VyOS¶
Mit Podman bauen¶
Ich habe mit dem Root-Benutzer und ausreichend Festplattenplatz gebaut
Um rolling oder 1.4 Sagitta zu bauen
podman pull docker.io/vyos/vyos-build:current # oder :sagitta für Sagitta
git clone -b current --single-branch https://github.com/vyos/vyos-build # oder -b sagitta für Sagitta
cd vyos-build
podman run --rm -it --privileged --net host -v $(pwd):/vyos -w /vyos vyos/vyos-build:current bash
./build-vyos-image --architecture amd64 --build-by "jochen@winteltosh.de" generic
exit
Anmelden mit
Installation über
Installation¶
Basis-Firewall mit¶
- Upstream-Interface eth0 DHCP/DHCPv6
- Downstream-Interface eth1 statische IP
- IPv4-Masquerading
- IPv6-Routing
Erste Schritte¶
Verfügbare Interfaces anzeigen
Konfigurationsmodus betreten ttyS0 aus Konfiguration entfernen, wenn in einer VM ausgeführt Standard-Tastaturlayout auf Deutsch ändern Hostname und Domäne setzen DNS-Server und Suchpfad konfigurieren Pre-Login-Banner konfigurierenset system login banner pre-login "This is a system with restricted access. If you are not authorized, leave now. Contravention will be prosecuted."
set service ntp server 2.de.pool.ntp.org
set service ntp server 2.nl.pool.ntp.org
delete service ntp server time1.vyos.net
delete service ntp server time2.vyos.net
delete service ntp server time3.vyos.net
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 address dhcpv6
set interfaces ethernet eth0 ipv6 address autoconf
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 address '100'
set interfaces ethernet eth0 description 'UPSTREAM'
set interfaces ethernet eth1 address '192.168.0.1/24'
set interfaces ethernet eth1 description 'DOWNSTREAM'
Downstream-Interface über Prefix Delegation konfigurieren eth0 ist das WAN-Interface und eth1.102 das Downstream-Interface, wobei 0 der Netzwerkpräfix ist, der an den vom Upstream erhaltenen Präfix angepasst wird.
VLAN-Interface konfigurieren
Router Advertisement konfigurieren
set service router-advert interface eth1
set service router-advert interface eth1 name-server 2001:4dd0:100:1020:53:2:0:2
set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 default-router '192.168.0.1'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 name-server '192.168.0.1'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 domain-name 'demo.junicast.de'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 start 192.168.0.9
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 stop '192.168.0.254'
set service dns forwarding cache-size '0'
set service dns forwarding listen-address '192.168.0.1'
set service dns forwarding allow-from '192.168.0.0/24'
set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address masquerade
set firewall name OUTSIDE-IN default-action 'drop'
set firewall name OUTSIDE-IN rule 10 action 'accept'
set firewall name OUTSIDE-IN rule 10 state established 'enable'
set firewall name OUTSIDE-IN rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL default-action 'drop'
set firewall name OUTSIDE-LOCAL rule 10 action 'accept'
set firewall name OUTSIDE-LOCAL rule 10 state established 'enable'
set firewall name OUTSIDE-LOCAL rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL rule 20 action 'accept'
set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request'
set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp'
set firewall name OUTSIDE-LOCAL rule 20 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 30 action 'drop'
set firewall name OUTSIDE-LOCAL rule 30 destination port '22'
set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 30 recent count '4'
set firewall name OUTSIDE-LOCAL rule 30 recent time 'minute'
set firewall name OUTSIDE-LOCAL rule 30 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 31 action 'accept'
set firewall name OUTSIDE-LOCAL rule 31 destination port '22'
set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 31 state new 'enable'
set interfaces ethernet eth0 firewall in name 'OUTSIDE-IN'
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'
SSH aktivieren
ntopng für Monitoring einrichten
allow-host-networks
arguments "-i eth0"
cap-add net-admin
cap-add setpcap
cap-add sys-admin
cap-add net-raw
description ntop-ng
image ntop/ntopng:stable
port ntopdefault {
destination 3000
protocol tcp
source 3000
}
restart always
API aktivieren
Für nächsten Neustart speichern
Konfigurationsmodus beendenVyOS-Release mit Podman bauen¶
Image herunterladen
Daten per Git abrufen In das Git-Repo-Verzeichnis wechseln Container aus dem Image starten und Bash im aktuellen Verzeichnis (vyos-build) ausführen Konfigurieren und bauenVyOS aktualisieren¶
Siehe auch hier Wenn eine neuere Version von VyOS gebaut wurde, kann wie folgt aktualisiert werden. Neues Image von HTTPS abrufen
Mit ja bestätigen Imagenamen wählen Konfiguration beibehaltenWould you like to save the current configuration
directory and config file? (Yes/No) [Yes]:
Would you like to save the SSH host keys from your
current configuration? (Yes/No) [Yes]: