VyOS est un système d’exploitation de routeur et firewall opensource. Vous trouverez leur site ici. On le retrouve dans les clouds AWS, Azure… et bien évidemment sur KVM. Très pratique, avec OpenVSwitch, il fait partie des petits blocs d’infra qui vous font économiser beaucoup d’heures de recherche et d’argent… Il s’interconnecte avec par exemple une “Azure VNet Gateway”, Wireguard, GRE, BGP over IKEv2/IPsec. L’OS consomme moins de 512M de RAM et prend quelques centaines de Mo de place en stockage.

Installation de l’OS

On va chercher la bonne image sur la bonne page du site de l’éditeur. Je suis sympa, je vous mets l’url. Dans mon infra de test KVM/libvirt, j’ai un switch virtuel (OpenVSwitch) sur une IP WAN (ext-br-network) et un réseau isolé (internal). On va créer une nouvelle VM dans libvirt :

virt-install -n vyos_r1 \
   --ram 4096 \
   --vcpus 2 \
   --cdrom /var/lib/libvirt/images/vyos-1.3-rolling-202012041912-amd64.iso \
   --os-type linux \
   --os-variant debian10 \
   --network network=ext-br-network,model=virtio \ # c'est un réseau sur mon OpenVSwitch sur le WAN 
   --network network=internal,model=virtio \ # c'est un réseau isolé
   --graphics vnc,port=5999 \
   --hvm \
   --virt-type kvm \
   --disk path=/var/lib/libvirt/images/vyos_r1.qcow2,bus=virtio,size=8 \
   --noautoconsole

On entre dans l’OS, on change les locales et on installe l’OS (ou pas, dans ce cas il est chargé en ram et il faut créer une image avec les scripts de configuration)

sudo loadkeys fr
sudo dpkg-reconfigure keyboard-configuration
install image

Configuration simple avec deux cartes réseau

configure
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 address '192.168.200.254/24'
set service ssh port '22' # à partir de là le routeur est accessible en ssh, donc la conf peut-être terminée via SSH, Ansible
set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.200.0/24'
set nat source rule 100 translation address masquerade
commit
save
exit

show interface
ping 8.8.8.8 interface 192.168.1.80 (en fonction)
ping 8.8.8.8 interface 192.168.200.254

Configuration du DHCP si besoin

set service dhcp-server disabled 'false' # version <~ 1.1.8
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 start '192.168.200.10' stop '192.168.200.253' # version <~ 1.1.8
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'

On configure le DNS forwarding

set service dns forwarding cache-size '0'
#set service dns forwarding listen-on 'eth1' # version <~ 1.1.8
set service dns forwarding listen-address '192.168.200.254'
set service dns forwarding allow-from '192.168.200.0/24'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'

Voilà, à ce niveau le routeur est fonctionnel !

Mise en place des firewalls

set firewall name OUTSIDE-IN default-action 'drop'
set firewall name OUTSIDE-IN rule 10 action 'accept'
set firewall name OUTSIDE-IN rule 10 state established 'enable'
set firewall name OUTSIDE-IN rule 10 state related 'enable'

set firewall name OUTSIDE-LOCAL default-action 'drop'
set firewall name OUTSIDE-LOCAL rule 10 action 'accept'
set firewall name OUTSIDE-LOCAL rule 10 state established 'enable'
set firewall name OUTSIDE-LOCAL rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL rule 20 action 'accept'
set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request'
set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp'
set firewall name OUTSIDE-LOCAL rule 20 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 30 action 'drop'
set firewall name OUTSIDE-LOCAL rule 30 destination port '22'
set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 30 recent count '4'
set firewall name OUTSIDE-LOCAL rule 30 recent time '60'
set firewall name OUTSIDE-LOCAL rule 30 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 31 action 'accept'
set firewall name OUTSIDE-LOCAL rule 31 destination port '22'
set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 31 state new 'enable'

et on applique la configuration à la carte réseau :

set interfaces ethernet eth0 firewall in name 'OUTSIDE-IN'
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'

