# Option - System Options

> Configure system options, performance, HTTP/SSH client, keyboard, startup beep, and system behavior in VyOS for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/system/vyos-option/



VyOS system options let you configure system behavior, optimize performance, manage HTTP/SSH clients, and change various system-wide parameters to adapt the router to specific requirements.

## Overview

### System option categories

**Performance Options**:
- Throughput optimization for high bandwidth
- Latency optimization for low delays
- Kernel tweaks for specific workloads

**Network Client Options**:
- HTTP client source address and interface
- SSH client source address and interface
- Outgoing connection control

**Hardware Options**:
- Keyboard layout for the console
- Startup beep enable/disable
- Root partition auto-resize

**System Behavior**:
- CTRL-ALT-DELETE behavior (ignore/reboot/poweroff)
- Reboot on kernel panic
- Reboot on upgrade failure

**Kernel Options**:
- CPU mitigations disable
- Power saving disable
- AMD P-State driver mode
- Quiet boot mode

### Use in cloud environments

**Yandex Cloud**:
- Performance tuning for compute-optimized instances
- HTTP client source for the metadata service
- Auto-resize for disk expansion

**VK Cloud**:
- Latency optimization for high-performance workloads
- SSH client source for management networks
- Kernel optimizations for specific instance types

### Change requirements

Most options require:
- Configuration commit
- System reboot for kernel and performance options
- Verification after applying

## Performance Options

### Performance Profiles

VyOS provides two performance profiles for optimizing the network stack:

**Throughput Profile**:
```bash
# Optimization for maximum bandwidth
set system option performance throughput

commit
```

**Purpose**:
- Maximize network throughput
- Optimal buffer sizes for bulk data transfer
- Suitable for file servers, backup, content delivery

**Adjusted parameters**:
- Increased TCP/UDP buffers
- Aggressive TCP window scaling
- Optimized interrupt coalescing

**Latency Profile**:
```bash
# Optimization for minimal delays
set system option performance latency

commit
```

**Purpose**:
- Minimize network latency
- Fast packet processing
- Suitable for VoIP, gaming, real-time applications

**Adjusted parameters**:
- Reduced buffer sizes
- Faster interrupt processing
- Lower latency network stack tuning

### Applying Performance Profiles

**A reboot is required after applying**:
```bash
set system option performance throughput
commit
save

# Reboot system
reboot now
```

### Checking the active profile

```bash
# Check the current configuration
show configuration system option performance

# System network parameters
show system kernel-parameters | grep net
```

### Default Performance Mode

If no performance profile is set:
- Balanced mode is used
- Default Linux kernel network stack settings
- Suitable for general purpose workloads

## HTTP Client Configuration

### HTTP Client Source Address

Configure the source address for outgoing HTTP connections:

```bash
# Use a specific IP for HTTP requests
set system option http-client source-address 10.0.1.1

commit
```

**Use**:
- Control the source IP for HTTP traffic
- Routing specific to management connections
- Compliance with firewall rules

### HTTP Client Source Interface

Configure the source interface for outgoing HTTP connections:

```bash
# Use a specific interface for HTTP requests
set system option http-client source-interface eth0

commit
```

**Use**:
- Force HTTP through a specific interface
- Management traffic isolation
- Multi-homed routing control

### Combined configuration

```bash
# Source interface and address
set system option http-client source-interface eth1
set system option http-client source-address 192.168.1.1

commit
```

### Use Cases for HTTP Client Options

**Yandex Cloud Metadata Service**:
```bash
# Ensure HTTP metadata requests use the correct interface
set system option http-client source-interface eth0
set system option http-client source-address 10.0.0.10

commit
```

**VK Cloud Management Network**:
```bash
# Isolate management HTTP traffic
set system option http-client source-interface eth2
set system option http-client source-address 172.16.1.1

commit
```

**Multi-WAN with an HTTP source**:
```bash
# Force HTTP updates through a specific WAN
set system option http-client source-interface eth1
set system option http-client source-address 203.0.113.1

commit
```

## SSH Client Configuration

### SSH Client Source Address

Configure the source address for outgoing SSH connections:

```bash
# Use a specific IP for SSH connections
set system option ssh-client source-address 10.0.1.1

commit
```

