Documentation
VyOS Documentation
VyOS Interfaces
Wireless (WLAN/WiFi) Interfaces in VyOS

Wireless (WLAN/WiFi) Interfaces in VyOS

Wireless interfaces in VyOS let you create access points (Access Point) or connect to existing wireless networks (Station mode).

Overview

VyOS supports the following wireless interface operating modes:

  • Access Point (WAP) - provide wireless access to client devices
  • Station (Client) - connect to an existing wireless network
  • Monitor - passively monitor wireless traffic

Supported standards:

  • IEEE 802.11a (5 GHz)
  • IEEE 802.11b/g (2.4 GHz)
  • IEEE 802.11n (2.4/5 GHz)
  • IEEE 802.11ac (5 GHz)
  • IEEE 802.11ax (2.4/5/6 GHz, WiFi 6)

Security:

  • WPA/WPA2-Personal (PSK)
  • WPA3-Personal (SAE)
  • WPA/WPA2-Enterprise (802.1X RADIUS)
  • Management Frame Protection (IEEE 802.11w)

Regulatory domain

IMPORTANT: Before configuring wireless interfaces, you must set the country code (regulatory domain).

Setting the country code

set system wireless country-code ru
commit

Country codes (ISO 3166-1 alpha-2):

  • ru - Russia
  • us - United States
  • de - Germany
  • gb - United Kingdom
  • fr - France
  • jp - Japan
  • cn - China

The country code determines:

  • Allowed frequencies and channels
  • Maximum transmit power
  • DFS (Dynamic Frequency Selection) requirements
  • Allowed standards (802.11d)

Access Point mode

Basic configuration

A simple access point with WPA2:

set system wireless country-code ru
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 ssid 'MyNetwork'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'SecurePassword123'
commit

SSID

Setting the network name:

set interfaces wireless wlan0 ssid 'Office-WiFi'
commit

Parameters:

  • Maximum length: 32 characters
  • May contain spaces (use quotes)
  • UTF-8 encoding is supported

Hidden SSID (not advertised in beacons):

set interfaces wireless wlan0 security wpa disable-ssid-broadcast
commit

Channel selection

2.4 GHz (802.11b/g/n):

set interfaces wireless wlan0 channel 1
commit

Available 2.4 GHz channels:

  • 1-14 (depending on the regulatory domain)
  • Recommended non-overlapping: 1, 6, 11

5 GHz (802.11a/n/ac/ax):

set interfaces wireless wlan0 channel 36
commit

Available 5 GHz channels:

  • 36, 40, 44, 48 - UNII-1 (indoor)
  • 52, 56, 60, 64 - UNII-2 (indoor, requires DFS)
  • 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144 - UNII-2 Extended (requires DFS)
  • 149, 153, 157, 161, 165 - UNII-3 (outdoor)

6 GHz (802.11ax, WiFi 6E):

set interfaces wireless wlan0 channel 1
commit

6 GHz channels: 1-233

Automatic channel selection (ACS):

set interfaces wireless wlan0 channel 0
commit

Wireless standard

802.11b (2.4 GHz, up to 11 Mbps):

set interfaces wireless wlan0 physical-device phy0
set interfaces wireless wlan0 mode b
commit

802.11g (2.4 GHz, up to 54 Mbps):

set interfaces wireless wlan0 mode g
commit

802.11n (2.4/5 GHz, up to 600 Mbps):

set interfaces wireless wlan0 mode n
commit

802.11ac (5 GHz, up to 6.9 Gbps):

set interfaces wireless wlan0 mode ac
commit

802.11ax (2.4/5/6 GHz, WiFi 6):

set interfaces wireless wlan0 mode ax
commit

Mixed mode (b/g):

set interfaces wireless wlan0 mode g
commit

Channel width

20 MHz (default):

set interfaces wireless wlan0 channel-width 20
commit

40 MHz (802.11n):

set interfaces wireless wlan0 channel-width 40
commit

80 MHz (802.11ac):

set interfaces wireless wlan0 channel-width 80
commit

160 MHz (802.11ac/ax):

set interfaces wireless wlan0 channel-width 160
commit

Transmit power

Reducing power (in dBm):

set interfaces wireless wlan0 reduce-transmit-power 5
commit

The value specifies how many dBm to reduce power from the maximum allowed by the regulatory domain.

