Installation de VyOS sur KVM/Qemu
VyOS est un système d’exploitation de routeur et firewall opensource. Vous trouverez leur site ici. On le retrouve dans les clouds AWS, Azure… et bien évidemment sur KVM. Très pratique, avec OpenVSwitch, il fait partie des petits blocs d’infra qui vous font économiser beaucoup d’heures de recherche et d’argent… Il s’interconnecte avec par exemple une “Azure VNet Gateway”, Wireguard, GRE, BGP over IKEv2/IPsec. L’OS consomme moins de 512M de RAM et prend quelques centaines de Mo de place en stockage.
Installation de l’OS
On va chercher la bonne image sur la bonne page du site de l’éditeur. Je suis sympa, je vous mets l’url. Dans mon infra de test KVM/libvirt, j’ai un switch virtuel (OpenVSwitch) sur une IP WAN (ext-br-network) et un réseau isolé (internal). On va créer une nouvelle VM dans libvirt :
virt-install -n vyos_r1 \
--ram 4096 \
--vcpus 2 \
--cdrom /var/lib/libvirt/images/vyos-1.3-rolling-202012041912-amd64.iso \
--os-type linux \
--os-variant debian10 \
--network network=ext-br-network,model=virtio \ # c'est un réseau sur mon OpenVSwitch sur le WAN
--network network=internal,model=virtio \ # c'est un réseau isolé
--graphics vnc,port=5999 \
--hvm \
--virt-type kvm \
--disk path=/var/lib/libvirt/images/vyos_r1.qcow2,bus=virtio,size=8 \
--noautoconsoleOn entre dans l’OS, on change les locales et on installe l’OS (ou pas, dans ce cas il est chargé en ram et il faut créer une image avec les scripts de configuration)
sudo loadkeys fr
sudo dpkg-reconfigure keyboard-configuration
install imageConfiguration simple avec deux cartes réseau
configure
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 address '192.168.200.254/24'
set service ssh port '22' # à partir de là le routeur est accessible en ssh, donc la conf peut-être terminée via SSH, Ansible
set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.200.0/24'
set nat source rule 100 translation address masquerade
commit
save
exit
show interface
ping 8.8.8.8 interface 192.168.1.80 (en fonction)
ping 8.8.8.8 interface 192.168.200.254Configuration du DHCP si besoin
set service dhcp-server disabled 'false' # version <~ 1.1.8
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 start '192.168.200.10' stop '192.168.200.253' # version <~ 1.1.8
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'On configure le DNS forwarding
set service dns forwarding cache-size '0'
#set service dns forwarding listen-on 'eth1' # version <~ 1.1.8
set service dns forwarding listen-address '192.168.200.254'
set service dns forwarding allow-from '192.168.200.0/24'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'Voilà, à ce niveau le routeur est fonctionnel !
Mise en place des firewalls
set firewall name OUTSIDE-IN default-action 'drop'
set firewall name OUTSIDE-IN rule 10 action 'accept'
set firewall name OUTSIDE-IN rule 10 state established 'enable'
set firewall name OUTSIDE-IN rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL default-action 'drop'
set firewall name OUTSIDE-LOCAL rule 10 action 'accept'
set firewall name OUTSIDE-LOCAL rule 10 state established 'enable'
set firewall name OUTSIDE-LOCAL rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL rule 20 action 'accept'
set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request'
set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp'
set firewall name OUTSIDE-LOCAL rule 20 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 30 action 'drop'
set firewall name OUTSIDE-LOCAL rule 30 destination port '22'
set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 30 recent count '4'
set firewall name OUTSIDE-LOCAL rule 30 recent time '60'
set firewall name OUTSIDE-LOCAL rule 30 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 31 action 'accept'
set firewall name OUTSIDE-LOCAL rule 31 destination port '22'
set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 31 state new 'enable'et on applique la configuration à la carte réseau :
set interfaces ethernet eth0 firewall in name 'OUTSIDE-IN'
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'Automatisation