**Use**:
- Control the source IP for SSH traffic
- Firewall rules on remote servers
- Audit and logging

### SSH Client Source Interface

Configure the source interface for outgoing SSH connections:

```bash
# Use a specific interface for SSH
set system option ssh-client source-interface eth1

commit
```

**Use**:
- Force SSH through the management interface
- Network isolation
- Multi-homed routing

### Example: SSH over the Management Network

```bash
# SSH only through the management interface
set system option ssh-client source-interface eth2
set system option ssh-client source-address 192.168.100.1

commit

# Verification
ssh admin@remote-server
# The connection will originate from 192.168.100.1
```

## Keyboard Layout

### Changing the keyboard layout

The keyboard layout affects only the system console (not SSH):

```bash
# Available layouts: us, fr, de, fi, no, dk
set system option keyboard-layout us

commit
```

**Supported Layouts**:
- `us` - US English (default)
- `fr` - French
- `de` - German
- `fi` - Finnish
- `no` - Norwegian
- `dk` - Danish

### Applying

**A change requires a reboot**:
```bash
set system option keyboard-layout de
commit
save

reboot now
```

### Checking the current layout

```bash
# Configuration
show configuration system option keyboard-layout

# Console keyboard settings
localectl status
```

### Notes

- The keyboard layout affects only the physical console
- SSH sessions use the client keyboard layout
- The serial console also uses the configured layout

## Startup Beep

### Enable/Disable System Beep

Control the audible signal during system boot:

**Disable Beep** (recommended for datacenters):
```bash
# Disable the startup beep
set system option startup-beep

commit
save
```

**Enable Beep** (default behavior):
```bash
# Enable the startup beep (remove the option)
delete system option startup-beep

commit
save
```

### Applying

- A change requires a reboot
- Useful in datacenters for noise reduction
- A diagnostic tool for troubleshooting boot

### Verification

```bash
# Current configuration
show configuration system option startup-beep

# After reboot, the system beeps or not
```

## CTRL-ALT-DELETE Behavior

### Configuring CTRL-ALT-DELETE behavior

Control+Alt+Delete on the console keyboard can be configured:

**Ignore** (recommended for production):
```bash
# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

commit
save
```

**Reboot**:
```bash
# Reboot on CTRL-ALT-DELETE
set system option ctrl-alt-delete reboot

commit
save
```

**Poweroff**:
```bash
# Poweroff on CTRL-ALT-DELETE
set system option ctrl-alt-delete poweroff

commit
save
```

**Default** (no configuration):
```bash
# Use the system default (usually ignore)
delete system option ctrl-alt-delete

commit
```

### Security

**Production Environment**:
```bash
# Always ignore to prevent accidental reboots
set system option ctrl-alt-delete ignore

commit
```

**Development/Lab**:
```bash
# Reboot for convenience
set system option ctrl-alt-delete reboot

commit
```

### Verification

```bash
# Current configuration
show configuration system option ctrl-alt-delete

# Systemd configuration
systemctl status ctrl-alt-del.target
```

## Reboot on Panic

### Automatic Reboot on Kernel Panic

Configure an automatic reboot on kernel panic:

**Enable Reboot on Panic**:
```bash
# Automatic reboot on kernel panic
set system option reboot-on-panic

commit
save
```

**Disable** (default):
```bash
# Do not reboot on panic (for debugging)
delete system option reboot-on-panic

commit
```

### Applying

**Production Servers**:
```bash
# Enable for automatic recovery
set system option reboot-on-panic

commit
```

**Development/Debugging**:
```bash
# Disable to analyze the panic
delete system option reboot-on-panic

commit
```

### Kernel Panic Timeout

The timeout is configured via sysctl:
```bash
# Set panic timeout (seconds before reboot)
set system sysctl parameter kernel.panic value 10

commit
```

### Verification

```bash
# VyOS configuration
show configuration system option reboot-on-panic

# Kernel parameter
cat /proc/sys/kernel/panic
```

## Reboot on Upgrade Failure

### Automatic Reboot on Failed Upgrade

Rollback and reboot on a failed system upgrade:

