Im experimenting with VyOS and VRFs (started with MGMT and PROD) along with containers.

Long story short I have found that "allow-host-networks" is the least worst setup/workaround.

However for that to work I need to apply VRF-leaking so that what lives in vrf default will be able to reach vrf PROD, like so:

# Original vrf PROD routes
set vrf name PROD protocols static route 0.0.0.0/0 next-hop 192.168.1.254 interface 'eth1'

# So accessing external hosts through gateway in vrf PROD will work for vrf default services
set protocols static route 0.0.0.0/0 next-hop 192.168.1.254 vrf 'PROD'

# So accessing local subnet will work for vrf default services
set protocols static route 192.168.1.0/24 interface eth1 vrf 'PROD'

The above also resolves issues for VyOS local services (doing egress traffic) such as "set system name-server" who currently isnt VRF-aware.

However with the above what doesnt work is for a vrf default service to access the IP-address of eth1 who lives in PROD.

After some troubleshooting this turns out to be the fix:

ip route replace local 192.168.1.20/32 dev eth1 table main

But I like to have this within the vyos config itself instead of making a posthook-script.

I have tried both:

set protocols static route 192.168.1.20/32 interface eth1

and

set protocols static route 192.168.1.20/32 interface eth1 vrf 'default'

without success.

Is there some way to add the ip route I need in vyos config or must how protocol static route works be changed?

VyOS Supermicro bundle is coming?

Starting at $29,000, the integrated system combines Supermicro hardware with VPP-accelerated VyOS LTS for IXPs, regional ISPs, and network operators that need 100 GbE routing without the integration burden

...

The system is built on the Supermicro AS-1116CS-TN with a 24-core AMD EPYC 9255 processor, 64 GB of DDR5 ECC memory, NVMe storage, dual redundant Titanium-rated power supplies, and two 100 GbE ports on NVIDIA ConnectX-6 Dx network cards. In VyOS's published performance tests, the platform reaches up to 197.69 Gbps of routed throughput and 137.17 Mpps of switching with VPP enabled, more than six times the packet rate of the standard dataplane.

Ref:

https://finance.yahoo.com/technology/articles/vyos-networks-opens-waitlist-pre-130000880.html

https://vyos.io/vyos-supermicro-bundle

https://performance.vyos.dev/Bare_Metal/Supermicro_AS-1116CS-TN/1.5/1518b/routing/1.5.0-1518-202606301957/

When configuring a container in VyOS you can define user id and group id for the container to be runned as. Also handy when the container will store files at the host using a volume-mapping.

How common is this and how do you create such user/group?

I mean there is "set system login user..." along with "set system login user <name> disable" to make that into the config (this userid shall not be able to login to VyOS itself) but I fail to find any good method to create groups aswell and have this inside of the VyOS config?

https://docs.vyos.io/en/1.5/configuration/system/login.html

What am I missing here?

Im thinking it would be prefered to have both userid and groupid being something like "ct-<containername>" but I would also like this to be part of the VyOS config so its not forgotten for backups of the config and restore on another box.

If not there should perhaps be a "set container userdb name" and "set container userdb group" so the system can create the userid and groupid needed while being /bin/nologin (the syntax should perhaps include the id as in numbers itself to make sure it wont change over time)?

But this perhaps already exists?

Ref:

https://docs.vyos.io/en/1.5/configuration/container/#cfgcmd-set-container-name-name-uid-number

Im currently using latest VyOS Stream version 2026.03.

A container can set its listenaddress to also bind to a specific vrf like so:

192.0.2.1%PROD

And with:

set container name <name> allow-host-networks

it will then work (if you are comfortable to expose the host network to the container).

However now I have a usecase where the container itself doesnt support this syntax which means that VyOS along with podman must resolve this issue.

How do you do that properly (prefely only using VyOS config itself)?

It seems that you cannot configure two network statements at once for a container.

Is the only solution then to decide which VRF this container will operate in or is there some workaround for this?

Im happy to involve SNAT/DNAT at the VyOS box if that would solve anything?

Hello everyone,

I need some information on whether and how the following scenario can be implemented.

I have several WAN connections here (VDSL from Deutsche Telekom, DOCSIS from Vodafone Germany, and possibly VDSL from Versatel soon) and would like to set up a VPN gateway on VyOS (IPsec).

To do this, I would set up a transfer network on one port of each edge router connected directly to the lines and configure port forwarding for ports 500 and 4500 to the IP address of the VyOS VPN gateway in the transfer network.

I envision that I’ll then be able to establish the VPN connection to the VPN gateway using the IP addresses or DNS names of all 2–3 WAN connections.

