I’ve been setting up a fairly recent rolling release build of VyOS 1.4 today and I’ve hopefully gotten it close to what I need. I did run into some issues that I’ve appreciate some help with though. 
- First of all, I set up Hairpin NAT according to the official documentation here. However, I realized that my “NAT Reflection: SSH” destination NAT rule (rule 110) for SSH to a home server of mine seems to prevent me from being able to SSH to the VyOS router from the LAN, which kind of makes sense. Is there any way to allow both of these to listen on port 22 and still have both of these use cases work without having to change the VyOS router to listen to SSH on a different port?
That was possible on my current EdgeRouter that the VyOS router is supposed to replace, so I would assume so. I’m just not entirely sure what the best way to accomplish that is. Can I simply specify the destination address there or something to solve it? Wouldn’t that have to be my WAN IP though?
- I tried to add a separate extra management interface that’s assigned a different subnet just in case I get locked out again. However, I’m unable to SSH after setting a static IP in that subnet on my laptop. Clearly there is something simple/obvious that I’m missing here, but I’ve stared too long at the configuration to see it. Any pointers?
Santized configuration:
firewall {
flowtable FT-OFFLOAD-v4 {
interface "eth0"
interface "eth3"
}
group {
interface-group LAN {
interface "eth4"
interface "eth3"
}
interface-group MANAGEMENT {
include "LAN"
interface "eth8"
}
interface-group WAN {
interface "eth0"
}
network-group NET-LAN-v4 {
network "192.168.10.0/24"
network "192.168.1.0/24"
}
}
ipv4 {
forward {
filter {
rule 5 {
action "offload"
offload-target "FT-OFFLOAD-v4"
state "established"
state "related"
}
rule 10 {
action "jump"
jump-target "CONN_FILTER"
}
rule 100 {
action "jump"
destination {
group {
network-group "NET-LAN-v4"
}
}
inbound-interface {
group "WAN"
}
jump-target "OUTSIDE-IN"
}
}
}
input {
filter {
default-action "drop"
rule 10 {
action "jump"
jump-target "CONN_FILTER"
}
rule 20 {
action "jump"
destination {
port "22"
}
jump-target "VyOS_MANAGEMENT"
protocol "tcp"
}
rule 30 {
action "accept"
icmp {
type-name "echo-request"
}
protocol "icmp"
state "new"
}
rule 40 {
action "accept"
destination {
port "53"
}
protocol "tcp_udp"
source {
group {
network-group "NET-LAN-v4"
}
}
}
rule 50 {
action "accept"
source {
address "127.0.0.0/8"
}
}
}
}
name CONN_FILTER {
default-action "return"
rule 10 {
action "accept"
description "Allow established/related"
state "established"
state "related"
}
rule 20 {
action "drop"
description "Drop invalid packets"
state "invalid"
}
}
name OUTSIDE-IN {
default-action "drop"
rule 30 {
action "accept"
description "SSH"
destination {
address "192.168.1.10"
port "22"
}
protocol "tcp"
state "new"
}
}
name VyOS_MANAGEMENT {
default-action "return"
rule 15 {
action "accept"
inbound-interface {
group "MANAGEMENT"
}
}
rule 20 {
action "drop"
inbound-interface {
group "WAN"
}
state "new"
}
}
}
}
interfaces {
ethernet eth0 {
address "dhcp"
description "WAN (SFP+ 1)"
hw-id "20:7c:xx:xx:xx:xx"
offload {
gro
gso
}
ring-buffer {
rx "4096"
tx "4096"
}
}
ethernet eth1 {
description "SFP+ 2"
hw-id "20:7c:xx:xx:xx:xx"
}
ethernet eth2 {
description "SFP+ 3"
hw-id "20:7c:xx:xx:xx:xx"
}
ethernet eth3 {
address "192.168.1.1/24"
description "LAN (SFP+ 4)"
hw-id "20:7c:xx:xx:xx:xx"
offload {
gro
gso
}
ring-buffer {
rx "4096"
tx "4096"
}
}
ethernet eth4 {
address "192.168.10.1/24"
description "LAN 2 (RJ45 4)"
hw-id "20:7c:xx:xx:xx:xx"
offload {
gro
gso
}
ring-buffer {
rx "4096"
tx "4096"
}
}
ethernet eth5 {
description "RJ45 2"
hw-id "20:7c:xx:xx:xx:xx"
}
ethernet eth6 {
description "RJ45 3"
hw-id "20:7c:xx:xx:xx:xx"
}
ethernet eth7 {
description "RJ45 1"
hw-id "20:7c:xx:xx:xx:xx"
}
ethernet eth8 {
address "192.168.100.1/24"
description "Management (RJ45 5)"
hw-id "20:7c:xx:xx:xx:xx"
}
loopback lo {
}
}
nat {
destination {
rule 10 {
description "SSH"
destination {
port "22"
}
inbound-interface {
group "WAN"
}
protocol "tcp"
translation {
address "192.168.1.10"
}
}
rule 110 {
description "NAT Reflection: SSH"
destination {
port "22"
}
inbound-interface {
group "LAN"
}
protocol "tcp"
translation {
address "192.168.1.10"
}
}
}
source {
rule 100 {
description "NAT"
outbound-interface {
name "eth0"
}
source {
address "192.168.0.0/16"
}
translation {
address "masquerade"
}
}
rule 110 {
description "NAT Reflection: INSIDE"
destination {
address "192.168.1.0/24"
}
outbound-interface {
group "WAN"
}
protocol "tcp_udp"
source {
address "192.168.1.0/24"
}
translation {
address "masquerade"
}
}
}
}
service {
dhcp-server {
shared-network-name LAN {
subnet 192.168.1.0/24 {
default-router "192.168.1.1"
lease "86400"
name-server "192.168.1.1"
range 0 {
start "192.168.1.10"
stop "192.168.1.254"
}
}
}
shared-network-name LAN2 {
subnet 192.168.10.0/24 {
default-router "192.168.10.1"
lease "86400"
name-server "192.168.10.1"
range 0 {
start "192.168.10.10"
stop "192.168.10.254"
}
}
}
}
dns {
forwarding {
allow-from "192.168.10.0/24"
allow-from "192.168.1.0/24"
cache-size "0"
listen-address "192.168.10.1"
listen-address "192.168.1.1"
name-server 1.0.0.1 {
}
name-server 1.1.1.1 {
}
}
}
ntp {
allow-client {
address "0.0.0.0/0"
address "::/0"
}
server time1.vyos.net {
}
server time2.vyos.net {
}
server time3.vyos.net {
}
}
ssh {
port "22"
}
}
system {
config-management {
commit-revisions "100"
}
conntrack {
modules {
ftp
h323
nfs
pptp
sip
sqlnet
tftp
}
}
console {
device ttyS0 {
speed "115200"
}
}
host-name "vyos"
login {
user xxxxxxxx {
authentication {
encrypted-password "xxxxxxxxxx"
}
}
}
name-server "192.168.10.1"
name-server "192.168.1.1"
syslog {
global {
facility all {
level "info"
}
facility local7 {
level "debug"
}
}
}
}
The last posts there about potentially destroying the config is a bit of a concern though, so I’ll probably just set the WAN IP manually for now, while I wait for that to be integrated officially.