Client isolation

Preventing direct communication between wireless clients:

set interfaces wireless wlan0 isolate-stations
commit

Useful for guest networks and public WiFi.

Maximum Stations

Limiting the number of simultaneous connections:

set interfaces wireless wlan0 max-stations 50
commit

MAC filtering

Allowed MAC addresses:

set interfaces wireless wlan0 security station-address 00:11:22:33:44:55
set interfaces wireless wlan0 security station-address aa:bb:cc:dd:ee:ff
commit

MAC filtering mode:

set interfaces wireless wlan0 security mac-mode allow
commit

Modes:

  • allow - allow only the listed MACs
  • deny - deny the listed MACs

Station mode (client)

Connecting to a WPA2 network

Basic client configuration:

set system wireless country-code ru
set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 ssid 'ExistingNetwork'
set interfaces wireless wlan0 security wpa passphrase 'NetworkPassword'
commit

Static IP address

set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address 192.168.1.100/24
set interfaces wireless wlan0 ssid 'Office-WiFi'
set interfaces wireless wlan0 security wpa passphrase 'SecurePass123'
commit

Multiple addresses

set interfaces wireless wlan0 address 192.168.1.100/24
set interfaces wireless wlan0 address 2001:db8::100/64
commit

WPA security

WPA2-Personal (PSK)

Recommended configuration:

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'StrongPassword123!'
commit

Parameters:

  • mode - WPA version (wpa, wpa2, wpa3, both)
  • cipher - encryption (CCMP, TKIP, CCMP+TKIP)
  • passphrase - password (8-63 characters)

WPA3-Personal (SAE)

The most secure option:

set interfaces wireless wlan0 security wpa mode wpa3
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'VeryStrongPassword123!'
commit

WPA3 provides:

  • Protection against offline dictionary attacks
  • Forward secrecy
  • Stronger encryption

WPA2/WPA3 Mixed Mode

Compatibility with older devices:

set interfaces wireless wlan0 security wpa mode both
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'SecurePassword123'
commit

Management Frame Protection

Protecting management frames (IEEE 802.11w):

set interfaces wireless wlan0 security wpa mgmt-frame-protection required
commit

Modes:

  • disabled - disabled
  • optional - optional (default for WPA2)
  • required - required (default for WPA3)

WPA2-Enterprise (802.1X)

Authentication via a RADIUS server:

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 port 1812
commit

Backup RADIUS server:

set interfaces wireless wlan0 security wpa radius server 192.168.1.11 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius server 192.168.1.11 port 1812
commit

RADIUS accounting:

set interfaces wireless wlan0 security wpa radius accounting-server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius accounting-server 192.168.1.10 port 1813
commit

VLAN support

VLAN sub-interfaces

Creating VLAN interfaces:

set interfaces wireless wlan0 vif 10 address 192.168.10.1/24
set interfaces wireless wlan0 vif 10 description 'Guest WiFi'

set interfaces wireless wlan0 vif 20 address 192.168.20.1/24
set interfaces wireless wlan0 vif 20 description 'Corporate WiFi'

commit

Dynamic VLAN (802.1X)

The RADIUS server assigns a VLAN based on the credentials:

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa dynamic-vlan
commit

RADIUS attributes for Dynamic VLAN:

  • Tunnel-Type = VLAN
  • Tunnel-Medium-Type = IEEE-802
  • Tunnel-Private-Group-Id = <VLAN-ID>

Multiple SSIDs

Creating several virtual wireless interfaces:

# Primary SSID
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Corporate'
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 channel 36
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa passphrase 'CorpPassword'

# Guest SSID (virtual interface)
set interfaces wireless wlan0-1 type access-point
set interfaces wireless wlan0-1 ssid 'Guest'
set interfaces wireless wlan0-1 address 192.168.20.1/24
set interfaces wireless wlan0-1 isolate-stations
set interfaces wireless wlan0-1 security wpa mode wpa2
set interfaces wireless wlan0-1 security wpa passphrase 'GuestPassword'

commit

Advanced parameters

Beacon interval

Interval for sending beacon frames (in milliseconds):

set interfaces wireless wlan0 beacon-interval 100
commit

Default: 100 ms. Range: 15-65535.

