Intermediate · VyOS firewall in depth · section 7 of 8

Checklist and troubleshooting

✓ Lab-tested 21 October 2026 on VyOS 2026.10.16-0024-rolling, Debian 12 hosts

Checklist

[ ] An input filter with a default drop: the router is the most valuable box on the network.
[ ] SSH only from management networks, and rate-limited from anywhere else that needs it.
[ ] A global state policy: established and related accepted, invalid dropped.
[ ] Groups for every address, network, port and interface that appears in more than one rule.
[ ] Drops that must always apply (blocklists) numbered before the accepts.
[ ] Egress filtering from the LAN, at least for SMTP and anything you'd be embarrassed to send.
[ ] The IPv6 rulesets as well, with Neighbour Discovery and the ICMPv6 errors allowed.
[ ] Logging on the rules you'll want evidence from, and on default actions.

Troubleshooting

Symptom	Likely cause	Check
A connection times out instead of being refused	A firewall dropped it	`show firewall …` counters; `show log firewall`
A blocked host still gets through	An accept rule is numbered before the drop	Rule numbers; which rule's counter climbs
IPv6 hosts can't reach their gateway	Neighbour Discovery dropped by the IPv6 input filter	`ip -6 neigh` shows `FAILED`; the IPv6 input default-action counter
Large IPv6 transfers hang	`packet-too-big` dropped	Allow it in input and forward
SSH works, then stops after a few attempts	The rate limit	The rate-limit rule's counter and log prefix
Counters are all zero	A commit since the traffic	Generate the traffic again
Locked out after a commit over SSH	Your own SSH not allowed	Use `commit-confirm` (see Operating VyOS), so a mistake rolls itself back

