TTR Networks

Learn networking by exploring it.

Step-through diagrams, annotated configs and output from real labs. Follow a learning path, or browse by topic.

New here? Read how the lessons are built and tested, keep a cheat sheet open, or look up a term in the glossary.

Learning paths

  • Start here: how networks workNew to networking, or filling in the basics

    From switches and IP addresses to a real router, then the two routing protocols everything else builds on.

  • Run an office or branch networkYou look after a small office, branch or home lab

    A VyOS router that hands out addresses, survives a failure, keeps the right traffic out, speaks IPv6, links sites together and can be run properly.

  • Build an internet edgeYou run (or want to run) your own AS: an ISP, hosting provider or multihomed business

    From BGP basics to a VyOS edge with transit and an IX, safe routing policy, communities and RTBH, registry and RPKI hygiene, then an edge-and-core network that scales.

  • Data-centre fabricsYou build or operate leaf-spine networks

    Layer 2 and VLANs, routing fundamentals and loopback design, IPv6-only cores, then EVPN and VXLAN to stretch layer 2 across a routed fabric.

  • Troubleshoot like an operatorSomething is broken and you want a method, not guesses

    Find where packets die with Linux tools and tcpdump, read a VyOS router's state, and set up the logs, counters and flows you'll want next time.

Foundations

  • Why not just keep it simple?Beginner · 25 min

    Why networks use routing protocols, BGP and redundant links instead of a few static routes, when they shouldn't, and what the extra complexity buys. With a real experiment: one quiet link failure, three designs, measured.

  • Switching basics: layer 2, VLANs and IP addressingBeginner · 40 min

    How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.

  • Linux Network ConnectivityBeginner · 80 min

    Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.

  • Building a network lab on an Apple Silicon MacBeginner · 45 min

    Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.

Office & branch networks

  • Setting up VyOS with NATBeginner · 45 min

    A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.

  • Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min

    Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.

  • VyOS firewall in depthIntermediate · 45 min

    Build a complete VyOS firewall step by step: the input, forward and output hooks, a global state policy, groups, custom chains, protecting the router with rate-limited SSH, egress filtering, rule order, the ICMPv6 that IPv6 can't live without, and the nftables underneath.

  • Zone-based firewall on VyOSIntermediate · 35 min

    Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.

  • IPv6 on VyOS: setup and routingBeginner · 55 min

    Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.

  • Two internet connections on VyOSIntermediate · 45 min

    Add a second ISP to a VyOS office router and make it actually work: why a backup default route misses most outages, health checks that test beyond the ISP, per-ISP NAT, port forwards through both ISPs, and what happens to open connections, all measured on a real lab.

  • Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min

    Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.

  • nftables and iptables on Debian: host and router firewallsIntermediate · 60 min

    Build a Debian firewall with nftables, from a host firewall to an office router with NAT and port forwards: safe changes with a timed rollback, sets and maps, logging and packet tracing, and what iptables really is on Debian 13.

  • OpenVPN on Debian: users, routing and revocationIntermediate · 60 min

    Install and run an OpenVPN server on Debian with your own certificate authority: one certificate per user, fixed addresses, routing to an office and a branch LAN, split and full tunnels, tls-crypt, revoking users, and the mistakes that lock everyone out.

  • WireGuard on Debian: users, routing and keysIntermediate · 50 min

    Run a WireGuard server on Debian for several users, an office LAN and a branch: keys, wg-quick and systemd, AllowedIPs as routing and access control, split and full tunnels, roaming and keepalives, adding and removing users live, and the silent failures.

  • PowerDNS on Debian: authoritative, secondary, DNSSEC and recursorIntermediate · 60 min

    Build a complete DNS service on Debian with PowerDNS: authoritative primary and secondary servers with NOTIFY and AXFR, zones by pdnsutil and the HTTP API, DNSSEC signed all the way from a lab root, and a validating recursor for the office.

  • Two internet connections on DebianIntermediate · 45 min

    Give a Debian office router a second ISP: a routing table per ISP, source rules and connection marks so replies leave the way they came, per-ISP NAT, and a systemd health check that fails over and back, measured with a real outage.

Routing protocols

  • OSPF FundamentalsBeginner · 70 min

    The link-state IGP that runs inside most networks: neighbour adjacencies, LSA flooding, SPF, costs, DR/BDR, areas and LSA types, a hands-on FRR lab, and how OSPF underpins BGP.

  • BGP FundamentalsIntermediate · 75 min

    How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.

  • BGP on loopbacks vs interface addressesIntermediate · 45 min

    Why BGP sessions between loopbacks survive link failures and use parallel links, and what they need to work: an IGP or static routes, update-source, the eBGP connected check, and BFD. Every failure is reproduced on two real VyOS routers.

  • OSPF on VyOS: costs and OSPFv3Intermediate · 30 min

    OSPF the VyOS way: interface-based configuration, reading the interface and database output, steering traffic with costs (and the asymmetric routing that follows), and OSPFv3 for IPv6 over link-local addresses. Captured on the three-router edge/core lab.

  • BFD on VyOS: fast failover for quiet failuresIntermediate · 40 min

    Measure how long OSPF and BGP take to notice a link that fails without going down (35 and 159 seconds in the lab), then cut it to about a second with BFD: profiles, BFD for OSPF and BGP, multihop sessions between loopbacks, and choosing timers.

  • Route reflectors on VyOSIntermediate · 30 min

    Replace an iBGP full mesh with route reflectors: see iBGP refuse to pass routes on, turn on reflection, read ORIGINATOR_ID and CLUSTER_LIST, confirm the reflector stays out of the forwarding path, and survive taking one reflector down.

  • IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min

    Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.

Internet edge

  • Setting up VyOS with basic BGPIntermediate · 50 min

    Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.

  • BGP communities, prepending and RTBHIntermediate · 45 min

    Tag routes with large communities, steer inbound traffic with AS-path prepending (and see why providers' local preference limits it), and stop a DDoS at your provider's edge with remotely triggered blackholing. Built on VyOS with two transit providers, including the two RTBH mistakes the lab made first.

  • Edge and core: building out a VyOS networkIntermediate · 60 min

    Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.

Routing security

  • IRR, RPSL and AS-SETsIntermediate · 60 min

    How networks publish what they announce and how their neighbours turn it into filters: Internet Routing Registries, whois queries, RPSL objects and attributes, AS-SET expansion, bgpq4, and the pitfalls of unsigned routing data.

  • RPKI and Route Origin ValidationIntermediate · 70 min

    Cryptographically signed routing origins: the RPKI trust chain, creating safe ROAs, Valid/Invalid/NotFound, validators and RTR, a real FRR + StayRTR lab, and what ROV can't stop (forged origins, leaks), plus where ASPA comes in.

Data centre

  • EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min

    Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.

Operations & troubleshooting

  • Packets That Never Come BackIntermediate · 75 min

    Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.

  • Debugging BGP: every session state, reproducedIntermediate · 60 min

    Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.

  • Operating VyOS: monitoring, backups and automationIntermediate · 50 min

    Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.