Automatisation

On peut exécuter un script pour automatiser la configuration, il doit être appelé par le groupe vyattacfg avec la commande switch group sg, ce qui donne :

sg vyattacfg -c ./conf-network.sh

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 address '192.168.200.254/24'
set service ssh port '22'
set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.200.0/24'
set nat source rule 100 translation address masquerade
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'
set service dns forwarding cache-size '0'
set service dns forwarding listen-address '192.168.200.254'
set service dns forwarding allow-from '192.168.200.0/24'
set service dns forwarding name-server '8.8.8.8'
commit
save
exit

Autre solution “maison”, un vieux script des familles qui permet de tout faire depuis l’hyperviseur :

#!/bin/bash
name="vyos_r1"
user="vyos"
password="vyos"
dns_ip="192.168.1.34"

function main() {
  launch
  sleep 40
  install
  sleep 10
  config
}

function launch() {
  sudo virt-install -n $name \
   --ram 4096 \
   --vcpus 2 \
   --cdrom /var/lib/libvirt/images/vyos-1.3-rolling-202012041912-amd64.iso \
   --os-type linux \
   --os-variant debian10 \
   --network network=ext-br-network,model=virtio \
   --network network=internal,model=virtio \
   --graphics vnc,port=5999 \
   --hvm \
   --virt-type kvm \
   --disk path=/var/lib/libvirt/images/$name.qcow2,bus=virtio,size=8 \
   --noautoconsole
}

function install() {
  sudo expect <<EOF
  set timeout 600
  spawn virsh console $name
  expect "Escape character is ^] (Ctrl + ])" {send "\n"}
  expect "vyos login:" {send "$user\r"}
  expect "Password:" {send "$password\r"}
  expect "vyos:~" {send "install image\r"}   expect "Would you like to continue? (Yes/No): " {send "Yes\n"}
  expect "Partition (Auto/Parted/Skip):" {send "Auto\n"}   expect "Install the image on?:" {send "\n"}
  expect "Continue? (Yes/No):" {send "Yes\n"}   expect "How big of a root partition should I create? (2000MB - 8589MB):" {send "8589MB\n"}
  expect "What would you like to name this image?:" {send "\n"}   expect "Which one should I copy to vda?:" {send "\n"}
  expect "Enter password for user 'vyos':" {send "$password\n"}
  expect "Retype password for user 'vyos':" {send "$password\n"}
  expect "Which drive should GRUB modify the boot partition on?:" {send "\n"}   expect "vyos:~" {send "sudo reboot\r"}
  expect "Are you sure you want to reboot this system?" {send "Yes\r"}
EOF
}

function config() {
  sudo virsh start $name
  sleep 50
  sudo expect <<EOF
  set timeout 600
  spawn virsh console $name
  expect "Escape character is ^] (Ctrl + ])" {send "\n"}
  expect "vyos login:" {send "$user\r"}
  expect "Password:" {send "$password\r"}
  send "sudo loadkeys fr\r"
  send "configure\r"
  send "set interfaces ethernet eth0 address dhcp\r"
  send "set interfaces ethernet eth1 address '192.168.200.254/24'\r"
  send "set service ssh port '22'\r"
  send "set nat source rule 100 outbound-interface 'eth0'\r"
  send "set nat source rule 100 source address '192.168.200.0/24'\r"
  send "set nat source rule 100 translation address masquerade\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'\r"
  send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'\r"
  send "set service dns forwarding cache-size '0'\r"
  send "set service dns forwarding listen-address '192.168.200.254'\r"
  send "set service dns forwarding allow-from '192.168.200.0/24'\r"
  send "set service dns forwarding name-server '$dns_ip'\r"
  send "commit\r"
  send "save\r"
  send "exit\r"
EOF
}
main
exit 0

Et voilà, un routeur fonctionnel avec un seul script… Pensez à modifier ce script pour durcir la sécurité d’accès au routeur en changeant le second mot de passe et en modifiant la config ssh pour accepter les clés. Je mets le lien vers les blueprints de VyOS (notamment dans des environnements Cloud) :

https://docs.vyos.io/en/latest/configexamples/index.html

@+