VyOS interface firewall zone setup checklist

Adding a new interface to an existing VyOS instance will typically require adding firewall rules for that interface. Here's a checklist:

1. Assign the interface (wg0 in this example) to a zone:

   set zone-policy zone wireguard0 interface wg0
   

   Avoid using the same name for the zone as the interface itself. It will save you some minor grief with grep in the future. In a zone-based firewall, you will often use a zone that handles multiple interfaces.

2. If creating a new zone:

   a. For each zone that can accept traffic from the new interface, create a new firewall:

   set firewall name wireguard0-myzone rule 22 action accept
   set firewall name wireguard0-myzone rule 22 description allow_ssh_in
   set firewall name wireguard0-myzone rule 22 destination port 22
   set firewall name wireguard0-myzone rule 22 protocol tcp
   set firewall name wireguard0-myzone rule 22 log enable
   

   b. Set the zone-policy for each new interface pair:

   set zone-policy zone myzone from wireguard0 firewall name wireguard0-myzone
   

   c. Create the same zone and zone-policy combination in the other direction:

   set firewall name myzone-wireguard0 rule 700 protocol icmp
   set firewall name myzone-wireguard0 rule 700 state new enable
   set firewall name myzone-wireguard0 rule 700 action accept
   set zone-policy zone wireguard0 from myzone firewall name myzone-wireguard0