On peut exécuter un script pour automatiser la configuration, il doit être appelé par le groupe vyattacfg avec la commande switch group sg, ce qui donne :
sg vyattacfg -c ./conf-network.sh
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 address '192.168.200.254/24'
set service ssh port '22'
set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.200.0/24'
set nat source rule 100 translation address masquerade
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'
set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'
set service dns forwarding cache-size '0'
set service dns forwarding listen-address '192.168.200.254'
set service dns forwarding allow-from '192.168.200.0/24'
set service dns forwarding name-server '8.8.8.8'
commit
save
exitAutre solution “maison”, un vieux script des familles qui permet de tout faire depuis l’hyperviseur :
#!/bin/bash
name="vyos_r1"
user="vyos"
password="vyos"
dns_ip="192.168.1.34"
function main() {
launch
sleep 40
install
sleep 10
config
}
function launch() {
sudo virt-install -n $name \
--ram 4096 \
--vcpus 2 \
--cdrom /var/lib/libvirt/images/vyos-1.3-rolling-202012041912-amd64.iso \
--os-type linux \
--os-variant debian10 \
--network network=ext-br-network,model=virtio \
--network network=internal,model=virtio \
--graphics vnc,port=5999 \
--hvm \
--virt-type kvm \
--disk path=/var/lib/libvirt/images/$name.qcow2,bus=virtio,size=8 \
--noautoconsole
}
function install() {
sudo expect <<EOF
set timeout 600
spawn virsh console $name
expect "Escape character is ^] (Ctrl + ])" {send "\n"}
expect "vyos login:" {send "$user\r"}
expect "Password:" {send "$password\r"}
expect "vyos:~" {send "install image\r"} expect "Would you like to continue? (Yes/No): " {send "Yes\n"}
expect "Partition (Auto/Parted/Skip):" {send "Auto\n"} expect "Install the image on?:" {send "\n"}
expect "Continue? (Yes/No):" {send "Yes\n"} expect "How big of a root partition should I create? (2000MB - 8589MB):" {send "8589MB\n"}
expect "What would you like to name this image?:" {send "\n"} expect "Which one should I copy to vda?:" {send "\n"}
expect "Enter password for user 'vyos':" {send "$password\n"}
expect "Retype password for user 'vyos':" {send "$password\n"}
expect "Which drive should GRUB modify the boot partition on?:" {send "\n"} expect "vyos:~" {send "sudo reboot\r"}
expect "Are you sure you want to reboot this system?" {send "Yes\r"}
EOF
}
function config() {
sudo virsh start $name
sleep 50
sudo expect <<EOF
set timeout 600
spawn virsh console $name
expect "Escape character is ^] (Ctrl + ])" {send "\n"}
expect "vyos login:" {send "$user\r"}
expect "Password:" {send "$password\r"}
send "sudo loadkeys fr\r"
send "configure\r"
send "set interfaces ethernet eth0 address dhcp\r"
send "set interfaces ethernet eth1 address '192.168.200.254/24'\r"
send "set service ssh port '22'\r"
send "set nat source rule 100 outbound-interface 'eth0'\r"
send "set nat source rule 100 source address '192.168.200.0/24'\r"
send "set nat source rule 100 translation address masquerade\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 default-router '192.168.200.254'\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 dns-server '192.168.200.254'\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 domain-name 'internal.domain.tld'\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 lease '86400'\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 start '192.168.200.9'\r"
send "set service dhcp-server shared-network-name LAN subnet 192.168.200.0/24 range 0 stop '192.168.200.253'\r"
send "set service dns forwarding cache-size '0'\r"
send "set service dns forwarding listen-address '192.168.200.254'\r"
send "set service dns forwarding allow-from '192.168.200.0/24'\r"
send "set service dns forwarding name-server '$dns_ip'\r"
send "commit\r"
send "save\r"
send "exit\r"
EOF
}
main
exit 0Et voilà, un routeur fonctionnel avec un seul script… Pensez à modifier ce script pour durcir la sécurité d’accès au routeur en changeant le second mot de passe et en modifiant la config ssh pour accepter les clés. Je mets le lien vers les blueprints de VyOS (notamment dans des environnements Cloud) :
https://docs.vyos.io/en/latest/configexamples/index.html
@+
