Three hooks, and the lab
Build a complete VyOS firewall step by step: the input, forward and output hooks, a global state policy, groups, custom chains, protecting the router with rate-limited SSH, egress filtering, rule order, the ICMPv6 that IPv6 can't live without, and the nftables underneath.
By the end you will be able to:
- Explain which of the input, forward and output hooks a packet meets
- Protect the router itself with an input filter, a custom SSH chain and a rate limit
- Use groups and a shared chain to keep rulesets short and consistent
- Predict the effect of rule order, and read counters and firewall logs
- Write an IPv6 firewall that allows the ICMPv6 IPv6 depends on, and read the nftables VyOS generates
Prerequisites: Setting up VyOS with NAT
The NAT lesson gave R1 one forward filter, and the zone lesson rewrote it as zones. Neither stopped to explain how a VyOS firewall is put together, or how to protect the router itself, which is the box an attacker most wants to reach. This lesson builds a complete firewall for one router, piece by piece, with every test run on a real VyOS VM.
Three hooks
Every packet that touches a router meets exactly one of three filters, depending on where it's going:
| Hook | Which packets | Example |
|---|---|---|
input | Addressed to the router itself | SSH to R1, a ping to R1, BGP from a neighbour |
forward | Passing through the router | lanhost browsing the web |
output | Sent by the router | R1 pinging something, its DNS lookups |
A packet passing through only meets forward, never input. That's why a forward filter alone leaves the router wide open: before any firewall, the scanner on the internet gets R1's SSH banner, and reaches the web server on the LAN.
In VyOS each one is firewall ipv4 <hook> filter (and the same under ipv6, which is a separate ruleset). Each has numbered rules, checked in order, and a default-action for packets no rule matched.
The lab
R1 has three networks: the internet side (WAN), a LAN with a public subnet and a web server, and a management network with an admin PC. On the internet, home is the address an administrator works from, and scanner is a host we want to keep out.
- input: to the router itself. SSH from admin is addressed to R1, so it meets the input filter, which jumps to the SSH-IN chain.
- input from the internet. home may SSH to R1 too, but at most three new connections a minute. scanner is dropped by the shared BLOCKLIST-CHECK chain before anything else.
- forward: through the router. lanhost browsing the internet passes through R1, so it meets only the forward filter: web ports out are allowed, everything else is dropped.
- output: from the router. R1's own packets leave through the output hook, and their replies return as established traffic.
set system host-name 'R1'
set interfaces ethernet eth0 address '203.0.113.2/30'
set interfaces ethernet eth0 address '2001:db8:ffff::2/64'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '198.51.100.1/24'
set interfaces ethernet eth1 address '2001:db8:10::1/64'
set interfaces ethernet eth1 description 'LAN'
set interfaces ethernet eth2 address '10.99.0.1/24'
set interfaces ethernet eth2 description 'MGMT'
set protocols static route 0.0.0.0/0 next-hop '203.0.113.1'
set protocols static route6 ::/0 next-hop '2001:db8:ffff::1'
set service ssh port '22'- Lines 2–9: WAN, LAN (a routed public subnet, with IPv6) and management.
- Lines 10–11: Default routes to the ISP, for IPv4 and IPv6.
- Line 12: SSH on, for the tests. Without a firewall, it answers anyone.
root@scanner:~# nc -w 3 203.0.113.2 22 </dev/null | head -1
SSH-2.0-OpenSSH_9.2p1
root@scanner:~# curl -s -m 3 http://198.51.100.10/
hello from lanhost- Lines 1–2: A host on the internet gets R1's SSH banner: an open door to the router itself.
- Lines 4–5: …and reaches the LAN's web server.
Check your understanding
A packet from lanhost to a web server on the internet passes through R1. Which of R1's filters does it meet?
- Only forward.
- input, then forward, then output.
- input, because it arrives on one of R1's interfaces.
- output, because it leaves through the WAN.