**Enable with Timeout**:
```bash
# Reboot after 5 minutes if the upgrade failed
set system option reboot-on-upgrade-failure 300

commit
save
```

**Disable** (default):
```bash
delete system option reboot-on-upgrade-failure

commit
```

### Timeout Values

```bash
# 5 minutes (300 seconds)
set system option reboot-on-upgrade-failure 300

# 10 minutes
set system option reboot-on-upgrade-failure 600

# 1 minute (minimum for testing)
set system option reboot-on-upgrade-failure 60

commit
```

### Use Case

**Remote Upgrades**:
```bash
# Safety net for remote upgrades
set system option reboot-on-upgrade-failure 600

# Add system image
add system image https://example.com/vyos.iso

# The system reboots automatically if the upgrade fails
```

## Root Partition Auto-Resize

### Automatic Root Filesystem Expansion

Automatically expand the root partition on boot:

**Enable Auto-Resize**:
```bash
# Expand the root filesystem on first boot
set system option root-partition-auto-resize

commit
save
```

**Disable**:
```bash
delete system option root-partition-auto-resize

commit
```

### Use in Cloud

**Yandex Cloud**:
```bash
# When increasing the disk size in the console
set system option root-partition-auto-resize

commit
save

# Reboot to apply
reboot now
```

**VK Cloud**:
```bash
# After resizing the instance disk
set system option root-partition-auto-resize

commit
reboot now
```

### Verifying the expansion

```bash
# Disk space before
df -h /

# After reboot with auto-resize
df -h /
# The filesystem should use the entire available disk
```

### Manual Resize (alternative)

```bash
# Growpart for partition expansion
sudo growpart /dev/vda 1

# Resize filesystem
sudo resize2fs /dev/vda1

# Verification
df -h /
```

## Kernel Options

### Disable CPU Mitigations

Disable CPU mitigations for performance (Spectre, Meltdown):

**Disable Mitigations**:
```bash
# Disable CPU vulnerability mitigations
set system option kernel disable-mitigations

commit
save
reboot now
```

**Warning**: Disabling mitigations reduces security in exchange for higher performance. Use only in trusted environments.

### Disable Power Saving

Disable CPU power saving for maximum performance:

**Disable Power Saving**:
```bash
# Maximum performance without power saving
set system option kernel disable-power-saving

commit
save
reboot now
```

**Use**:
- High-performance compute workloads
- Low latency applications
- When power consumption is not critical

### AMD P-State Driver

Configure the AMD P-State driver mode (for AMD CPUs):

**Available Modes**:
```bash
# Passive mode (default)
set system option kernel amd-pstate-driver passive

# Active mode (more aggressive power management)
set system option kernel amd-pstate-driver active

# Guided mode (balance)
set system option kernel amd-pstate-driver guided

commit
save
reboot now
```

**Passive Mode**:
- Default mode
- Legacy frequency scaling
- Better compatibility

**Active Mode**:
- Hardware-controlled frequency
- Better power efficiency
- Newer AMD CPUs

**Guided Mode**:
- Hybrid approach
- Balance performance/power

### Quiet Boot

Hide kernel boot messages:

**Enable Quiet Boot**:
```bash
# Minimal boot messages
set system option kernel quiet

commit
save
reboot now
```

**Disable** (verbose boot):
```bash
delete system option kernel quiet

commit
reboot now
```

### Checking Kernel Options

```bash
# Boot parameters
cat /proc/cmdline

# CPU frequency governor
cat /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

# CPU mitigations
cat /sys/devices/system/cpu/vulnerabilities/*
```

## Configuration Examples

### Example 1: Yandex Cloud - Performance Tuning

**Scenario**: A high-throughput compute instance in Yandex Cloud.

```bash
configure

# Throughput optimization
set system option performance throughput

# HTTP client for the metadata service
set system option http-client source-interface eth0

# Auto-resize for disk expansion
set system option root-partition-auto-resize

# Reboot on panic for availability
set system option reboot-on-panic

# Disable unnecessary beep
set system option startup-beep

# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

# Kernel optimizations
set system option kernel disable-power-saving

commit
save

# Reboot to apply kernel options
reboot now
```

**Result**:
- Maximum network throughput
- Automatic disk resize
- High availability through reboot on panic
- Optimized performance

