About VyOS

A stateful firewall that leverage Linux Netfilter for packet filtering.

Supports both zone-based and interface-based policies.

Stateful Firewall

Download

  1. Download free .iso file from VyOS from the link below

    https://vyos.net/get/

    Go to rolling release page and download the latest one (this release is free)

Create VM

  1. In VirtualBox, create new VM with:

    <aside>

    General

    OS: Linux

    OS Version: Oracle Linux (64-bit)

    System

    Base Memory: 1GB (1024MB)

    Boot Device Order: Enable Optical and Hard Disk

    Display

    Video Memory: 16MB

    CPU: 1

    Storage

    Controller IDE: Click Empty and choose the .iso file for Optical Device

    Network

    Attacked to: Host-only Adapter

    </aside>

VM Setting

  1. Start the VM

    Follow steps of this link : https://changineer.info/network/vyatta/vyatta_os_install.html (JP)

    Some configuration steps aren’t mentioned in the article

    Here’s my configuration

    <aside>

    Name of image (mentioned but changed)

    → Changed to VyOS

    </aside>

    <aside>

    What kind of console?

    → Select KVA

    (KVA: When you’re using physical monitor and keyboard)

    (Serial: When you’re connection via serial console port)

    </aside>

Setups

  1. Setup firewall

    <aside>

    1. Basic setup
      • Configure interfaces (eth0 = WAN, eth1 = LAN).
    2. Firewall rules
      • Default deny inbound on WAN.
      • Allow outbound from LAN.
      • Allow SSH only from LAN.
    3. Stateful behavior
      • Test with ping, curl, nmap from attacker side.
      • Watch how “established” connections return, while unsolicited traffic dies.
    4. Segmentation (next step)
      • Add a “DMZ” (Metasploitable2/OWASP BWA).
      • Write rules: LAN ↔ DMZ allowed, WAN ↔ DMZ restricted. </aside>

Configs

# Create group
set firewall group interface-group WAN interface eth0
set firewall group interface-group LAN interface eth1
****set firewall group interface-group DMZ interface eth2

# WAN -> LAN
set firewall ipv4 name WAN-IN default-action drop

set firewall ipv4 name WAN-IN rule 10 action accept
set firewall ipv4 name WAN-IN rule 10 state established
set firewall ipv4 name WAN-IN rule 10 state related

set firewall ipv4 forward filter rule 10 action jump
set firewall ipv4 forward filter rule 10 jump-target WAN-IN

set firewall ipv4 input filter rule 10 action jump
set firewall ipv4 input filter rule 10 jump-target WAN-IN