DTIM period

Delivery Traffic Indication Message:

set interfaces wireless wlan0 dtim-period 2
commit

Determines how often to send buffered multicast/broadcast traffic to sleeping clients.

RTS/CTS threshold

Request to Send / Clear to Send for collision avoidance:

set interfaces wireless wlan0 rts-threshold 2347
commit

Values:

  • 0 - disabled
  • 1-2347 - packet size in bytes at which RTS/CTS is triggered

Fragmentation threshold

Packet fragmentation threshold:

set interfaces wireless wlan0 fragmentation-threshold 2346
commit

Packets larger than the specified size will be fragmented.

Short preamble

Short preamble (802.11b/g only):

set interfaces wireless wlan0 short-preamble
commit

Can improve performance with devices that support it.

WMM (WiFi Multimedia)

QoS for wireless networks:

set interfaces wireless wlan0 wmm
commit

Prioritizes voice, video, best-effort, and background traffic.

Configuration examples

Home WiFi access point

set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.1.1/24
set interfaces wireless wlan0 ssid 'HomeNetwork'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 channel-width 40

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'MyHomePassword123'

commit

Corporate access point with RADIUS

set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 10.0.10.1/24
set interfaces wireless wlan0 ssid 'Corp-Enterprise'
set interfaces wireless wlan0 channel 36
set interfaces wireless wlan0 mode ac
set interfaces wireless wlan0 channel-width 80

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa radius server 10.0.0.100 key 'RadiusSharedSecret'
set interfaces wireless wlan0 security wpa radius server 10.0.0.101 key 'RadiusSharedSecret'
set interfaces wireless wlan0 security wpa mgmt-frame-protection required

commit

Guest WiFi with isolation

set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 172.16.100.1/24
set interfaces wireless wlan0 ssid 'Guest-WiFi'
set interfaces wireless wlan0 channel 11
set interfaces wireless wlan0 mode n

set interfaces wireless wlan0 isolate-stations
set interfaces wireless wlan0 max-stations 100

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'GuestAccess2024'

commit

Dual-band access point

2.4 GHz:

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 ssid 'MyNetwork-2.4G'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'Password123'
commit

5 GHz:

set interfaces wireless wlan1 type access-point
set interfaces wireless wlan1 address 192.168.11.1/24
set interfaces wireless wlan1 ssid 'MyNetwork-5G'
set interfaces wireless wlan1 channel 36
set interfaces wireless wlan1 mode ac
set interfaces wireless wlan1 channel-width 80
set interfaces wireless wlan1 security wpa mode wpa2
set interfaces wireless wlan1 security wpa cipher CCMP
set interfaces wireless wlan1 security wpa passphrase 'Password123'
commit

WiFi client with a backup route

set system wireless country-code ru

set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 ssid 'MainNetwork'
set interfaces wireless wlan0 security wpa passphrase 'MainPassword'
set interfaces wireless wlan0 dhcp-options default-route-distance 10

commit

Captive Portal integration

set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 10.99.0.1/24
set interfaces wireless wlan0 ssid 'Public-WiFi'
set interfaces wireless wlan0 channel 6

# Open network (no WPA)
# Authentication via web portal

set service dns forwarding listen-address 10.99.0.1

# Redirect to the captive portal
set nat destination rule 100 inbound-interface name wlan0
set nat destination rule 100 protocol tcp
set nat destination rule 100 destination port 80
set nat destination rule 100 translation address 10.99.0.1
set nat destination rule 100 translation port 8080

commit

WiFi bridge for network extension

# Connect to an existing WiFi
set interfaces wireless wlan0 type station
set interfaces wireless wlan0 ssid 'MainRouter'
set interfaces wireless wlan0 security wpa passphrase 'MainPassword'

# Create a bridge with Ethernet
set interfaces bridge br0 member interface wlan0
set interfaces bridge br0 member interface eth0
set interfaces bridge br0 address dhcp

commit

Operational commands

Viewing interface status

show interfaces wireless wlan0

Example output:

wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP
    link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.1/24 brd 192.168.10.255 scope global wlan0
    RX:  bytes  packets  errors  dropped  overrun  mcast
         1234567  12345   0       0        0        123
    TX:  bytes  packets  errors  dropped  carrier  collisions
         7654321  54321   0       0        0        0

Wireless interface information

show interfaces wireless wlan0 info

Shows:

