Documentation
VyOS Documentation
VyOS System Configuration
Option - System Options

Option - System Options

VyOS system options let you configure system behavior, optimize performance, manage HTTP/SSH clients, and change various system-wide parameters to adapt the router to specific requirements.

Overview

System option categories

Performance Options:

  • Throughput optimization for high bandwidth
  • Latency optimization for low delays
  • Kernel tweaks for specific workloads

Network Client Options:

  • HTTP client source address and interface
  • SSH client source address and interface
  • Outgoing connection control

Hardware Options:

  • Keyboard layout for the console
  • Startup beep enable/disable
  • Root partition auto-resize

System Behavior:

  • CTRL-ALT-DELETE behavior (ignore/reboot/poweroff)
  • Reboot on kernel panic
  • Reboot on upgrade failure

Kernel Options:

  • CPU mitigations disable
  • Power saving disable
  • AMD P-State driver mode
  • Quiet boot mode

Use in cloud environments

Yandex Cloud:

  • Performance tuning for compute-optimized instances
  • HTTP client source for the metadata service
  • Auto-resize for disk expansion

VK Cloud:

  • Latency optimization for high-performance workloads
  • SSH client source for management networks
  • Kernel optimizations for specific instance types

Change requirements

Most options require:

  • Configuration commit
  • System reboot for kernel and performance options
  • Verification after applying

Performance Options

Performance Profiles

VyOS provides two performance profiles for optimizing the network stack:

Throughput Profile:

# Optimization for maximum bandwidth
set system option performance throughput

commit

Purpose:

  • Maximize network throughput
  • Optimal buffer sizes for bulk data transfer
  • Suitable for file servers, backup, content delivery

Adjusted parameters:

  • Increased TCP/UDP buffers
  • Aggressive TCP window scaling
  • Optimized interrupt coalescing

Latency Profile:

# Optimization for minimal delays
set system option performance latency

commit

Purpose:

  • Minimize network latency
  • Fast packet processing
  • Suitable for VoIP, gaming, real-time applications

Adjusted parameters:

  • Reduced buffer sizes
  • Faster interrupt processing
  • Lower latency network stack tuning

Applying Performance Profiles

A reboot is required after applying:

set system option performance throughput
commit
save

# Reboot system
reboot now

Checking the active profile

# Check the current configuration
show configuration system option performance

# System network parameters
show system kernel-parameters | grep net

Default Performance Mode

If no performance profile is set:

  • Balanced mode is used
  • Default Linux kernel network stack settings
  • Suitable for general purpose workloads

HTTP Client Configuration

HTTP Client Source Address

Configure the source address for outgoing HTTP connections:

# Use a specific IP for HTTP requests
set system option http-client source-address 10.0.1.1

commit

Use:

  • Control the source IP for HTTP traffic
  • Routing specific to management connections
  • Compliance with firewall rules

HTTP Client Source Interface

Configure the source interface for outgoing HTTP connections:

# Use a specific interface for HTTP requests
set system option http-client source-interface eth0

commit

Use:

  • Force HTTP through a specific interface
  • Management traffic isolation
  • Multi-homed routing control

Combined configuration

# Source interface and address
set system option http-client source-interface eth1
set system option http-client source-address 192.168.1.1

commit

Use Cases for HTTP Client Options

Yandex Cloud Metadata Service:

# Ensure HTTP metadata requests use the correct interface
set system option http-client source-interface eth0
set system option http-client source-address 10.0.0.10

commit

VK Cloud Management Network:

# Isolate management HTTP traffic
set system option http-client source-interface eth2
set system option http-client source-address 172.16.1.1

commit

Multi-WAN with an HTTP source:

# Force HTTP updates through a specific WAN
set system option http-client source-interface eth1
set system option http-client source-address 203.0.113.1

commit

SSH Client Configuration

SSH Client Source Address

Configure the source address for outgoing SSH connections:

