What the product does#
Nine areas, one page each, and the way onto the box. Every page states a claim and shows the mechanism behind it.
Read the second half of every page
Where something is narrower than its name suggests, the page says so beside the claim rather than a page away.
The uplink model and the neighbour table are IPv4 only. Ring sizes, queue counts, link speed and duplex are console work. A fleet change goes to one router at a time. Each of those sentences sits on the page that makes the claim it qualifies.
The configuration model
One list of pending changes, one Commit Bar, the router's own auto-revert, and a revision for every change applied. Read more
A form for every setting
Every page edits what it shows and says each change in a sentence. The set and delete
lines are one switch away, in Advanced mode. Read more
Interfaces, routing, uplinks
VLANs, bridges, bonds, PPPoE, tunnels, static routes joined to the live forwarding table, BGP and OSPF, multi-WAN. Read more
Firewall and NAT
Rules with live counters, groups as a first-class editor, and port forwards that stage the accept rule with them. Read more
VPN and intrusion detection
WireGuard as native configuration, IPsec beside strongSwan's live associations, and Suricata inline in the packet path. Read more
Apps as configuration
A 40-entry catalogue where installing an app is a diff, a commit, and something you can roll back. Read more
What the box is doing
Live counters over a WebSocket, conntrack top talkers, the journal, Prometheus metrics, and drift flagged where intent and reality disagree. Read more
Automation and the API
The interface consumes the API you get. One desired-state engine sits behind the UI, the API, the CLI and an optional loop. Read more
Accounts, roles and audit
Argon2id and TOTP, three server-enforced roles, scoped API tokens, OIDC single sign-on, and an attributed audit entry per change. Read more
Getting onto the box
- A dialog installer on the first console, and an unattended seed for the same install with nobody at the keyboard — repaired in the tree after three releases in which it applied the seed's configuration and then failed to write the disk.
- An OPNsense importer that turns a
config.xmlinto VyOS commands plus a report of what came across, what came across differently, and what could not. --check-againstthen compares a running router with the configuration it should have.
What is not here#
No alerting of any kind. No client or device inventory. No wireless. IPv6 in the uplink model or the neighbour table. The list is on its own page, in the same detail as everything above.
See it on your own hardware
Every page above describes something running today. The image is published for every tag.