u/regina-83

Hello everyone,

I’d like to optimize the network design and separate core and edge routing.

So far, I’ve been using three routers that handle both inter-VLAN routing and edge routing and are part of a VRRP cluster.

Now I’d like to deploy a core router running VyOS that acts as the default gateway for all networks and initially handles inter-VLAN routing. The three edge routers will be connected to this core router, with each one connected to a different Internet line or provider.

The core router should use policy-based routing to determine which networks, clients, or services are routed to the Internet via which edge router or WAN connection. Additionally, failover should still be available in the event of an Internet connection failure (as has been the case with VRRP).

My question is: what is the best way to set up this configuration? On the one hand, I could set up a transport network containing the three edge routers and use VRRP again. In that case, I would likely need a transit switch between the core router and the edge routers so that the VRRP cluster’s traffic does not have to pass through the core router’s CPU.

On the other hand, it would certainly also be possible to connect the edge routers directly to the core router’s interfaces and operate without VRRP. Which protocol could I then use to implement both policy-based routing and failover?

Which network design would you recommend for my situation? I’d appreciate any tips and assistance.

Thank you in advance for your tips, and best regards

Regina (she/her)

Hi everyone,

I need your help choosing a new core switch. Right now, we’re using a TP-Link SX3016F. Unfortunately, it’s only a Layer 2 switch, and the 16 ports aren’t quite enough.

While searching for an affordable Layer 3 switch that also has 25G and 40G ports, I came across the FS S5860-20SQ.

There are reviews from users who have this switch in operation and are very satisfied with it.

The switch is available in two versions:

With its own FSOS or with PicOS. Now I’m unsure which version is better suited for our use case.

The plan is to connect the aggregation/distribution switches, the large storage devices (Synology NAS), and the edge routers running VyOS to this switch.

Currently, the edge routers also handle inter-VLAN routing, but this is supposed to be offloaded to the core switch.

I have experience with both Cisco-style CLIs (Cisco IOS, Aruba AOS-CX) and Juniper-style CLIs (JunOS, VyOS).

Could you please help me determine whether FSOS or PicOS is better suited for our use case?

Thank you very much and best regards,

Regina (she/her)

Hi there,

how is it possible, that VyOS doesn't write these VRRP messages to syslog:

Jun 12 21:29:48 keepalived-fifo.py[3363]: Received message: INSTANCE "INTRANET" MASTER_RX_LOWER_PRI 50
Jun 12 21:29:48 keepalived-fifo.py[3363]: INSTANCE INTRANET changed state to MASTER_RX_LOWER_PRI
Jun 12 21:29:48 Keepalived_vrrp[3362]: (INTRANET) Received advert from 192.168.XX.XXX with lower priority 30, ours 50, forcing new election

Thanks and kind regards

Regina (she/her)

Hi,

currently I am trying to configure a more complex router setup with VyOS.

My LAN interface is eth4, with one IP adress without VLAN and multiple VIF. My WAN interface is eth0:

interfaces {
    ethernet eth0 {
        address 00.00.00.000/29
        description VODAFONE
        hw-id 00:
    }
    ethernet eth1 {
        hw-id 00:
    }
    ethernet eth2 {
        hw-id 00:
    }
    ethernet eth3 {
        hw-id 00:
    }
    ethernet eth4 {
        address 192.168.11.143/24
        description INTRANET
        hw-id 60:
        vif 2 {
            address 192.168.12.143/24
            description MOBILE
        }
        vif 3 {
            address 192.168.13.143/24
            description VOICE
        }
        vif 4 {
            address 192.168.14.143/24
            description MEDIA
        }
    }
    ethernet eth5 {
        hw-id 60:
    }
    loopback lo {
    }
}

Now I want the following rules:

Subnet 192.168.11.0/24 (INTRANET) should have access to all other subnets MOBILE, MEDIA and VOICE

The subnets MOBILE, MEDIA and VOICE should be isolated and there should be no access to each other and also no access to INTRANET.

The subnets MOBILE and MEDIA should have access to the WAN interface (eth0).

The subnet VOICE should't have access to the WAN interface.

At the moment my firewall looks like this:

firewall {
    flowtable FT1 {
        description "Flow Table for the forward chain"
        interface eth0
        interface eth4
        interface eth4.2
        interface eth4.3
        interface eth4.4
        offload software
    }
    global-options {
        all-ping enable
    }
    group {
        interface-group LAN {
            interface eth4
            interface eth4.2
            interface eth4.3
            interface eth4.4
        }
    }
    ipv4 {
        forward {
            filter {
                default-action drop
                rule 10 {
                    action offload
                    description "Allow Return traffic through the router - Fast Path"
                    offload-target FT1
                    state established
                    state related
                }
                rule 20 {
                    action accept
                    description "Allow Return traffic through the router"
                    inbound-interface {
                        name eth0
                    }
                    state established
                    state related
                }
                rule 1000 {
                    action accept
                    description "Allow all traffic from LAN interface"
                    inbound-interface {
                        group LAN
                    }
                }
            }
        }
        input {
            filter {
                default-action drop
                rule 10 {
                    action accept
                    description "Allow Return traffic destined to the router"
                    inbound-interface {
                        name eth0
                    }
                    state established
                    state related
                }
                rule 20 {
                    action accept
                    description "Allow ICMP echo-request on WAN"
                    icmp {
                        type-name echo-request
                    }
                    inbound-interface {
                        name eth0
                    }
                    protocol icmp
                }
                rule 21 {
                    action accept
                    description "Allow ICMP time-exceeded on WAN"
                    icmp {
                        type-name time-exceeded
                    }
                    inbound-interface {
                        name eth0
                    }
                    protocol icmp
                }
                rule 22 {
                    action accept
                    description "Allow ICMP destination-unreachable on WAN"
                    icmp {
                        type-name destination-unreachable
                    }
                    inbound-interface {
                        name eth0
                    }
                    protocol icmp
                }
                rule 23 {
                    action accept
                    description "Allow UDP Traceroute on WAN"
                    destination {
                        port 33434-33534
                    }
                    inbound-interface {
                        name eth0
                    }
                    protocol udp
                }
                rule 1000 {
                    action accept
                    description "Allow all traffic from LAN interface"
                    inbound-interface {
                        group LAN
                    }
                }
            }
        }
        output {
            filter {
                default-action accept
            }
        }
    }
}

What is the best way to set the firewall rules?

Please help me.

Thanks and best regards from Germany

Regina (she/her)