  • SSID
  • Frequency/Channel
  • Mode (AP/Station)
  • Signal level (for Station mode)
  • Connected clients (for AP mode)

List of connected clients

show interfaces wireless wlan0 station

Example output:

Station            Signal   RX Rate   TX Rate   Connected
aa:bb:cc:dd:ee:ff  -45 dBm  866 Mbps  866 Mbps  00:15:23
11:22:33:44:55:66  -52 dBm  433 Mbps  433 Mbps  01:23:45

Scanning available networks

show interfaces wireless wlan0 scan

Shows:

  • SSID
  • BSSID
  • Channel
  • Signal level
  • Security (WPA/WPA2/Open)

Physical capabilities

show interfaces wireless wlan0 capabilities

Output:

  • Supported standards (802.11a/b/g/n/ac/ax)
  • Supported frequencies
  • Maximum power
  • HT/VHT capabilities

Statistics

show interfaces wireless wlan0 statistics

Traffic monitoring

monitor interfaces wireless wlan0 traffic

Clearing counters

clear interfaces wireless wlan0 counters

Troubleshooting

WiFi interface does not come up

Check the regulatory domain:

show system wireless country-code

Set it if missing:

set system wireless country-code ru
commit

Check the status:

show interfaces wireless wlan0

Check dmesg for driver errors:

show log | grep wlan0

Clients cannot connect

Check the SSID and channel:

show interfaces wireless wlan0 info

Check the security configuration:

show configuration interfaces wireless wlan0 security

Review the hostapd logs:

show log | grep hostapd

Make sure the channel is available in the regulatory domain:

show interfaces wireless wlan0 capabilities

Poor performance

Check the clients’ signal level:

show interfaces wireless wlan0 station

Try a different channel (check neighboring networks):

show interfaces wireless wlan0 scan

Reduce the channel width:

set interfaces wireless wlan0 channel-width 20
commit

Disable WMM if there are problems:

delete interfaces wireless wlan0 wmm
commit

Interference

Scan available networks:

show interfaces wireless wlan0 scan

Choose a less congested channel:

  • 2.4 GHz: use 1, 6, or 11
  • 5 GHz: pick channels away from neighboring networks

Reduce the transmit power:

set interfaces wireless wlan0 reduce-transmit-power 3
commit

WPA3 incompatibility

Use mixed mode:

set interfaces wireless wlan0 security wpa mode both
commit

Or switch to WPA2:

set interfaces wireless wlan0 security wpa mode wpa2
commit

RADIUS authentication does not work

Check RADIUS server reachability:

ping 192.168.1.10

Check the shared secret:

show configuration interfaces wireless wlan0 security wpa radius

Check the logs on the RADIUS server.

Test with radtest (if available):

radtest user password 192.168.1.10 0 RadiusSecret

Frequent client disconnects

Increase the beacon interval:

set interfaces wireless wlan0 beacon-interval 200
commit

Check for interference:

show interfaces wireless wlan0 scan

Disable power saving on the clients.

Integration with other services

DHCP server

set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 range 0 start 192.168.10.100
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 range 0 stop 192.168.10.200
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 option default-router 192.168.10.1
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 option name-server 8.8.8.8

set interfaces wireless wlan0 address 192.168.10.1/24

commit

DNS Forwarding

set service dns forwarding listen-address 192.168.10.1
set service dns forwarding allow-from 192.168.10.0/24

commit

NAT (Internet access)

set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.10.0/24
set nat source rule 100 translation address masquerade

commit

Firewall

Restricting Guest WiFi:

# Allow only Internet, block the local network
set firewall ipv4 name GUEST-OUT default-action drop
set firewall ipv4 name GUEST-OUT rule 10 action accept
set firewall ipv4 name GUEST-OUT rule 10 state established
set firewall ipv4 name GUEST-OUT rule 10 state related

set firewall ipv4 name GUEST-OUT rule 20 action accept
set firewall ipv4 name GUEST-OUT rule 20 destination address !192.168.0.0/16

set firewall interface wlan0 out name GUEST-OUT

commit

QoS for VoIP

set traffic-policy shaper WIFI-QOS bandwidth 100mbit
set traffic-policy shaper WIFI-QOS class 10 bandwidth 30%
set traffic-policy shaper WIFI-QOS class 10 priority 1
set traffic-policy shaper WIFI-QOS class 10 match VOIP ip dscp ef

set interfaces wireless wlan0 traffic-policy out WIFI-QOS

commit

VLAN for multiple SSIDs

# Corporate SSID - VLAN 10
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Corporate'
set interfaces wireless wlan0 vif 10 address 10.0.10.1/24