### Example 2: VK Cloud - Low Latency VoIP Router

**Scenario**: A VoIP router in VK Cloud that requires minimal delays.

```bash
configure

# Latency optimization
set system option performance latency

# SSH over the management network
set system option ssh-client source-interface eth1
set system option ssh-client source-address 172.16.1.10

# HTTP over management
set system option http-client source-interface eth1
set system option http-client source-address 172.16.1.10

# Reboot on panic
set system option reboot-on-panic

# Ignore CTRL-ALT-DELETE
set system option ctrl-alt-delete ignore

# Disable startup beep
set system option startup-beep

# Kernel options for low latency
set system option kernel disable-power-saving

commit
save
reboot now
```

**Result**:
- Minimal network latency for VoIP
- Isolated management traffic
- Consistent performance

### Example 3: Enterprise Datacenter - Security-Focused

**Scenario**: An enterprise router with a focus on security.

```bash
configure

# Balanced performance (no specific profile)
# Use the default

# HTTP client control
set system option http-client source-interface eth2
set system option http-client source-address 192.168.100.1

# SSH client control
set system option ssh-client source-interface eth2
set system option ssh-client source-address 192.168.100.1

# Security settings
set system option ctrl-alt-delete ignore

# Reboot on panic disabled for forensics
delete system option reboot-on-panic

# Disable beep
set system option startup-beep

# Keep CPU mitigations enabled (default)
# Do not use disable-mitigations for security
set system option kernel quiet

commit
save
reboot now
```

**Result**:
- Controlled management traffic
- Security mitigations enabled
- Production-ready configuration

### Example 4: Development Lab - Convenience

**Scenario**: A development/testing environment.

```bash
configure

# Throughput for testing
set system option performance throughput

# CTRL-ALT-DELETE reboot for convenience
set system option ctrl-alt-delete reboot

# Reboot on panic
set system option reboot-on-panic

# Verbose boot for debugging
delete system option kernel quiet

# German keyboard for the local console
set system option keyboard-layout de

commit
save
reboot now
```

**Result**:
- Convenience for developers
- Easy troubleshooting
- Fast recovery

## Monitoring and Diagnostics

### Checking system options

```bash
# All system options
show configuration system option

# Specific option
show configuration system option performance
show configuration system option http-client
show configuration system option ssh-client
```

### Performance Metrics

**Network Throughput**:
```bash
# Interface statistics
show interfaces ethernet eth0

# Detailed stats
show interfaces ethernet eth0 statistics

# Monitor traffic
monitor interface eth0
```

**Latency Testing**:
```bash
# Ping test
ping 8.8.8.8

# MTR for latency analysis
mtr 8.8.8.8

# Traffic capture
monitor traffic interface eth0
```

### HTTP Client Verification

```bash
# Test HTTP source
curl -v http://example.com

# Check connection source
tcpdump -i eth1 -n port 80

# Verify routing
show ip route
```

### SSH Client Verification

```bash
# SSH with verbose
ssh -v user@remote-host

# Check SSH source
# On the remote host:
tail -f /var/log/auth.log
# Should show the source address
```

### Kernel Parameters

```bash
# Boot command line
cat /proc/cmdline

# CPU frequency
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

# Performance stats
cat /proc/stat

# Memory usage
free -h

# System load
uptime
```

### Performance Testing

**Throughput Test**:
```bash
# iperf3 server on the remote host
iperf3 -s

# iperf3 client on VyOS
iperf3 -c remote-server -t 60
# Should show high throughput with the throughput profile
```

**Latency Test**:
```bash
# hping3 for latency
sudo hping3 -1 remote-server --fast

# sockperf for network latency
sockperf ping-pong -i remote-server -p 5001
```

## Troubleshooting

### Performance profile does not work

**Problem**: The performance profile does not improve performance.

**Causes**:
1. The system was not rebooted after the changes
2. Hardware limitations
3. A bottleneck elsewhere (CPU, disk)

**Solution**:
```bash
# Check the configuration
show configuration system option performance

# Check kernel parameters
cat /proc/cmdline | grep performance

# If absent - a reboot is required
reboot now

# After reboot, verify
cat /proc/sys/net/core/rmem_max
cat /proc/sys/net/core/wmem_max
```

