Are you afraid of the big bad VyOS? - VyOS Home Use Series Part 1 of 5

Рет қаралды 5,920

Level Zero Networking

Күн бұрын

Пікірлер: 23

@huanxu-vj8fi 6 ай бұрын

Great tutorial. Looking forward to the content related to firewalls.

@DavidConnerCodeaholic 10 күн бұрын

Oh and thanks for the tutorials on ZeroTier

@DavidConnerCodeaholic 10 күн бұрын

I’m pretty excited about vyos now that the automation seems more mature. I didn’t quite understand how notables simplifies firewall configuration, otherwise I would’ve tried it much sooner. I also didn’t quite understand that it’s basically a router OS that gives you a Cisco-style DSL for CLI.

@jw3492 3 ай бұрын

Love it - new sub here

@amorpheuses1627 6 ай бұрын

Since hearing of VyOS I've been intrigued - so this video is timely. See if I can get it going on an old seeed studio odyssey...

@DarkNightSonata 6 ай бұрын

awesome blog btw. love your posts. would be extremely interested in the Zerotier Chasing Performance article. if you can possibly make a video on it to experiment with. while I tried but wasn't successful so a video would be amazing.

@level0networking 6 ай бұрын

I'll look into that one

@level0networking 6 ай бұрын

Also, thank you! L0crian does the blog and I (Burm) do the videos.

@l0crian2 6 ай бұрын

Hi @DarkNightSonata, I'm the author of the blog posts. My friend Burm makes these videos. What was giving you problems with trying to test the multipathed ZeroTier?

@DarkNightSonata 6 ай бұрын

@@l0crian2 awesome thanks a lot. so i was a bit confused in the "Using more cores" section of the post, I basically couldn't find the local.conf file, I looked in the zerotier dir in vyos, and its not there. and then I tried "connect container zt1" and into the home folder and didn't see it. so first question, do we create it from scratch and put it inside vyos, zt1 dir, then restart the container? or do we create it inside the container after connecting to it ? also, if you can explain which interfaces exactly do we need to blacklist. lets say if our zt1 is mapped to eth10 and zt2 is mapped to eth11, do we blacklist both interfaces in both instances? or only we blacklist eth11 in zt1 local.conf and blacklist eth10 in zt2 local.conf ? lastly, just to be sure, to use the 4 cores, we create 4 x zerotier containers on both router1 & router2 so total is 8 zt containers between the 2 routers right ? thanks again for your awesome blog and thanks @Burm for the video

@l0crian2 6 ай бұрын

@@DarkNightSonata Gotcha! The local.conf file is not created by default, so you'll have to create it. I should have called that out in the article, sorry about that. You can create the file in the /config/containers/zt1 folder. That directory would be mapped to the /var/zerotier-one folder for the container so the container will see it. Then just restart for ZeroTier to read the file. The interfaces that you blacklist are ultimately just scoping which interfaces ZeroTier will be listening on, so we want to blacklist anything we don't want ZeroTier to attempt to build over. In the article, this was all of the other ZeroTier interfaces, and the other VPNs I configured for speed comparisons (WireGuard, OpenVPN, etc...). So for your question, if you were configuring the local.conf file for zt1, then you'd blacklist the ZeroTier interfaces of all of the other containers, but not zt1's interface. That way you can't build ZeroTier on top of ZeroTier. Correct on the 4 cores piece. You would configure 4 containers on each host (for a total of 8), and the CPU scheduler will generally attach each container to a single core to spread the utilization around. If you use this in production, you may wish to leave 1-2 cores available for general routing functions. If all of your cores are the same speed, you should see near linear scaling with the throughput.

@nadtz 6 ай бұрын

I'm happy with opnsense and using something that is rolling release on a router makes me kind of wary but I recently upgraded my opnsense hardware so I might play with this on the old hardware as i'm never opposed to learning something new.

@level0networking 6 ай бұрын

I can definitely understand the reservation on using the rolling release. You might find this interesting: blog.vyos.io/introducing-vyos-stream VyOS are adding an intermediate image between the LTS and rolling releases that aims to be stable, but still allow for new features. - L0crian

@nadtz 6 ай бұрын

@@level0networking Ok if they have an LTS branch I'm much more aboard. I do like how this remind me of enterprise switch OS's I've worked with with the commit/save functionality an like I said I'll probably figure out some way to work with this in my homelab for testing. Thanks for the link!

@level0networking 6 ай бұрын

I usually characterize VyOS as Juniper syntax with Cisco configuration structure (prefix-list, route-map, etc...). The control plane for routing is largely FRRouting, so that is why a lot of the structure mirrors Cisco, since FRR does. They do have LTS images, but they're currently going through some changes with how to access/build the LTS images. You can fully build the LTS images (though it generally has newer packages than the official LTS build), but it does require working with Jenkins a little bit. You need a subscription to be able to download the pre-built LTS images, which can be a paid subscription, or another option like a contributor subscription or what they call "VyOS for good" for things like non-profits. - L0crian

@nadtz 6 ай бұрын

@@level0networking That makes perfect sense to me having worked with both Juniper and Cisco hardware. Kind of looking forward to messing with this now (even though it's probably going to be overkill for my home network/homelab), again thanks for the vid and looking forward to the following ones since it will probably be a bit before I get this installed.

@marcusaurelius3487 4 ай бұрын

Set up an IDS, or an IDPS, VLAN segment, seperate internal from external managment access to the service(s) you want to deploy (you can use VyOS natting/firewalling, ex admin login for website x has diff port which is only acessible in local subnet/VLAN), and lastly, hide it behind cloudflare if you want (Because of your statement around the beginning of the video)

@level0networking 16 күн бұрын

We have a video on ntopng for traffic monitoring here. kzbin.info/www/bejne/jaHYZHeJibKbitU And then we also have a video on segment routing with MPLS. kzbin.info/www/bejne/r6azhKV7d82BhZY