# Use a specific IP for SSH connections
set system option ssh-client source-address 10.0.1.1

commit

Use:

  • Control the source IP for SSH traffic
  • Firewall rules on remote servers
  • Audit and logging

SSH Client Source Interface

Configure the source interface for outgoing SSH connections:

# Use a specific interface for SSH
set system option ssh-client source-interface eth1

commit

Use:

  • Force SSH through the management interface
  • Network isolation
  • Multi-homed routing

Example: SSH over the Management Network

# SSH only through the management interface
set system option ssh-client source-interface eth2
set system option ssh-client source-address 192.168.100.1

commit

# Verification
ssh admin@remote-server
# The connection will originate from 192.168.100.1

Keyboard Layout

Changing the keyboard layout

The keyboard layout affects only the system console (not SSH):

# Available layouts: us, fr, de, fi, no, dk
set system option keyboard-layout us

commit

Supported Layouts:

  • us - US English (default)
  • fr - French
  • de - German
  • fi - Finnish
  • no - Norwegian
  • dk - Danish

Applying

A change requires a reboot:

set system option keyboard-layout de
commit
save

reboot now

Checking the current layout

# Configuration
show configuration system option keyboard-layout

# Console keyboard settings
localectl status

Notes

  • The keyboard layout affects only the physical console
  • SSH sessions use the client keyboard layout
  • The serial console also uses the configured layout

Startup Beep

Enable/Disable System Beep

Control the audible signal during system boot:

Disable Beep (recommended for datacenters):

# Disable the startup beep
set system option startup-beep

commit
save

Enable Beep (default behavior):

# Enable the startup beep (remove the option)
delete system option startup-beep

commit
save

Applying

  • A change requires a reboot
  • Useful in datacenters for noise reduction
  • A diagnostic tool for troubleshooting boot

Verification

# Current configuration
show configuration system option startup-beep

# After reboot, the system beeps or not

CTRL-ALT-DELETE Behavior

Configuring CTRL-ALT-DELETE behavior

Control+Alt+Delete on the console keyboard can be configured:

Ignore (recommended for production):

# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

commit
save

Reboot:

# Reboot on CTRL-ALT-DELETE
set system option ctrl-alt-delete reboot

commit
save

Poweroff:

# Poweroff on CTRL-ALT-DELETE
set system option ctrl-alt-delete poweroff

commit
save

Default (no configuration):

# Use the system default (usually ignore)
delete system option ctrl-alt-delete

commit

Security

Production Environment:

# Always ignore to prevent accidental reboots
set system option ctrl-alt-delete ignore

commit

Development/Lab:

# Reboot for convenience
set system option ctrl-alt-delete reboot

commit

Verification

# Current configuration
show configuration system option ctrl-alt-delete

# Systemd configuration
systemctl status ctrl-alt-del.target

Reboot on Panic

Automatic Reboot on Kernel Panic

Configure an automatic reboot on kernel panic:

Enable Reboot on Panic:

# Automatic reboot on kernel panic
set system option reboot-on-panic

commit
save

Disable (default):

# Do not reboot on panic (for debugging)
delete system option reboot-on-panic

commit

Applying

Production Servers:

# Enable for automatic recovery
set system option reboot-on-panic

commit

Development/Debugging:

# Disable to analyze the panic
delete system option reboot-on-panic

commit

Kernel Panic Timeout

The timeout is configured via sysctl:

# Set panic timeout (seconds before reboot)
set system sysctl parameter kernel.panic value 10

commit

Verification

# VyOS configuration
show configuration system option reboot-on-panic

# Kernel parameter
cat /proc/sys/kernel/panic

Reboot on Upgrade Failure

Automatic Reboot on Failed Upgrade

Rollback and reboot on a failed system upgrade:

Enable with Timeout:

# Reboot after 5 minutes if the upgrade failed
set system option reboot-on-upgrade-failure 300

commit
save

Disable (default):

delete system option reboot-on-upgrade-failure

commit

Timeout Values

# 5 minutes (300 seconds)
set system option reboot-on-upgrade-failure 300

# 10 minutes
set system option reboot-on-upgrade-failure 600

# 1 minute (minimum for testing)
set system option reboot-on-upgrade-failure 60

commit

Use Case

Remote Upgrades:

# Safety net for remote upgrades
set system option reboot-on-upgrade-failure 600

# Add system image
add system image https://example.com/vyos.iso

# The system reboots automatically if the upgrade fails

Root Partition Auto-Resize

Automatic Root Filesystem Expansion

Automatically expand the root partition on boot:

Enable Auto-Resize:

# Expand the root filesystem on first boot
set system option root-partition-auto-resize

commit
save

Disable:

delete system option root-partition-auto-resize

commit

Use in Cloud

Yandex Cloud:

# When increasing the disk size in the console
set system option root-partition-auto-resize

commit
save

# Reboot to apply
reboot now

VK Cloud:

# After resizing the instance disk
set system option root-partition-auto-resize

commit
reboot now

Verifying the expansion

# Disk space before
df -h /

# After reboot with auto-resize
df -h /
# The filesystem should use the entire available disk

Manual Resize (alternative)

# Growpart for partition expansion
sudo growpart /dev/vda 1

# Resize filesystem
sudo resize2fs /dev/vda1

# Verification
df -h /

Kernel Options

Disable CPU Mitigations

Disable CPU mitigations for performance (Spectre, Meltdown):

Disable Mitigations:

# Disable CPU vulnerability mitigations
set system option kernel disable-mitigations

commit
save
reboot now

Warning: Disabling mitigations reduces security in exchange for higher performance. Use only in trusted environments.

Disable Power Saving

Disable CPU power saving for maximum performance:

Disable Power Saving:

# Maximum performance without power saving
set system option kernel disable-power-saving

commit
save
reboot now

Use:

  • High-performance compute workloads
  • Low latency applications
  • When power consumption is not critical

AMD P-State Driver

Configure the AMD P-State driver mode (for AMD CPUs):

Available Modes:

# Passive mode (default)
set system option kernel amd-pstate-driver passive

# Active mode (more aggressive power management)
set system option kernel amd-pstate-driver active

# Guided mode (balance)
set system option kernel amd-pstate-driver guided

commit
save
reboot now

Passive Mode:

  • Default mode
  • Legacy frequency scaling
  • Better compatibility

Active Mode:

  • Hardware-controlled frequency
  • Better power efficiency
  • Newer AMD CPUs

Guided Mode:

  • Hybrid approach
  • Balance performance/power

Quiet Boot

Hide kernel boot messages:

Enable Quiet Boot:

# Minimal boot messages
set system option kernel quiet

commit
save
reboot now

Disable (verbose boot):

delete system option kernel quiet

commit
reboot now

Checking Kernel Options

# Boot parameters
cat /proc/cmdline

# CPU frequency governor
cat /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

# CPU mitigations
cat /sys/devices/system/cpu/vulnerabilities/*

Configuration Examples

Example 1: Yandex Cloud - Performance Tuning

Scenario: A high-throughput compute instance in Yandex Cloud.

configure

# Throughput optimization
set system option performance throughput

# HTTP client for the metadata service
set system option http-client source-interface eth0

# Auto-resize for disk expansion
set system option root-partition-auto-resize

# Reboot on panic for availability
set system option reboot-on-panic

# Disable unnecessary beep
set system option startup-beep

# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

# Kernel optimizations
set system option kernel disable-power-saving

commit
save

# Reboot to apply kernel options
reboot now

Result:

  • Maximum network throughput
  • Automatic disk resize
  • High availability through reboot on panic
  • Optimized performance

Example 2: VK Cloud - Low Latency VoIP Router

Scenario: A VoIP router in VK Cloud that requires minimal delays.