# Guest SSID - VLAN 20
set interfaces wireless wlan0-1 type access-point
set interfaces wireless wlan0-1 ssid 'Guest'
set interfaces wireless wlan0-1 vif 20 address 10.0.20.1/24

commit

Monitoring and diagnostics

Continuous monitoring

monitor interfaces wireless wlan0 traffic

Capturing WiFi traffic

monitor traffic interface wlan0

With a filter:

monitor traffic interface wlan0 filter 'port 80 or port 443'

Collecting statistics

Script for monitoring clients:

#!/bin/bash
while true; do
  clear
  echo "WiFi Clients - $(date)"
  echo "================================"
  /opt/vyatta/bin/vyatta-op-cmd-wrapper show interfaces wireless wlan0 station
  sleep 5
done

Security

Recommendations

  1. Use WPA3 if all clients support it
  2. WPA2-Enterprise for corporate networks
  3. Isolate Guest WiFi from the main network
  4. Disable WPS (not supported in VyOS)
  5. Hide the SSID for additional security
  6. MAC filtering as an extra layer
  7. Change passwords regularly
  8. Enable Management Frame Protection
  9. Limit the maximum number of clients
  10. Monitor connected devices

Guest network isolation

# Guest WiFi
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Guest'
set interfaces wireless wlan0 address 172.16.99.1/24
set interfaces wireless wlan0 isolate-stations

# Firewall - Internet only
set firewall ipv4 name GUEST-TO-LAN default-action drop
set firewall zone guest from local firewall name GUEST-TO-LAN
set firewall zone guest interface wlan0

# NAT for Internet
set nat source rule 200 outbound-interface name eth0
set nat source rule 200 source address 172.16.99.0/24
set nat source rule 200 translation address masquerade

commit

Performance

Optimization for high load

set interfaces wireless wlan0 wmm
set interfaces wireless wlan0 max-stations 100
set interfaces wireless wlan0 beacon-interval 100
set interfaces wireless wlan0 dtim-period 1

# For 802.11ac/ax
set interfaces wireless wlan0 mode ac
set interfaces wireless wlan0 channel-width 80

commit

Performance monitoring

show interfaces wireless wlan0 statistics
show interfaces wireless wlan0 station

Best practices

  1. Channel planning

    • Use 1, 6, 11 for 2.4 GHz
    • Avoid overlap with neighboring networks
    • 5 GHz is preferable for high performance

  2. Security

    • WPA2 minimum, WPA3 preferred
    • Enterprise (RADIUS) for business
    • Guest network isolation

  3. Performance

    • 5 GHz for high speed
    • 80/160 MHz channels for 802.11ac/ax
    • WMM for QoS
    • Limiting the number of clients

  4. Reliability

    • Backup RADIUS servers
    • Monitoring connected clients
    • Event logging

  5. Documentation

    • Description of all SSIDs
    • Coverage map
    • List of MAC addresses (if filtering is used)

  6. Regulatory compliance

    • Correct country code
    • Compliance with transmit power limits
    • DFS for 5 GHz channels

Limitations

  • Performance depends on the WiFi adapter
  • Not all adapters support AP mode
  • WPA3 requires modern hardware
  • DFS channels may switch when radar is detected
  • The number of simultaneous SSIDs is limited by the hardware
  • Monitor mode may not be supported by all adapters

Hardware compatibility check

List of supported adapters:

show interfaces wireless

Checking capabilities:

show interfaces wireless wlan0 capabilities

Linux drivers with good AP mode support:

  • ath9k (Atheros)
  • ath10k (Atheros)
  • iwlwifi (Intel)
  • rt2800 (Ralink)
  • rtl8xxxu (Realtek)

Next steps

  • Firewall - protecting the wireless network
  • DHCP Server - automatic client configuration
  • NAT - providing Internet access
  • QoS - traffic prioritization
  • VPN - secure remote access
Reviewed by OpenNix LLC · Last updated on
Dummy Interfaces in VyOSVirtual Ethernet (veth) Interfaces in VyOS