Build the lab yourself
This lesson uses the Setting up VyOS with NAT lab unchanged: build it from that lesson's Build the lab yourself section, apply its interface, source NAT and destination NAT stages (but not its forward filter), then apply this lesson's zone policy and the return-traffic rule.
Where next
- Setting up VyOS with NATPrerequisite · Beginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- IPv6 on VyOS: setup and routingAlso covers firewall · Beginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
- Packets That Never Come BackAlso covers NAT · Intermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Office gateway: DHCP, DNS and VRRP on VyOSAlso in Office & branch networks · Beginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.