configure

# Latency optimization
set system option performance latency

# SSH over the management network
set system option ssh-client source-interface eth1
set system option ssh-client source-address 172.16.1.10

# HTTP over management
set system option http-client source-interface eth1
set system option http-client source-address 172.16.1.10

# Reboot on panic
set system option reboot-on-panic

# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

# Disable startup beep
set system option startup-beep

# Kernel options for low latency
set system option kernel disable-power-saving

commit
save
reboot now

Result:

  • Minimal network latency for VoIP
  • Isolated management traffic
  • Consistent performance

Example 3: Enterprise Datacenter - Security-Focused

Scenario: An enterprise router with a focus on security.

configure

# Balanced performance (no specific profile)
# Use the default

# HTTP client control
set system option http-client source-interface eth2
set system option http-client source-address 192.168.100.1

# SSH client control
set system option ssh-client source-interface eth2
set system option ssh-client source-address 192.168.100.1

# Security settings
set system option ctrl-alt-delete ignore

# Reboot on panic disabled for forensics
delete system option reboot-on-panic

# Disable beep
set system option startup-beep

# Keep CPU mitigations enabled (default)
# Do not use disable-mitigations for security
set system option kernel quiet

commit
save
reboot now

Result:

  • Controlled management traffic
  • Security mitigations enabled
  • Production-ready configuration

Example 4: Development Lab - Convenience

Scenario: A development/testing environment.

configure

# Throughput for testing
set system option performance throughput

# CTRL-ALT-DELETE reboot for convenience
set system option ctrl-alt-delete reboot

# Reboot on panic
set system option reboot-on-panic

# Verbose boot for debugging
delete system option kernel quiet

# German keyboard for the local console
set system option keyboard-layout de

commit
save
reboot now

Result:

  • Convenience for developers
  • Easy troubleshooting
  • Fast recovery

Monitoring and Diagnostics

Checking system options

# All system options
show configuration system option

# Specific option
show configuration system option performance
show configuration system option http-client
show configuration system option ssh-client

Performance Metrics

Network Throughput:

# Interface statistics
show interfaces ethernet eth0

# Detailed stats
show interfaces ethernet eth0 statistics

# Monitor traffic
monitor interface eth0

Latency Testing:

# Ping test
ping 8.8.8.8

# MTR for latency analysis
mtr 8.8.8.8

# Traffic capture
monitor traffic interface eth0

HTTP Client Verification

# Test HTTP source
curl -v http://example.com

# Check connection source
tcpdump -i eth1 -n port 80

# Verify routing
show ip route

SSH Client Verification

# SSH with verbose
ssh -v user@remote-host

# Check SSH source
# On the remote host:
tail -f /var/log/auth.log
# Should show the source address

Kernel Parameters

# Boot command line
cat /proc/cmdline

# CPU frequency
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

# Performance stats
cat /proc/stat

# Memory usage
free -h

# System load
uptime

Performance Testing

Throughput Test:

# iperf3 server on the remote host
iperf3 -s

# iperf3 client on VyOS
iperf3 -c remote-server -t 60
# Should show high throughput with the throughput profile

Latency Test:

# hping3 for latency
sudo hping3 -1 remote-server --fast

# sockperf for network latency
sockperf ping-pong -i remote-server -p 5001

Troubleshooting

Performance profile does not work

Problem: The performance profile does not improve performance.

Causes:

  1. The system was not rebooted after the changes
  2. Hardware limitations
  3. A bottleneck elsewhere (CPU, disk)

Solution:

# Check the configuration
show configuration system option performance

# Check kernel parameters
cat /proc/cmdline | grep performance

# If absent - a reboot is required
reboot now

# After reboot, verify
cat /proc/sys/net/core/rmem_max
cat /proc/sys/net/core/wmem_max

HTTP Client Source does not work

Problem: HTTP requests do not use the configured source.

