Cli does exist in opnsense and No, interfaces for wan or lan are interchangeable during install haven’t tried to change after install though.
Well then, do tell how you configure firewall rules from the CLI.
@RelevantUsername I’m not sure what your level of familiarity is with firewalls, however, I’ll assume you have at least a basic knowledge of how stateful firewalls work in general. (Side note: I usually configure Established, Invalid, and Related State at the global level. Documentation link.)
The first question you’ll need to answer when preparing to set up the firewall on VyOS is: do you want to use the Zone Policy system, or the more “traditional” (in the Linux world) tables (IPv4 linked there; IPv6 available too) system where rules are tied directly to a specific interface (or interface-group [nftables feature])?
The benefit of the Zone system is a helpful abstraction layer between your firewall rules and the actual interfaces you want them to apply to. This is beneficial when you have a system with many interfaces, and a fair bit of configuration churn. For example, perhaps you are using VyOS as your network edge router. Today you might have one internet link, but anticipate having two or more down the road. With the Zone system, accommodating the new internet link in the future is as simple as adding the new interface to your Internet zone when you turn it up.
Of course, you can do the same thing in the by leveraging an interface-group with the traditional firewall tables system, however, I personally find Zones to be more intuitive, both in the abstraction from physical interfaces (as mentioned above) and the “directional” nature of zone names (eg. internet-local = internet to local [which is actually technically expressed as local from internet in the config]), and so forth.
Hopefully this gives you a bit of a boost in getting started with VyOS. All the best!
3 Likes