Upstream packages

Many base system packages are pulled straight from Debian’s main and contrib repositories, but there are exceptions.


Due to issues in the upstream version that sometimes set interfaces down, a modified version is used.

The source is located at

In the future, we may switch to using systemd infrastructure instead. Building it doesn’t require a special procedure.


Keepalived normally isn’t updated to newer feature releases between Debian versions, so we are building it from source.

Debian does keep their package in git, but it’s upstream tarball imported into git without its original commit history. To be able to merge new tags in, we keep a fork of the upstream repository with packaging files imported from Debian at


Our StrongSWAN build differs from the upstream:

  • strongswan-nm package build is disabled since we don’t use NetworkManager
  • Patches for DMVPN are merged in

The source is at

DMVPN patches are added by this commit:

Our op mode scripts use the python-vici module, which is not included in Debian’s build, and isn’t quite easy to integrate in that build. For this reason we debianize that module by hand now, using this procedure:

  1. Install
  2. cd vyos-strongswan
  3. ./configure –enable-python-eggs
  4. cd src/libcharon/plugins/vici/python
  5. make
  6. python3 –command-packages=stdeb.command bdist_deb

The package ends up in deb_dist dir.


Properly renaming PPTP and L2TP interfaces to pptpX and l2tpX from generic and non-informative pppX requires a patch that is neither in the upstream nor in Debian.

We keep a fork of Debian’s repo at

The patches for pre-up renaming are:

Additionally, there’s a patch for reopening the log file to better support logging to files, even though it’s less essential:

The patches were written by Stephen Hemminger back in the Vyatta times.


This package doesn’t exist in Debian. A debianized fork is kept at

No special build procedure is required.


This package doesn’t exist in Debian. A debianized fork is kept at

No special build procedure is required.

Linux kernel

In the past a fork of the Kernel source code was kept at the well-known location of - where it is kept for history.

Nowadays the Kernel we use is the upstream source code which is patched with two additional patches from the good old Vyatta times which never made it into the mainstream Kernel. The patches can be found here: and are automatically applied to the Kernel by the Jenkins Pipeline which is used to generate the Kernel binaries.

The Pipeline script not only builds the Kernel with the configuration named x86_64_vyos_defconfig which is located in the vyos-build-kernel repository, too - but in addition also builds some Intel out-of-tree drivers, WireGuard (as long it is not upstreamed) and Accel-PPP.

The Jenkinsfile tries to be as verbose as possible on each individual build step.

Linux firmware

More and more hardware cards require an additional firmware which is not open source. The Kernel community hosts a special linux-firmware Git repository with all available binary files which can be loaded by the Kernel.

The vyos-build repository fetches a specific commit of the linux-firmware repository and embeds those binaries into the resulting ISO image. This step is done in the data/live-build-config/hooks/live/40-linux-firmware.chroot file.

If the firmware needs to be updated it is sufficient to just exchange the Git commit id we reference in our build.

Intel drivers

Are build as part of the Kernel Pipeline - read above.


Accel-PPP used to be an upstream fork for quiet some time but now has been converted to make use of the upstream source code and build system.

It is build as part of the Kernel Pipeline - read above.


A fork with packaging changes for VyOS is kept at

The original repo is at

It’s an Ada program and requires GNAT and gprbuild for building, dependencies are properly specified so just follow debuild’s suggestions.

Per-file modifications

vyos-replace package replaces the upstream dhclient-script with a modified version that is aware of the VyOS config.