Learning path

Run an office or branch network

For: You look after a small office, branch or home lab

A VyOS router that hands out addresses, survives a failure, keeps the right traffic out, speaks IPv6, links sites together and can be run properly.

1. Switching basics: layer 2, VLANs and IP addressingBeginner · 40 min

   How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.

2. Setting up VyOS with NATBeginner · 45 min

   A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.

3. Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min

   Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.

4. Zone-based firewall on VyOSIntermediate · 35 min

   Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.

5. IPv6 on VyOS: setup and routingBeginner · 55 min

   Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.

6. Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min

   Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.

7. Operating VyOS: monitoring, backups and automationIntermediate · 50 min

   Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.