Documentation
VyOS Documentation
Firewall in VyOS
Firewall

Firewall

VyOS uses nftables (starting with version 1.5.x) as the firewall backend, providing flexible and high-performance control over network traffic.

Firewall architecture

Packet processing stages

Packets pass through several processing stages:

  1. Prerouting - packets before the routing decision is made
  2. Input - packets addressed to the router itself
  3. Forward - transit packets (passing through the router)
  4. Output - packets originating from the router
  5. Postrouting - packets after the routing decision is made
                                 Packet in
                                      │
                                      ▼
                               ┌─────────────┐
                               │ Prerouting  │
                               └──────┬──────┘
                                      │
                         ┌────────────┴────────────┐
                         │                         │
                         ▼                         ▼
                   ┌──────────┐            ┌──────────────┐
                   │  Input   │            │   Forward    │
                   └────┬─────┘            └──────┬───────┘
                        │                         │
                        ▼                         ▼
                   Local                     Routing
                   processes                      │
                        │                         │
                        ▼                         │
                   ┌──────────┐                  │
                   │  Output  │                  │
                   └────┬─────┘                  │
                        │                         │
                        └────────────┬────────────┘
                                     ▼
                              ┌─────────────┐
                              │ Postrouting │
                              └──────┬──────┘
                                     ▼
                               Packet out

Firewall types

IPv4 Firewall

Rules for IPv4 traffic:

set firewall ipv4 input filter rule <number>
set firewall ipv4 forward filter rule <number>
set firewall ipv4 output filter rule <number>
set firewall ipv4 prerouting filter rule <number>

IPv6 Firewall

Rules for IPv6 traffic:

set firewall ipv6 input filter rule <number>
set firewall ipv6 forward filter rule <number>
set firewall ipv6 output filter rule <number>

Bridge Firewall

Rules for bridge (L2) traffic:

set firewall bridge forward filter rule <number>
set firewall bridge prerouting filter rule <number>

Groups

Groups let you combine addresses, networks, ports, and interfaces to simplify rules.

Address Group

A group of IP addresses:

set firewall group address-group LAN-HOSTS address 192.168.1.10
set firewall group address-group LAN-HOSTS address 192.168.1.20
set firewall group address-group LAN-HOSTS address 192.168.1.30

Network Group

A group of networks:

set firewall group network-group INTERNAL-NETS network 192.168.0.0/24
set firewall group network-group INTERNAL-NETS network 192.168.1.0/24
set firewall group network-group INTERNAL-NETS network 10.0.0.0/8

Port Group

A group of ports:

set firewall group port-group WEB-PORTS port 80
set firewall group port-group WEB-PORTS port 443
set firewall group port-group WEB-PORTS port 8080

Interface Group

A group of interfaces:

set firewall group interface-group LAN-INTERFACES interface eth1
set firewall group interface-group LAN-INTERFACES interface eth2
set firewall group interface-group LAN-INTERFACES interface eth3

Rule structure

Basic rule

set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 source address 192.168.1.0/24
set firewall ipv4 forward filter rule 10 destination address 8.8.8.8
set firewall ipv4 forward filter rule 10 protocol tcp
set firewall ipv4 forward filter rule 10 destination port 443

Actions

  • accept - allow the packet
  • drop - drop the packet (without notification)
  • reject - reject the packet (sending an ICMP/TCP RST)
  • return - return to the rule of the calling chain
  • jump <target> - jump to another rule chain

Default Action

The default action for traffic that does not match any rule:

set firewall ipv4 forward filter default-action drop

Matching criteria

Source and Destination

IP addresses:

set firewall ipv4 forward filter rule 10 source address 192.168.1.0/24
set firewall ipv4 forward filter rule 10 destination address 8.8.8.8

Address groups:

set firewall ipv4 forward filter rule 10 source group address-group LAN-HOSTS
set firewall ipv4 forward filter rule 10 destination group network-group DMZ-NETS

Ports:

set firewall ipv4 forward filter rule 10 source port 1024-65535
set firewall ipv4 forward filter rule 10 destination port 80
set firewall ipv4 forward filter rule 10 destination group port-group WEB-PORTS

Protocols

set firewall ipv4 forward filter rule 10 protocol tcp
set firewall ipv4 forward filter rule 20 protocol udp
set firewall ipv4 forward filter rule 30 protocol icmp

List of protocols: tcp, udp, icmp, esp, ah, gre, ipip, all

ICMP

ICMP types:

set firewall ipv4 forward filter rule 30 protocol icmp
set firewall ipv4 forward filter rule 30 icmp type-name echo-request

TCP flags

set firewall ipv4 forward filter rule 10 protocol tcp
set firewall ipv4 forward filter rule 10 tcp flags syn
set firewall ipv4 forward filter rule 10 tcp flags not fin
set firewall ipv4 forward filter rule 10 tcp flags not ack

Connection state

set firewall ipv4 forward filter rule 10 state established
set firewall ipv4 forward filter rule 10 state related
set firewall ipv4 forward filter rule 20 state invalid
set firewall ipv4 forward filter rule 20 action drop

States:

  • established - packets belonging to established connections
  • related - packets related to established connections
  • new - new connections
  • invalid - malformed packets