### HTTP Client Source does not work

**Problem**: HTTP requests do not use the configured source.

**Causes**:
1. The source interface is down
2. No route through the source interface
3. The source address is not on the source interface

**Diagnostics**:
```bash
# Check interface status
show interfaces

# Check routing table
show ip route

# Check source address
ip addr show eth1

# Test connectivity
ping -I eth1 8.8.8.8
```

**Solution**:
```bash
# Verify the source interface is up
show interfaces ethernet eth1

# Verify the source address exists
show interfaces ethernet eth1 address

# Fix if needed
set interfaces ethernet eth1 address 10.0.1.1/24

# Verify routing
set protocols static route 0.0.0.0/0 next-hop 10.0.1.254 interface eth1

commit
```

### Keyboard Layout did not change

**Problem**: The keyboard layout stayed the same after configuration.

**Causes**:
1. The system was not rebooted
2. The option was set incorrectly
3. Console vs SSH confusion

**Solution**:
```bash
# Verify configuration
show configuration system option keyboard-layout

# Reboot system
reboot now

# After reboot, test on the console (not SSH)
# SSH uses the client keyboard layout
```

### CTRL-ALT-DELETE is not ignored

**Problem**: CTRL-ALT-DELETE triggers a reboot despite ignore.

**Causes**:
1. The configuration is not saved
2. Systemd is not updated
3. Testing over SSH (does not work, console only)

**Solution**:
```bash
# Set ignore
set system option ctrl-alt-delete ignore
commit
save

# Verify systemd
systemctl status ctrl-alt-del.target

# Test only on the physical console
```

### Reboot on Panic does not trigger

**Problem**: The system does not reboot on kernel panic.

**Causes**:
1. The panic timeout is not set
2. Hardware hang
3. The panic is too severe for a reboot

**Solution**:
```bash
# Enable reboot on panic
set system option reboot-on-panic
commit

# Set panic timeout
set system sysctl parameter kernel.panic value 10
commit
save

# Test trigger panic (ONLY IN TEST ENVIRONMENT)
# echo c > /proc/sysrq-trigger
```

### Root Partition did not expand

**Problem**: The root partition did not expand after a disk resize.

**Causes**:
1. The system was not rebooted
2. The partition table is not updated
3. The filesystem is already at maximum size

**Diagnostics**:
```bash
# Check disk size
lsblk

# Check filesystem size
df -h /

# Check partition table
sudo fdisk -l /dev/vda
```

**Solution**:
```bash
# Enable auto-resize
set system option root-partition-auto-resize
commit
save

# Reboot
reboot now

# Manual resize if auto-resize failed
sudo growpart /dev/vda 1
sudo resize2fs /dev/vda1

# Verify
df -h /
```

### Kernel Options did not apply

**Problem**: Kernel options (disable-mitigations, disable-power-saving) are not active.

**Causes**:
1. The system was not rebooted
2. The hardware does not support the option
3. Conflicting kernel parameters

**Diagnostics**:
```bash
# Check boot parameters
cat /proc/cmdline

# Should see mitigations=off if configured
# Should see processor.max_cstate=0 for disable-power-saving
```

**Solution**:
```bash
# Verify configuration
show configuration system option kernel

# A reboot is required for kernel options
reboot now

# After reboot, verify
cat /proc/cmdline

# Check the CPU governor
cat /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
```

## Security

### Performance vs Security Trade-offs

**Disable CPU Mitigations**:
```bash
# Increases performance BUT reduces security
set system option kernel disable-mitigations
```

**Risks**:
- Vulnerable to Spectre, Meltdown attacks
- Side-channel vulnerabilities
- Use only in trusted networks

**Recommendation**:
```bash
# Production - keep mitigations enabled (default)
delete system option kernel disable-mitigations

# Trusted lab - can disable for performance
set system option kernel disable-mitigations
```

### CTRL-ALT-DELETE Security

**Production**:
```bash
# Always ignore to prevent accidental reboots
set system option ctrl-alt-delete ignore
```

**Physical Security**:
- Console access must be physically protected
- Ignoring CTRL-ALT-DELETE does not replace physical security
- Monitor console access

