandex Cloud ↔ Azure)
- VPN to Azure (VK Cloud ↔ Azure)
- Tunnelbroker IPv6 (Cloud IPv6 connectivity)

### Home/SOHO
- PPPoE IPv6 Setup
- Tunnelbroker IPv6

---

## Cloud Platform Integration

### Yandex Cloud Integration

Many of the examples are adapted for use with Yandex Cloud:

- **VPN to Azure**: VyOS in Yandex Cloud as a VPN gateway
- **Tunnelbroker IPv6**: IPv6 connectivity for Yandex Cloud VMs
- **Inter-VRF Routing**: Isolating environments (prod/dev/test)
- **Zone Firewall**: Security zones for cloud networks

### VK Cloud Integration

Examples adapted for VK Cloud:

- **VPN scenarios**: VK Cloud ↔ Azure/On-premises
- **IPv6 tunneling**: IPv6 for VK Cloud infrastructure
- **Multi-tenant**: VRF for tenant isolation

---

## How to Use the Examples

### 1. Choose the right scenario
Identify your use case and find the matching example.

### 2. Study the topology
Each example includes a network topology diagram.

### 3. Adapt the configuration
Replace the placeholder IP addresses and parameters with your actual values.

### 4. Test incrementally
Apply the configuration in stages, verifying each component.

### 5. Validate the result
Use the verification commands from the "Verification" section in each example.

---

## Structure of Each Example

Each configuration example includes:

1. **Scenario description** - Use case and applicability
2. **Network topology** - Network diagram
3. **Requirements** - Prerequisites
4. **Full VyOS configuration** - Complete working config
5. **Third-party device configuration** - Azure/Cisco/etc configs
6. **Cloud integration** - Yandex Cloud / VK Cloud specifics
7. **Verification commands** - Verification commands
8. **Troubleshooting** - Common issues
9. **Best practices** - Recommendations

---

## Additional Resources

- [VyOS Official Documentation](https://docs.vyos.io)
- [VyOS Configuration Blueprints (Autotest)](/docs/vyos/examples/vyos-blueprints/)
- [VyOS First Steps](/docs/vyos/first-steps/)
- [VyOS Troubleshooting](/docs/vyos/admin-guide/vyos-troubleshooting/)