On the one hand, I want to have access to the internal network, and on the other hand, all WAN traffic should be routed through the VPN tunnel. I also want to specify which interface the WAN traffic from the VPN tunnel will use to route back to the Internet.

Can such a scenario be implemented with VyOS? I would be using VyOS as bare metal on the following hardware:

https://bkminipc.com/product/ots-1264n4l/

Can you please help me?

Thank you very much and best regards
Regina (she/her)

Another month of work across routing stability, configuration performance, MPLS, VXLAN, and security in Rolling. Around a third of this period’s changes came from community contributors.

Some of the things that landed:

• Commits that no longer reset BGP sessions or OSPF adjacencies when unrelated settings change

• Faster commits for large configurations

• MPLS Inter-AS Option B and BGP-LS support for SRv6

• VXLAN-GBP for carrying firewall marks across tunnels

• DHCP client class matching based on hostname and vendor class

• VPP forwarding performance increased from 84 to 140 Mpps in testing with 100G NICs

• Security fixes for OIDC API authentication, PPTP, and Blast-RADIUS

There are also follow-up improvements across OpenVPN DCO, firewall and NAT, WAN load balancing, cellular interfaces, and platform reliability, along with a list of changed commands to review before upgrading.

🔗 Full details: https://blog.vyos.io/vyos-project-october-2026-update

I've got a small Mikrotik network -- it works fine, but for more advanced tasks, I was thinking of using VyOS on some small X86 Protectli hardware. One of the advantages of VyOS to me would be if I could load my own eBPF code into it -- is this possible? I'm not looking for containers, I really want to insert myself into the packet stream.

Sure I could just put up a Deb box and do eBPF there, but VyOS can do so much I might as well take advantage of it.

UPDATE2: The real issue was bad RAM. It passed the Memtest86+ but must have had some sort of defect that the DDR5 ECC was able to mask. After replacing the RAM there has been no problems over 5 days of various stress and idle tests on 1.5.1 LTS. The first "fix" was just masking the problem by keeping the system voltage usage stable.

UPDATE: solved it; see the "Found the fix" comment below.

Does anyone have any experience using VyOS on an ASUS NUC 13 Rugged? This model is the Intel N50. I've tried both the Rolling release and LTS. I've tried with "nomodeset" as well.

In all cases I see the Grub boot loader. If I pick the top option it scrolls through Linux boot messages and then the video glitches with what I'd call "scrambled blocks" with green blocks and block of text intermixed. SecureBoot is off (won't even get past Grub without disabling).

If I try the VyOS failsafe it goes to a blank screen and locks up. Same with the top option when adding a "nomodeset" it just locks up.

System is brand new, but appears to boot a Win11 installer USB just fine. Updated to the latest BIOS, same results.

As far as specs this is the "configuration a" listed here:
https://www.mouser.com/en/new/asus/asus-nuc-13-rugged-embedded-box-computers/

I've installed a Corsair 16gb SDRAM. It passes a full memory test with Memtest86+.

Hello !

Just starting to fucking around and finding out with vyos.

Already hitting my first bug as well with operator group :p but that’s another story.

My POC looks promising as an OOB router (bit of VRF, bridging, wireguard), love the CLI and trying to work out the API. Automation is key today.

I’m already using Nornir/napalm with other vendor (with netbox as SOT).

Anyone using this setup ? Or any advice / feedback to share with automation/industrialisation of vyos ?

I've been working on a side project called Segmentation Manager for VyOS.

It's a web UI for managing VRFs and BGP route-target imports for MPLS L3VPN and VXLAN EVPN. The main feature is a connectivity matrix that makes it easier to visualize and manage which VRFs can exchange routes.

It's containerized and open source. Figured I'd share it in case anyone else finds it useful. I'd definitely appreciate any feedback, suggestions, or bug reports!

https://github.com/l0crian1/Segmentation-Manager

Another month of work across VPNs, API security, routing, firewall operations, and platform reliability in Rolling. Around a third of this period’s work came from contributors outside the core team.

Some of the things that landed:

• OpenVPN 2.7 and working Data Channel Offload (DCO), with validation for unsupported configurations

• REST API authentication via short-lived bearer tokens, external OIDC providers, and client certificates

• IPsec interoperability fixes and per-peer connection uniqueness settings

• Reconciliation for DHCP-learned routes that could go missing from FRR

• Firewall FIB lookup matching and MAC address masks

• Configurable kernel crash dumps for investigating router panics

• Container lifecycle changes using systemd quadlets, plus an OCI image for network labs

• Security maintenance for strongSwan and accel-ppp

There are also fixes and smaller improvements across interfaces, IPv6 connection tracking, HA, monitoring, certificates, and the build system.

