VyOS command cheat sheet

Every command on this page comes from the lessons and was run on VyOS 2026.10.16-0024-rolling in their labs, with the addresses shown (all documentation or private ranges). The one exception is save: the labs boot straight from the ISO, so there is nothing to save to. The lesson linked in each section shows the command in context, with its real output.

VyOS has two modes. Operational mode (prompt ends in $) is for looking: show, ping, monitor. Configuration mode (configure, prompt ends in #) is for changing: set and delete edit a candidate configuration, and nothing takes effect until you commit. To run an operational command from configuration mode, prefix it with run.

Configuration workflow

configure                     # enter configuration mode
set ...                       # stage changes
compare                       # what will change
commit                        # apply them
commit-confirm 1              # apply, and roll back in 1 minute unless you type: confirm
save                          # keep them across reboots
exit                          # back to operational mode

show configuration commands | match "protocols bgp" prints the running configuration as set commands, filtered — the quickest way to copy a working config. (Setting up VyOS with basic BGP)
show system commit lists previous commits, for comparing or rolling back. (Operating VyOS)

Interfaces and static routes

set interfaces ethernet eth0 address '192.0.2.0/31'
set interfaces ethernet eth0 description 'Link to R2'
set interfaces loopback lo address '198.51.100.1/32'
set protocols static route 198.51.100.2/32 next-hop 192.0.2.1

Look at	Command
All interfaces and addresses	`show interfaces`
One interface's counters	`show interfaces ethernet eth0 brief`
The routing table	`show ip route`, `show ip route 203.0.113.0/24`
ARP / IPv6 neighbours	`show arp`, `show ipv6 neighbors`
Reachability from a chosen source	`ping 203.0.113.1 source-address 198.51.100.1 count 3`
Packet capture	`monitor traffic interface eth1 filter "icmp"`

Lessons: BGP on loopbacks vs interface addresses, Packets That Never Come Back.

NAT

# Source NAT (masquerade) for a private LAN leaving via the WAN
set nat source rule 100 description 'LAN to WAN'
set nat source rule 100 outbound-interface name 'eth1'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'

# Port forwarding: WAN port 8080 to a server on the LAN
set nat destination rule 100 inbound-interface name 'eth0'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 destination port '8080'

Check with show nat source rules, show nat source translations and show nat destination translations. Always match the private source range in a source NAT rule, or public addresses get translated too. Lesson: Setting up VyOS with NAT.

Firewall

# Stateful basics: allow replies, drop invalid packets
set firewall global-options state-policy established action 'accept'
set firewall global-options state-policy related action 'accept'
set firewall global-options state-policy invalid action 'drop'

# Traffic through the router
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 inbound-interface name 'eth0'

# Traffic to the router itself (allow OSPF, for example)
set firewall ipv4 input filter rule 70 action 'accept'
set firewall ipv4 input filter rule 70 protocol 'ospf'

Zone-based policy groups interfaces into zones and applies a named ruleset per zone pair:

set firewall ipv4 name RETURN-ONLY default-action 'drop'
set firewall ipv4 name RETURN-ONLY rule 10 action 'accept'
set firewall ipv4 name RETURN-ONLY rule 10 state 'established'
set firewall zone WAN member interface 'eth0'
set firewall zone WAN default-action 'drop'
set firewall zone WAN from LAN firewall name 'ALLOW-ALL'

Check with show firewall ipv4 forward filter, show firewall ipv4 input filter, show firewall ipv4 name WAN-TO-LAN and show firewall zone-policy. Lessons: Zone-based firewall on VyOS, Setting up VyOS with NAT.

BGP

set protocols bgp system-as '64500'
set protocols bgp parameters router-id '198.51.100.1'
set protocols bgp neighbor 192.0.2.1 remote-as 'internal'
set protocols bgp neighbor 192.0.2.1 description 'R2 via link A'
set protocols bgp neighbor 192.0.2.1 address-family ipv4-unicast

# Export policy: only our own prefix
set policy prefix-list OUR-PREFIXES rule 10 action 'permit'
set policy prefix-list OUR-PREFIXES rule 10 prefix '198.51.100.0/24'
set policy route-map TRANSIT-OUT rule 10 action 'permit'
set policy route-map TRANSIT-OUT rule 10 match ip address prefix-list 'OUR-PREFIXES'
set policy route-map TRANSIT-OUT rule 100 action 'deny'

Look at	Command
All sessions and prefix counts	`show ip bgp summary`
One session's state and last reset	`show ip bgp neighbors 192.0.2.1 \	match "BGP state\	Last reset"`
What you receive / send	`show ip bgp neighbors 192.0.2.1 received-routes`, `... advertised-routes`
Every path for a prefix and why one won	`show bgp ipv4 203.0.113.0/24`
Routes carrying a community	`show bgp ipv4 community-list BLACKHOLE`

Lessons: Setting up VyOS with basic BGP, BGP communities, prepending and RTBH, Route reflectors on VyOS. When a session won't come up, see the BGP troubleshooting cheat sheet.

OSPF and BFD

set protocols ospf parameters router-id '198.51.100.1'
set protocols ospf interface lo area '0'
set protocols ospf interface lo passive
set protocols ospf interface eth0 area '0'
set protocols ospfv3 interface eth0 area '0'
set protocols bfd peer 192.0.2.1

Check with show ip ospf neighbor, show ip ospf interface eth0, show ip ospf database, show ip route ospf, show ipv6 ospfv3 neighbor and show bfd peers brief. Lessons: OSPF on VyOS: costs and OSPFv3, BGP on loopbacks vs interface addresses.

LAN services: DHCP, DNS and VRRP

set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 subnet-id '1'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option default-router '10.0.0.1'
set service dns forwarding listen-address '10.0.0.1'
set service dns forwarding allow-from '10.0.0.0/24'
set high-availability vrrp group LAN vrid '10'
set high-availability vrrp group LAN interface 'eth0'
set high-availability vrrp group LAN address 10.0.0.1/24
set high-availability vrrp group LAN priority '100'

Check with show dhcp server leases and show vrrp. Lesson: Office gateway: DHCP, DNS and VRRP on VyOS.

IPv6

set service router-advert interface eth1 prefix 2001:db8:1000:1::/64
set service router-advert interface eth1 name-server '2001:db8:f000::53'
set interfaces ethernet eth0 dhcpv6-options pd 0 length '56'
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 sla-id '0'

Check with show ipv6 route, show ipv6 neighbors and show dhcpv6 server leases. Lessons: IPv6 on VyOS: setup and routing, IPv4 over an IPv6-only core.

WireGuard

generate pki wireguard key-pair
set interfaces wireguard wg0 peer SITE-B allowed-ips '10.2.0.0/24'

Check with show interfaces wireguard wg0 and show interfaces wireguard wg0 summary. Lesson: Site-to-site VPN with WireGuard on VyOS.

Management and operations

set service ssh listen-address '198.51.100.254'
set service ssh disable-password-authentication
set system login banner pre-login 'Authorised access only. All activity is logged.'
set system syslog remote 198.51.100.10 facility all level 'info'
set service snmp listen-address 198.51.100.1
set system flow-accounting netflow interface 'eth0'
set system flow-accounting netflow server 198.51.100.10 port '2055'
set system config-management commit-archive location OPS scp server '198.51.100.10'

Lessons: Setting up VyOS with basic BGP (management section), Operating VyOS: monitoring, backups and automation.