Firewall and NAT#

Two pages that do most of the day-to-day work, built so that the rule you are looking at and the packets going through it are on the same screen.

Rules, with counters#

The rule table is the configured ruleset joined with the router's own firewall statistics, so each rule carries its hit count. A rule that is never matched looks different from a rule that is matched constantly, which is most of what you want to know when something is not working.

Add, edit and delete are all side panels over the table, and every one of them renders its commands first. Logging is a per-rule toggle.

Groups are an editor, not a read-only list#

Every kind VyOS supports is editable: address, network, port, domain, MAC, interface, and the IPv6 address and network groups. Create a group, add and remove members, delete it. The rule editor then references groups as source, destination or port — which is the point of having them.

The page also refuses to offer an ipv6-address-group to an IPv4 rule, because that combination commits and then does nothing.

The empty state teaches the pattern rather than saying "no groups":

What the Firewall groups tab shows on an empty router

set firewall group network-group LAN-NETS network 10.0.0.0/16
set firewall group port-group WEB port 80
set firewall group port-group WEB port 443
set firewall ipv4 forward filter rule 10 destination group port-group WEB

Port forwards that work the first time#

A destination-NAT rule with no matching filter rule is the classic silent failure: the translation happens and the packet is dropped a moment later. The New port forward panel offers the accept rule alongside the forward, ticked by default, numbered into the first free slot in the forward chain, and shows you both in the same block.

It will also stage the hairpin pair — the LAN-side destination NAT on the public address plus the matching masquerade — for clients inside the network that use the public address. That needs the WAN address and the LAN network, and where the router cannot supply them the option is not offered rather than staged half-formed.

Per-rule counters are joined from nat statistics the same way the firewall's are. Source NAT has its own table and editor.

Inline intrusion prevention, if you want it#

The firewall is also how packets reach the IPS engine: a rule with action queue and queue-options bypass hands matched packets to a kernel queue that a Suricata container verdicts. It is described on the VPN and intrusion detection page, because the interesting part is the safety argument rather than the rule syntax.

What the installer writes#

If you leave the Firewall box ticked during the install, and there is a WAN, you get a default-drop input and forward policy on both address families, with established and related accepted, invalid dropped, the LAN allowed out, ICMP accepted, and the DHCP or DHCPv6 client's own return traffic permitted on the WAN. Nothing in it opens the management port from the WAN.

Unticking the box raises a screen that says the router will accept everything arriving from the internet, and its default answer is Turn it on.

Read on#

Security — the posture in summary.
The wiki: firewall rules and publishing a service.