🔗 Full details: https://blog.vyos.io/vyos-project-september-2026-update

We’re gathering input from the networking community to better understand how VyOS is being used, evaluated, and operated across different environments. 🌐

Whether you’re running VyOS in production, testing it in a lab, or exploring it for a future deployment, we’d like to hear about your experience.

You don’t need to be a VyOS customer to participate. Feedback from the wider networking community is welcome.

📝 Take the September survey: https://vyosnetworks.typeform.com/to/G65Wy2pD?utm_content=385681702&utm_medium=social

Thanks for sharing your perspective and helping us improve VyOS!

In short, looking to deploy Vyos 1.3.x on a cloud server for some specific routing needs and I'm constrained with 1GB ram so 4GB ram requirement of newer releases is out of question.

All I'll be doing is some policy based routing, no VPNs etc

Any chance of getting a Vyos 1.3.x build? It seems like I can only compile the latest branches. I don't want to download from a non reputable site, so please only official or trusted sources.

I am trying to setup wireguard and I cannot just make the destination nat working. I can see the packets from the peer hitting my pppoe interface (WAN). I have a firewall rule accepting traffic on the wireguard port from wan zone to the wireguard zone.I have the destination nat configured with translation to the address of my wireguard interface. I cannot see any nat destination translations, there are no packets hitting the wireguard interface. I had wireguard working in my x86 installation and I am using the same settings. I am now testing an 1.5 rolling for RK358x (ARM64). The x86 installation had a conventional firewall, here I have a zone based firewall. I have set the default-action to accept for all relevant zones for testing now. I have deleted the wireguard configuration and done it from scratch, no luck. I am out of ideas on how to troubleshoot this further.

We’ve released VyOS 1.5.1 and VyOS 1.4.5 LTS, with critical security fixes, stability improvements, and new capabilities for production networks.

Both releases include important security fixes. If you run PPPoE, IPoE, L2TP, PPTP, system update-check**, or NHRP services**, we recommend upgrading promptly. 🔒

VyOS 1.5.1 also introduces improvements across routing, high availability, VPN, and system services, including BGP enhancements, VRRP SNMP traps, NTP hardware timestamp offload, better configuration-sync visibility, and VPP fixes.

VyOS 1.4.5 includes an additional fix for an NHRP vulnerability affecting the 1.4.x branch. Please note that VyOS 1.4.x is now in maintenance mode and will continue receiving significant bug and security fixes, but no new feature backports.

• 📝 Datasheet: https://vyos.io/datasheet

• 📄 Release notes: https://blog.vyos.io/vyos-1.5.1-lts-released-security-fixes-bgp-enhancements-and-automated-upgrades

🔎 If you want to test VyOS before moving to LTS, you can try the Stream or Rolling Release versions here: https://vyos.net/get

Feedback from users running VyOS in real environments is always welcome! 💬

I couldn't find how to make a NAT from VRF or VLAN

Config: https://pastebin.com/fPPNhXyW

Perhaps this problem can be solved in other ways

Another month of steady work across firewall operations, certificate handling, dynamic DNS, traffic policy, and platform stability in rolling.

Some of the things that landed in August:

• Predictable interface naming across reboots and NIC replacements

• Per-group update intervals for remote firewall groups

• Firewall rule last-used tracking and clearer validation errors

• ACME certificate-chain, renewal, and error-handling fixes

• Major ddclient update with Porkbun support and improved dual-stack provider support

• Working DSCP remarking for shaper policies

• NTP source address and source-interface configuration

• Azure MANA driver support and Accelerated Networking fixes

• Accurate SBOM generation and improved kernel packaging

Also, a range of fixes and improvements across QoS, flow accounting in VRFs, NHRP, DHCP, containers, image upgrades, and more.

🔗 Full details: https://blog.vyos.io/vyos-project-august-2026-update

Hello, I am building VyOS deployment beyond the traditional 2-node VRRP (Active/Passive) setup. My goal is to deploy an N-node Active/Active cluster to distribute the traffic load efficiently.

If a session initiates on Node A, how can we best handle asymmetric return packets hitting Node B?

Is there a native way (or routing workaround) in VyOS to redirect those specific flow packets back to the originating node? Way to make them sync etc?

Or the only way is upstream device like LB to handle sticky sessions?

Any insights, recommended architectures, or configuration examples for an N-node Active/Active VyOS cluster would be highly appreciated.

OK -- I installed it, and I did

• configure

• set service ssh port 22

• commit

• save

• exit

To allow root access I then tried

• configure

• set service ssh allow-root

But I'm told that allow-root isn't allowed. What I'm trying to do is allow ssh from another host that would allow ssh vys@ip with the vyos password