unsealed counsel
17 Jan 2022

VyOS interface firewall zone setup checklist

Adding a new interface to an existing VyOS instance will typically require adding firewall rules for that interface. Here's a checklist:

  1. Assign the interface (wg0 in this example) to a zone:

    set zone-policy zone wireguard0 interface wg0
    

    Avoid using the same name for the zone as the interface itself. It will save you some minor grief with grep in the future. In a zone-based firewall, you will often use a zone that handles multiple interfaces.

  2. If creating a new zone:

    a. For each zone that can accept traffic from the new interface, create a new firewall:

    set firewall name wireguard0-myzone rule 22 action accept
    set firewall name wireguard0-myzone rule 22 description allow_ssh_in
    set firewall name wireguard0-myzone rule 22 destination port 22
    set firewall name wireguard0-myzone rule 22 protocol tcp
    set firewall name wireguard0-myzone rule 22 log enable
    

    b. Set the zone-policy for each new interface pair:

    set zone-policy zone myzone from wireguard0 firewall name wireguard0-myzone
    

    c. Create the same zone and zone-policy combination in the other direction:

    set firewall name myzone-wireguard0 rule 700 protocol icmp
    set firewall name myzone-wireguard0 rule 700 state new enable
    set firewall name myzone-wireguard0 rule 700 action accept
    set zone-policy zone wireguard0 from myzone firewall name myzone-wireguard0
    
Tags: vyos firewall checklist
Creative Commons License
runes.lexarcana.com by Ravi R Kiran is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License .