17 Jan 2022
VyOS interface firewall zone setup checklist
Adding a new interface to an existing VyOS instance will typically require adding firewall rules for that interface. Here's a checklist:
Assign the interface (
wg0
in this example) to a zone:set zone-policy zone wireguard0 interface wg0
Avoid using the same name for the zone as the interface itself. It will save you some minor grief with
grep
in the future. In a zone-based firewall, you will often use a zone that handles multiple interfaces.If creating a new zone:
a. For each zone that can accept traffic from the new interface, create a new firewall:
set firewall name wireguard0-myzone rule 22 action accept set firewall name wireguard0-myzone rule 22 description allow_ssh_in set firewall name wireguard0-myzone rule 22 destination port 22 set firewall name wireguard0-myzone rule 22 protocol tcp set firewall name wireguard0-myzone rule 22 log enable
b. Set the zone-policy for each new interface pair:
set zone-policy zone myzone from wireguard0 firewall name wireguard0-myzone
c. Create the same zone and zone-policy combination in the other direction:
set firewall name myzone-wireguard0 rule 700 protocol icmp set firewall name myzone-wireguard0 rule 700 state new enable set firewall name myzone-wireguard0 rule 700 action accept set zone-policy zone wireguard0 from myzone firewall name myzone-wireguard0