Firewall in VyOS

The VyOS firewall protects the network by filtering traffic based on rules.

Section contents

Firewall Configuration

A complete guide to configuring the firewall in VyOS.

Key capabilities:

• Stateful and stateless filtering
• IPv4 and IPv6 support
• Security zones
• Address and network groups
• Port and protocol filtering
• Connection tracking
• Rate limiting

VyOS 1.5 uses nftables instead of iptables for better performance.

Core concepts

Traffic directions

• Input - traffic to the router itself
• Output - traffic from the router
• Forward - transit traffic passing through the router

Rule types

• Accept - allow the traffic
• Drop - discard without notification
• Reject - reject with notification
• Return - return to the previous rule

Default Action

The default action for traffic that does not match any rule (usually drop).

Quick examples

Basic WAN interface protection

set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

Allow SSH only from the local network

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 destination port 22
set firewall ipv4 input filter rule 20 protocol tcp
set firewall ipv4 input filter rule 20 source address 192.168.1.0/24

Best practices

1. Default Deny - block everything by default and allow only what is necessary
2. Established/Related First - allow established connections in the first rule
3. Logging - log blocked traffic for analysis
4. Address groups - use them to simplify management
5. Documentation - comment your rules

Additional resources

• VyOS Firewall Documentation
• nftables Documentation