R1's complete firewall

set firewall global-options state-policy established action 'accept'
set firewall global-options state-policy invalid action 'drop'
set firewall global-options state-policy related action 'accept'
set firewall group address-group ADMIN-HOMES address '192.0.2.10'
set firewall group address-group BLOCKLIST address '192.0.2.66'
set firewall group interface-group LAN-IFS interface 'eth1'
set firewall group network-group MGMT-NETS network '10.99.0.0/24'
set firewall group port-group WEB-PORTS port '80'
set firewall group port-group WEB-PORTS port '443'
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 5 action 'jump'
set firewall ipv4 forward filter rule 5 jump-target 'BLOCKLIST-CHECK'
set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 description 'LAN may browse the web'
set firewall ipv4 forward filter rule 10 destination group port-group 'WEB-PORTS'
set firewall ipv4 forward filter rule 10 inbound-interface group 'LAN-IFS'
set firewall ipv4 forward filter rule 10 protocol 'tcp'
set firewall ipv4 forward filter rule 20 action 'accept'
set firewall ipv4 forward filter rule 20 protocol 'icmp'
set firewall ipv4 forward filter rule 30 action 'accept'
set firewall ipv4 forward filter rule 30 description 'The public web server on the LAN'
set firewall ipv4 forward filter rule 30 destination address '198.51.100.10'
set firewall ipv4 forward filter rule 30 destination group port-group 'WEB-PORTS'
set firewall ipv4 forward filter rule 30 outbound-interface group 'LAN-IFS'
set firewall ipv4 forward filter rule 30 protocol 'tcp'
set firewall ipv4 input filter default-action 'drop'
set firewall ipv4 input filter rule 5 action 'jump'
set firewall ipv4 input filter rule 5 jump-target 'BLOCKLIST-CHECK'
set firewall ipv4 input filter rule 10 action 'accept'
set firewall ipv4 input filter rule 10 protocol 'icmp'
set firewall ipv4 input filter rule 20 action 'jump'
set firewall ipv4 input filter rule 20 destination port '22'
set firewall ipv4 input filter rule 20 jump-target 'SSH-IN'
set firewall ipv4 input filter rule 20 protocol 'tcp'
set firewall ipv4 name BLOCKLIST-CHECK default-action 'return'
set firewall ipv4 name BLOCKLIST-CHECK description 'Shared by input and forward'
set firewall ipv4 name BLOCKLIST-CHECK rule 10 action 'drop'
set firewall ipv4 name BLOCKLIST-CHECK rule 10 log
set firewall ipv4 name BLOCKLIST-CHECK rule 10 source group address-group 'BLOCKLIST'
set firewall ipv4 name SSH-IN default-action 'drop'
set firewall ipv4 name SSH-IN default-log
set firewall ipv4 name SSH-IN description 'Who may SSH to the router'
set firewall ipv4 name SSH-IN rule 10 action 'accept'
set firewall ipv4 name SSH-IN rule 10 description 'Management network: always'
set firewall ipv4 name SSH-IN rule 10 source group network-group 'MGMT-NETS'
set firewall ipv4 name SSH-IN rule 20 action 'drop'
set firewall ipv4 name SSH-IN rule 20 description 'Anyone else: at most 3 new connections a minute'
set firewall ipv4 name SSH-IN rule 20 log
set firewall ipv4 name SSH-IN rule 20 recent count '3'
set firewall ipv4 name SSH-IN rule 20 recent time 'minute'
set firewall ipv4 name SSH-IN rule 20 state 'new'
set firewall ipv4 name SSH-IN rule 30 action 'accept'
set firewall ipv4 name SSH-IN rule 30 description 'Admins from home'
set firewall ipv4 name SSH-IN rule 30 source group address-group 'ADMIN-HOMES'
set firewall ipv6 forward filter default-action 'drop'
set firewall ipv6 forward filter rule 10 action 'accept'
set firewall ipv6 forward filter rule 10 description 'LAN may browse the web'
set firewall ipv6 forward filter rule 10 destination group port-group 'WEB-PORTS'
set firewall ipv6 forward filter rule 10 inbound-interface group 'LAN-IFS'
set firewall ipv6 forward filter rule 10 protocol 'tcp'
set firewall ipv6 forward filter rule 20 action 'accept'
set firewall ipv6 forward filter rule 20 description 'Echo and the ICMPv6 errors, in both directions'
set firewall ipv6 forward filter rule 20 protocol 'ipv6-icmp'
set firewall ipv6 input filter default-action 'drop'
set firewall ipv6 input filter rule 10 action 'accept'
set firewall ipv6 input filter rule 10 icmpv6 type-name 'echo-request'
set firewall ipv6 input filter rule 10 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 20 action 'accept'
set firewall ipv6 input filter rule 20 description 'Neighbour Discovery: IPv6 needs it like IPv4 needs ARP'
set firewall ipv6 input filter rule 20 icmpv6 type-name 'nd-neighbor-solicit'
set firewall ipv6 input filter rule 20 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 21 action 'accept'
set firewall ipv6 input filter rule 21 icmpv6 type-name 'nd-neighbor-advert'
set firewall ipv6 input filter rule 21 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 22 action 'accept'
set firewall ipv6 input filter rule 22 icmpv6 type-name 'nd-router-solicit'
set firewall ipv6 input filter rule 22 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 30 action 'accept'
set firewall ipv6 input filter rule 30 description 'Errors that make IPv6 work: never block packet-too-big'
set firewall ipv6 input filter rule 30 icmpv6 type-name 'packet-too-big'
set firewall ipv6 input filter rule 30 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 31 action 'accept'
set firewall ipv6 input filter rule 31 icmpv6 type-name 'destination-unreachable'
set firewall ipv6 input filter rule 31 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 32 action 'accept'
set firewall ipv6 input filter rule 32 icmpv6 type-name 'time-exceeded'
set firewall ipv6 input filter rule 32 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 33 action 'accept'
set firewall ipv6 input filter rule 33 icmpv6 type-name 'parameter-problem'
set firewall ipv6 input filter rule 33 protocol 'ipv6-icmp'