### Source Address Security

**Whitelisting**:
```bash
# Control the source for HTTP/SSH
set system option http-client source-address 10.0.1.1
set system option ssh-client source-address 10.0.1.1

# Remote firewalls can whitelist these IPs
```

**Audit**:
```bash
# Log outgoing connections
set system syslog host 192.168.1.100 facility local0 level info

# Monitor source addresses
tcpdump -i any -n | grep "10.0.1.1"
```

## Integration with Cloud Platforms

### Yandex Cloud Metadata Service

**HTTP Client for Metadata**:
```bash
# Ensure metadata requests use the correct interface
set system option http-client source-interface eth0

# Metadata service IP: 169.254.169.254
# Must be reachable through eth0

commit
```

**Testing**:
```bash
# Test metadata access
curl http://169.254.169.254/latest/meta-data/

# Should return metadata
```

### VK Cloud Instance Metadata

**Similar Configuration**:
```bash
# HTTP client through the primary interface
set system option http-client source-interface eth0

# VK Cloud metadata service
curl http://169.254.169.254/openstack/latest/meta_data.json

commit
```

### Cloud Disk Auto-Resize

**Yandex Cloud**:
```bash
# When increasing the disk in the console
set system option root-partition-auto-resize
commit
save
reboot now

# After reboot, the filesystem is expanded
```

**VK Cloud**:
```bash
# Similar process
set system option root-partition-auto-resize
commit
save
reboot now
```

## Best Practices

1. **Performance Tuning**:
   - Use the throughput profile for file servers, backup
   - Use the latency profile for VoIP, gaming, real-time apps
   - Test before/after to measure the improvement
   - Reboot after changing the performance profile

2. **HTTP/SSH Client Source**:
   - Configure the source for predictable routing
   - Whitelist source addresses on remote firewalls
   - Document source configurations for troubleshooting
   - Test connectivity after changes

3. **Keyboard Layout**:
   - Configure it if you use a non-US keyboard on the console
   - Remember: console only, not SSH
   - A reboot is required after the change

4. **Startup Beep**:
   - Disable in datacenters for noise reduction
   - Keep enabled in small deployments for diagnostics
   - Personal preference

5. **CTRL-ALT-DELETE**:
   - Always ignore in production
   - Physical console security is critical
   - Document the behavior for the operations team

6. **Reboot on Panic**:
   - Enable in production for automatic recovery
   - Disable in development for debugging
   - Set a reasonable panic timeout (10-60 seconds)
   - Monitor panic events

7. **Root Auto-Resize**:
   - Enable for cloud instances with dynamic disks
   - Test the resize procedure before production
   - Monitor filesystem space after the resize

8. **Kernel Options**:
   - Disable mitigations only in trusted environments
   - Disable power-saving for consistent performance
   - AMD P-State for newer AMD CPUs
   - Always test after kernel changes

9. **Change Management**:
   - Test system options in a lab environment
   - Document all changes
   - Plan reboot windows
   - Back up the configuration before changes
   - Verify after reboot

10. **Monitoring**:
    - Monitor performance metrics after tuning
    - Track source address usage
    - Log kernel panics
    - Alert on unexpected reboots

## Conclusion

VyOS system options provide flexible tools for configuring system behavior and optimizing performance. Key capabilities:

- **Performance profiles** - throughput and latency optimization for specific workloads
- **HTTP/SSH client source** - control of outgoing connections for security and routing
- **Keyboard layout** - support for various layouts for console access
- **System behavior** - configuration of startup beep, CTRL-ALT-DELETE, reboot on panic
- **Kernel options** - advanced tuning for performance and power management
- **Cloud integration** - auto-resize and metadata service support

Proper configuration of system options lets you:
- Optimize performance for specific use cases
- Improve security through source address control
- Increase availability through automatic reboot on panic
- Simplify cloud deployment through auto-resize

Use system options to adapt VyOS to your specific requirements:
- High-throughput workloads → throughput profile
- Low-latency applications → latency profile
- Cloud environments → auto-resize and metadata configuration
- Enterprise security → source address control and mitigations enabled

Always test changes in a non-production environment and plan reboot windows, since most options require a system restart to apply.