Interfaces

Inbound interface:

set firewall ipv4 forward filter rule 10 inbound-interface name eth0

Outbound interface:

set firewall ipv4 forward filter rule 10 outbound-interface name eth1

Interface groups:

set firewall ipv4 forward filter rule 10 inbound-interface group LAN-INTERFACES

Logging

Enable logging for a rule:

set firewall ipv4 forward filter rule 10 log

With a custom prefix:

set firewall ipv4 forward filter rule 10 log
set firewall ipv4 forward filter rule 10 log-prefix "[FW-DROP]"

Rate Limiting

Limit how often a rule fires:

set firewall ipv4 forward filter rule 10 limit rate 10/second
set firewall ipv4 forward filter rule 10 limit burst 20

Configuration examples

Basic router protection (Input)

# Default drop
set firewall ipv4 input filter default-action drop

# Allow established/related
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

# Drop invalid
set firewall ipv4 input filter rule 20 action drop
set firewall ipv4 input filter rule 20 state invalid

# Allow ICMP
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 protocol icmp

# Allow SSH from LAN
set firewall ipv4 input filter rule 40 action accept
set firewall ipv4 input filter rule 40 source group address-group LAN-NETWORKS
set firewall ipv4 input filter rule 40 destination port 22
set firewall ipv4 input filter rule 40 protocol tcp

Basic protection for transit traffic (Forward)

# Default drop
set firewall ipv4 forward filter default-action drop

# Established/related
set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 state established
set firewall ipv4 forward filter rule 10 state related

# Invalid drop
set firewall ipv4 forward filter rule 20 action drop
set firewall ipv4 forward filter rule 20 state invalid

# Allow LAN -> WAN
set firewall ipv4 forward filter rule 30 action accept
set firewall ipv4 forward filter rule 30 source group address-group LAN-NETWORKS
set firewall ipv4 forward filter rule 30 outbound-interface name eth0

Allowing specific services

# Web server in the DMZ
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 destination address 192.168.100.10
set firewall ipv4 forward filter rule 100 destination group port-group WEB-PORTS
set firewall ipv4 forward filter rule 100 protocol tcp

# SSH for administrators
set firewall ipv4 forward filter rule 110 action accept
set firewall ipv4 forward filter rule 110 source group address-group ADMIN-HOSTS
set firewall ipv4 forward filter rule 110 destination group network-group SERVERS
set firewall ipv4 forward filter rule 110 destination port 22
set firewall ipv4 forward filter rule 110 protocol tcp

DoS protection

# ICMP limit
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 protocol icmp
set firewall ipv4 input filter rule 30 limit rate 10/second

# Limit new SSH connections
set firewall ipv4 input filter rule 40 action accept
set firewall ipv4 input filter rule 40 destination port 22
set firewall ipv4 input filter rule 40 protocol tcp
set firewall ipv4 input filter rule 40 state new
set firewall ipv4 input filter rule 40 limit rate 3/minute

Zone-Based Firewall

Zones let you group interfaces and define policies between zones.

Creating zones

set firewall zone LAN interface eth1
set firewall zone LAN default-action drop

set firewall zone WAN interface eth0
set firewall zone WAN default-action drop

set firewall zone DMZ interface eth2
set firewall zone DMZ default-action drop

Policies between zones

# LAN -> WAN
set firewall zone LAN from WAN firewall ipv4 name LAN-WAN-FILTER

# WAN -> LAN (usually blocked)
set firewall zone WAN from LAN firewall ipv4 name WAN-LAN-FILTER

Global Options

Connection tracking

Timeout for various protocols:

set firewall global-options timeout tcp close 10
set firewall global-options timeout tcp established 86400
set firewall global-options timeout udp other 30
set firewall global-options timeout icmp 10

Log martians

Log packets with invalid addresses:

set firewall global-options log-martians

State policy

Policy for various connection states:

set firewall global-options state-policy established action accept
set firewall global-options state-policy related action accept
set firewall global-options state-policy invalid action drop

Flowtable

Hardware acceleration for high-performance processing:

set firewall flowtable FT01 interface eth0
set firewall flowtable FT01 interface eth1
set firewall flowtable FT01 offload hardware

Operational commands

Viewing rules

show firewall
show firewall ipv4
show firewall ipv4 forward filter
show firewall ipv4 forward filter rule 10

Viewing statistics

show firewall statistics

Viewing groups

show firewall group
show firewall group address-group LAN-NETWORKS

Monitoring logs

monitor log | grep FW

Troubleshooting

Traffic is being blocked

Check the rules:

show firewall ipv4 forward filter

Enable logging for diagnostics:

set firewall ipv4 forward filter rule 10 log
commit

View the logs:

show log firewall
monitor log | grep firewall

Performance issues

Use a flowtable for offload:

set firewall flowtable FT01 interface eth0
set firewall flowtable FT01 interface eth1
set firewall flowtable FT01 offload hardware

Check connection tracking:

show conntrack table ipv4

Best practices

  1. Default deny - use default-action drop and allow only the necessary traffic
  2. Stateful inspection - always allow established/related connections
  3. Block invalid - drop packets in the invalid state
  4. Use groups - simplifies rule management
  5. Log the critical - enable logging for important rules
  6. Rule numbering - leave gaps (10, 20, 30) for future changes
  7. Document - use descriptive names for groups and zones
  8. Test carefully - use commit-confirm for remote changes

Next steps

  • NAT - address translation setup
  • VPN - secure connections
  • Policy - routing policies
Reviewed by OpenNix LLC · Last updated on
L2TP/IPsec VPNNAT (Network Address Translation)