Causes:

  1. The source interface is down
  2. No route through the source interface
  3. The source address is not on the source interface

Diagnostics:

# Check interface status
show interfaces

# Check routing table
show ip route

# Check source address
ip addr show eth1

# Test connectivity
ping -I eth1 8.8.8.8

Solution:

# Verify the source interface is up
show interfaces ethernet eth1

# Verify the source address exists
show interfaces ethernet eth1 address

# Fix if needed
set interfaces ethernet eth1 address 10.0.1.1/24

# Verify routing
set protocols static route 0.0.0.0/0 next-hop 10.0.1.254 interface eth1

commit

Keyboard Layout did not change

Problem: The keyboard layout stayed the same after configuration.

Causes:

  1. The system was not rebooted
  2. The option was set incorrectly
  3. Console vs SSH confusion

Solution:

# Verify configuration
show configuration system option keyboard-layout

# Reboot system
reboot now

# After reboot, test on the console (not SSH)
# SSH uses the client keyboard layout

CTRL-ALT-DELETE is not ignored

Problem: CTRL-ALT-DELETE triggers a reboot despite ignore.

Causes:

  1. The configuration is not saved
  2. Systemd is not updated
  3. Testing over SSH (does not work, console only)

Solution:

# Set ignore
set system option ctrl-alt-delete ignore
commit
save

# Verify systemd
systemctl status ctrl-alt-del.target

# Test only on the physical console

Reboot on Panic does not trigger

Problem: The system does not reboot on kernel panic.

Causes:

  1. The panic timeout is not set
  2. Hardware hang
  3. The panic is too severe for a reboot

Solution:

# Enable reboot on panic
set system option reboot-on-panic
commit

# Set panic timeout
set system sysctl parameter kernel.panic value 10
commit
save

# Test trigger panic (ONLY IN TEST ENVIRONMENT)
# echo c > /proc/sysrq-trigger

Root Partition did not expand

Problem: The root partition did not expand after a disk resize.

Causes:

  1. The system was not rebooted
  2. The partition table is not updated
  3. The filesystem is already at maximum size

Diagnostics:

# Check disk size
lsblk

# Check filesystem size
df -h /

# Check partition table
sudo fdisk -l /dev/vda

Solution:

# Enable auto-resize
set system option root-partition-auto-resize
commit
save

# Reboot
reboot now

# Manual resize if auto-resize failed
sudo growpart /dev/vda 1
sudo resize2fs /dev/vda1

# Verify
df -h /

Kernel Options did not apply

Problem: Kernel options (disable-mitigations, disable-power-saving) are not active.

Causes:

  1. The system was not rebooted
  2. The hardware does not support the option
  3. Conflicting kernel parameters

Diagnostics:

# Check boot parameters
cat /proc/cmdline

# Should see mitigations=off if configured
# Should see processor.max_cstate=0 for disable-power-saving

Solution:

# Verify configuration
show configuration system option kernel

# A reboot is required for kernel options
reboot now

# After reboot, verify
cat /proc/cmdline

# Check the CPU governor
cat /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Security

Performance vs Security Trade-offs

Disable CPU Mitigations:

# Increases performance BUT reduces security
set system option kernel disable-mitigations

Risks:

  • Vulnerable to Spectre, Meltdown attacks
  • Side-channel vulnerabilities
  • Use only in trusted networks

Recommendation:

# Production - keep mitigations enabled (default)
delete system option kernel disable-mitigations

# Trusted lab - can disable for performance
set system option kernel disable-mitigations

CTRL-ALT-DELETE Security

Production:

# Always ignore to prevent accidental reboots
set system option ctrl-alt-delete ignore

Physical Security:

  • Console access must be physically protected
  • Ignoring CTRL-ALT-DELETE does not replace physical security
  • Monitor console access

Source Address Security

Whitelisting:

# Control the source for HTTP/SSH
set system option http-client source-address 10.0.1.1
set system option ssh-client source-address 10.0.1.1

# Remote firewalls can whitelist these IPs

Audit:

# Log outgoing connections
set system syslog host 192.168.1.100 facility local0 level info

# Monitor source addresses
tcpdump -i any -n | grep "10.0.1.1"

Integration with Cloud Platforms

Yandex Cloud Metadata Service

HTTP Client for Metadata:

# Ensure metadata requests use the correct interface
set system option http-client source-interface eth0

# Metadata service IP: 169.254.169.254
# Must be reachable through eth0

commit

Testing:

# Test metadata access
curl http://169.254.169.254/latest/meta-data/

# Should return metadata

VK Cloud Instance Metadata

Similar Configuration:

# HTTP client through the primary interface
set system option http-client source-interface eth0

# VK Cloud metadata service
curl http://169.254.169.254/openstack/latest/meta_data.json

commit

Cloud Disk Auto-Resize

Yandex Cloud:

# When increasing the disk in the console
set system option root-partition-auto-resize
commit
save
reboot now

# After reboot, the filesystem is expanded

VK Cloud:

# Similar process
set system option root-partition-auto-resize
commit
save
reboot now

Best Practices

  1. Performance Tuning:

    • Use the throughput profile for file servers, backup
    • Use the latency profile for VoIP, gaming, real-time apps
    • Test before/after to measure the improvement
    • Reboot after changing the performance profile

  2. HTTP/SSH Client Source:

    • Configure the source for predictable routing
    • Whitelist source addresses on remote firewalls
    • Document source configurations for troubleshooting
    • Test connectivity after changes

  3. Keyboard Layout:

    • Configure it if you use a non-US keyboard on the console
    • Remember: console only, not SSH
    • A reboot is required after the change

  4. Startup Beep:

    • Disable in datacenters for noise reduction
    • Keep enabled in small deployments for diagnostics
    • Personal preference

  5. CTRL-ALT-DELETE:

    • Always ignore in production
    • Physical console security is critical
    • Document the behavior for the operations team

  6. Reboot on Panic:

    • Enable in production for automatic recovery
    • Disable in development for debugging
    • Set a reasonable panic timeout (10-60 seconds)
    • Monitor panic events

  7. Root Auto-Resize:

    • Enable for cloud instances with dynamic disks
    • Test the resize procedure before production
    • Monitor filesystem space after the resize

  8. Kernel Options:

    • Disable mitigations only in trusted environments
    • Disable power-saving for consistent performance
    • AMD P-State for newer AMD CPUs
    • Always test after kernel changes

  9. Change Management:

    • Test system options in a lab environment
    • Document all changes
    • Plan reboot windows
    • Back up the configuration before changes
    • Verify after reboot

  10. Monitoring:

    • Monitor performance metrics after tuning
    • Track source address usage
    • Log kernel panics
    • Alert on unexpected reboots

Conclusion

VyOS system options provide flexible tools for configuring system behavior and optimizing performance. Key capabilities:

  • Performance profiles - throughput and latency optimization for specific workloads
  • HTTP/SSH client source - control of outgoing connections for security and routing
  • Keyboard layout - support for various layouts for console access
  • System behavior - configuration of startup beep, CTRL-ALT-DELETE, reboot on panic
  • Kernel options - advanced tuning for performance and power management
  • Cloud integration - auto-resize and metadata service support

Proper configuration of system options lets you:

  • Optimize performance for specific use cases
  • Improve security through source address control
  • Increase availability through automatic reboot on panic
  • Simplify cloud deployment through auto-resize

Use system options to adapt VyOS to your specific requirements:

  • High-throughput workloads → throughput profile
  • Low-latency applications → latency profile
  • Cloud environments → auto-resize and metadata configuration
  • Enterprise security → source address control and mitigations enabled

Always test changes in a non-production environment and plan reboot windows, since most options require a system restart to apply.

Reviewed by OpenNix LLC · Last updated on
Name Server - System DNS ServersProxy - System HTTP/HTTPS Proxy