Build the lab yourself
One VyOS VM and one ops server container. Put ./vyos (from the Packets That Never Come Back lesson's get-vyos.sh) next to these files with an ansible/ folder holding the inventory and playbooks, run docker compose up -d --build and ./ops-setup.sh, then on R1 set eth0 to 198.51.100.1/24, enable SSH on it, and apply the stages.
# Needs ./vyos (from the tcpdump-and-vyos lesson's get-vyos.sh). Then: docker compose up -d --build && ./ops-setup.sh
# R1's address (198.51.100.1/24 on eth0) comes from its VyOS configuration.
name: vyos-ops-lab
services:
r1:
build:
context: .
dockerfile_inline: |
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends qemu-system-x86 iproute2 socat
COPY start-vyos.sh /usr/local/bin/start-vyos.sh
CMD ["/usr/local/bin/start-vyos.sh"]
cap_add: [NET_ADMIN]
devices: ["/dev/net/tun:/dev/net/tun"]
environment: { VYOS_MEM: "1536", VYOS_SMP: "1", VM_ID: "01" }
volumes: ["./vyos:/vyos:ro"]
networks: { mgmt: { interface_name: eth0 } }
ops:
build: { context: ., dockerfile: Dockerfile.ops }
privileged: true
volumes: ["./ansible:/ansible"]
networks: { mgmt: { interface_name: eth0 } }
networks:
mgmt: { enable_ipv4: false, enable_ipv6: true, ipam: { config: [{ subnet: "fd00:90::/64" }] } }- Lines 5–17: R1.
- Lines 18–22: The ops server.
FROM debian:bookworm-slim
RUN apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
rsyslog nfdump snmp openssh-server openssh-client ansible python3-paramiko iproute2 iputils-ping procps sshpass >/dev/null \
&& rm -rf /var/lib/apt/lists/* && useradd -m -s /bin/bash cfgbackup && echo "cfgbackup:backup-lab-only" | chpasswd && mkdir -p /run/sshd
CMD ["sleep", "infinity"]- Lines 2–4: Syslog, flows, SNMP tools, an SSH server for backups, and Ansible with the VyOS collection.
#!/bin/sh
# The ops server: 198.51.100.10 on the management network. Receives syslog (UDP 514), NetFlow (UDP 2055)
# and config backups (SSH as user "cfgbackup"); runs snmpwalk and Ansible.
cd "$(dirname "$0")"
docker compose exec -T ops sh -c '
sysctl -qw net.ipv6.conf.all.disable_ipv6=1
ip addr add 198.51.100.10/24 dev eth0
printf "module(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n:fromhost-ip, isequal, \"198.51.100.1\" /var/log/r1.log\n& stop\n" > /etc/rsyslog.d/10-remote.conf
rsyslogd
mkdir -p /var/flows && nfcapd -D -w /var/flows -p 2055 -t 60
/usr/sbin/sshd
mkdir -p /home/cfgbackup/r1 && chown cfgbackup /home/cfgbackup/r1'
echo ops ready- Line 8: rsyslog: R1's messages into their own file.
- Line 10: nfcapd: a new flow file every 60 s.
- Line 11: sshd for the commit archive.
Where next
- Setting up VyOS with NATPrerequisite · Beginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- Packets That Never Come BackAlso in Operations & troubleshooting · Intermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Switching basics: layer 2, VLANs and IP addressingAlso on VyOS · Beginner · 40 min
How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.
- Building a network lab on an Apple Silicon MacAlso on VyOS · Beginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.