Firewall
Attention
Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos installations.
Note
The legacy and zone-based firewall configuration options is not longer supported. They are here for reference purposes only.
Netfilter based
With VyOS being based on top of Linux and its kernel, the Netfilter project created the iptables and now the successor nftables for the Linux kernel to work directly on the data flows. This now extends the concept of zone-based security to allow for manipulating the data at multiple stages once accepted by the network interface and the driver before being handed off to the destination (e.g. a web server OR another device).
To configure VyOS with the new firewall configuration
The only stages VyOS will process as part of the firewall configuration is the forward (F4 stage), input (L4 stage), and output (L5 stage). All the other stages and steps are for reference and cant be manipulated through VyOS.
In this example image, a simplifed traffic flow is shown to help provide context to the terms of forward, input, and output for the new firewall CLI format.
Note
For more information of Netfilter hooks and Linux networking packet flows can be found in Netfilter-Hooks
Legacy Firewall
Traditionally firewalls weere configured with the concept of data going in and out of an interface. The router just listened to the data flowing through and responding as required if it was directed at the router itself.
To configure VyOS with the legacy firewall configuration
As the example image below shows, the device was configured with rules blocking inbound or outbound traffic on each interface.
Zone-based firewall
With zone-based firewalls a new concept was implemented, in addtion to the standard in and out traffic flows, a local flow was added. This local was for traffic originating and destined to the router itself. Which means additional rules were required to secure the firewall itself from the network, in addition to the existing inbound and outbound rules from the traditional concept above.
To configure VyOS with the zone-based firewall configuration
As the example image below shows, the device now needs rules to allow/block traffic to or from the services running on the device that have open connections on that interface.
