What is VyOS?
VyOS router OS
VyOS is a free, open-source router and firewall operating system built on Debian Linux, configured through a single configuration tree.
VyOS grew out of Vyatta Core, the community edition of a commercial router OS, after that edition was discontinued in the early 2010s. Under the hood it is ordinary Linux: the kernel forwards packets, FRR provides routing protocols such as BGP and OSPF, nftables handles firewalling and NAT, and familiar daemons provide DHCP, DNS forwarding, VRRP and WireGuard. What VyOS adds is one consistent CLI over all of them. In operational mode you run show commands. In configuration mode, entered with configure, you build a candidate configuration with set and delete commands such as set interfaces ethernet eth0 address 192.0.2.1/24, review it with compare, apply it atomically with commit, and write it to disk with save. commit-confirm rolls a change back automatically unless you confirm it, which protects you when editing a remote router.
VyOS runs on hardware, as a virtual machine and in clouds, and is popular for edge routers, labs and small-to-medium networks. Rolling builds are freely available, while long-term-support images are tied to a subscription, so commands and behaviour can differ between versions, and older guides do not always match a current build. A common confusion is between an applied and a saved configuration: commit alone does not survive a reboot. Another is assuming NAT protects the LAN; VyOS needs explicit firewall rules for that. Because VyOS uses FRR, its routing behaviour and show output are close to FRR's. The Packets That Never Come Back lesson troubleshoots a real VyOS router with tcpdump, and Setting up VyOS with NAT builds one from scratch.
Lessons that use VyOS
- Packets That Never Come BackTeaches this term · Intermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- Setting up VyOS with basic BGPIntermediate · 50 min
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
- Operating VyOS: monitoring, backups and automationIntermediate · 50 min
Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.
- Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.
- IPv6 on VyOS: setup and routingBeginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
- Setting up VyOS with NATBeginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min
Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.