#vyos — Public Fediverse posts

Need to route multiple subnets through a single IPSec tunnel on VyOS 1.4? This snippet shows how to configure multiple traffic selectors (TS) with strongSwan and XFRM for efficient site-to-site connections. #vyos #snippet #ipsec #traffic-selector #ValtersIT

https://www.valtersit.com/vault/ipsec-tunnel-with-traffic-selectors-and-multiple-subnets-on--456fe5/

How is it even legal in Europe to employ time-tracking software? This is a job with #VyOS, I know nothing about them except that a friend wanted to apply and then saw the time-tracking software bit, advertised loud and clear:

https://www.linkedin.com/jobs/view/4433954543/

Running BGP between ZeroTier and your physical router? This snippet configures VyOS to redistribute ZeroTier subnets via iBGP using FRR, making zt0 routes available to your local network. Full config at #zerotier #snippet #bgp #vyos #ValtersIT

https://www.valtersit.com/vault/zerotier-route-redistribution-via-bgp-on-vyos-2c3ef2/

New router is working well. This is a switchport in NextDC B2, connected into a #VyOS VM router running in #Proxmox.

This has been something I've been working on for quite a few months now! #MastodonAU #mastodonNZ #nerd #mikrotik

ah, ... precisamente andaba leyendo sobre esta potente herramienta @d1cor ,

Umh... prácticas para algunos estudios que estás cursando ? Lo pregunto porque en mi Escuela vamos a cambiar, precisamente por esa inestabilidad a la que apuntas, de #gns3 a alternativas más estables (y ligeras!) como #mininet y #VyOS (el 'router universal', basada en debian ) o quizas, #containerlab (que usa profusalmente contenedores #docker ). Que te parece ?

I'm trying to build a list of Ethernet switch devices that can run normal(ish) Linux builds with hardware (L2 or L3) switch offloading via `switchdev`.

I know about Mellanox SN* switches and a few Banana Pis (R4, at least). The Ubiquiti ER-4 and -6 seem to have a Nix port, so they're probably also on the list.

Does anyone know anything else that would fit?

I'm in the middle of making VyOS work on my Mellanox SN2010 (18x SFP28, 4x QSFP28), and I'd like to assemble a list of other switches that could also be useful with VyOS. Non x86 is just fine.

#linux #switchdev #networking #vyos

Interested in running #vyos on non-x86 hardware?

Let's meet at #39c3

https://events.ccc.de/congress/2025/hub/en/event/detail/vyos-on-non-x86-meetup

#VyOS Stream 2025.11 is available for download 👉 https://blog.vyos.io/vyos-stream-2025.11

Okay, a bit of progress on #vyos on the SN2010 -- I wrote up the first part of the experience here: https://scottstuff.net/posts/2025/11/11/vyos-on-mellanox-sn2010-switch-part1/

Also, it looks like an idle switch will keep its ASIC around 42C with the fans set to the minimum value that keeps them spinning (PWM 32). The CPU is only slightly over ambient at that level. It's still *slightly* louder than I'd like with the fans at that level, but it's probably acceptable.

Odds are actually it'll start overheating if I add more than one or two optics to it, but `fancontrol` will speed the fan up in that case. Also, Mellanox gives the same crazy thermal margins for SN2xxx switches that they do for their NICs. Basically, anything under 105C is fine, and "critical" doesn't kick in until 120C. So 45C shouldn't worry me.

Ok, it's time: trying to install #VyOS on a Mellanox SN2010 Ethernet switch.

Mellanox/nVidia's SN-series switches are fairly unique because they've upstreamed a driver for the switch ASIC into the Linux kernel. So, in theory you can run *any* Linux distribution on the switch and still have hardware L2/L3 switching working. The switch chip looks like a bunch of extra Ethernet interfaces to the system, and you can configure them like normal (`ip`, `brctl`, etc). The kernel's config gets pushed into the ASIC transparently, and metrics from the ASIC get pulled back into the kernel as well.

I've been watching eBay for a cheap SN2010 for a while. It's a half-width 1U switch with 4x 100G and 18x 25G ports, and finally found one. It draws around 35W on idle without anything plugged in, and is *almost* quiet enough for desk use with the fans spun almost all the way down (`fae mlci2c set_fan /MGMT/FAN1 1 14` in their wonky stock NOS). I've seen a couple fan mods for it that will *probably* get it to be nearly silent.

From what I've seen, this is the lowest-power L3 switch with >2 QSFP28 and >12 SFP28 ports on the market.

The goal is to make this my new desktop switch for less-critical things. I'm currently using 8 or 9 fiber pairs between my desk and my wiring closet, and I *really* don't want to pull more fiber.

The biggest issue right now is that the "MXNX-OS" that came with it is just different enough from every other switch OS that I've used that I really don't want to bother with it. I've seen people run stock Debian on them (example: https://ipng.ch/s/articles/2023/11/11/debian-on-mellanox-sn2700-32x100g/), but I don't see how you can say "this switch OS is clunky, I'd really rather write a bunch of scripts to run 'ip addr add' myself" with a straight face.

So, let's see if I can get VyOS on it, and how close it comes to being usable.

It's shaping up to be a Add Features to #VyOS sort of fall, apparently.

In addition to playing with some ARM things, I'd like to add a few missing NTP options (around polling speed, mostly), get PTP (time) support working, and do whatever tweaks are needed to get support for Mellanox's switchdev-backed switches, like the SN2010.

For the most part, it looks like just loading the (included) mlxsw module *should* be enough to get hardware offloaded L2, L3, and at least some VxLAN working if you install VyOS (or any Linux) on a Mellanox SNxxxx switch. Just configure Linux networking like normal, and the kernel pushes a matching offload config to the hardware on its own. Counter/statistic support may be somewhat lacking, and I don't think VyOS has any support for configuring port splitting (1x100G -> 4x25G). All in all, though, it's *probably* fairly minimal.

It's apparently time for my semi-annual "I wish I had a #Linux #ARM build system" post. But, as usual, I can't actually find a good solution to my problem.

I'm ~12h into compiling #VyOS for ARM right now, running on a system with 4x A73 cores. That's way, way too slow.

Moving it to a Pi 5 would help slightly (~2x, maybe?). There are a few 6-8 core SBCs or similar with faster CPUs for under $250. After that, I *think* I could piece together a 80 or 96-core Ampere Altra system for $1500 or so.

Surely there's *some* ARM system that will run Linux and fits between (say) a RK3588 and an Ampere server, righjt?

Presumably it'd be possible to run Linux on a M1 or M2 Mac mini, but driver support seems dodgy.

Or maybe ARM Linux in a VM on a new er Mac mini? That'd probably sidestep a lot of the driver issues with M3/M4 CPUs and Linux.

I could probably try qemu running on my x86 desktop; it's almost certainly slower than running natively, but it'd probably still outperform a 4-core power-constrained system.

Or I could farm this out to AWS/GCP/etc. That'd certainly be cheaper up front, but I'd end up paying to sling multi-GB images back and forth all day.

Anyone have any other suggestions?

I'm guessing it's not possible, but does anyone know if on #Hetzner it's possible to create like a VPC or similar between auction servers, and a VPS?

Basically want want to run #Vyos on VPS and then route traffic from the auction servers out via that Vyos instance.

VyOSを使用してSite-to-Site VPNの構築検証してみた in 2025
https://dev.classmethod.jp/articles/vyos-site-to-site-vpn-in-2025/

#dev_classmethod #AWS_Site_to_Site_VPN #VyOS #AWS_Transit_Gateway #AWS_CDK #VPN

การตั้งค่า AWS Site-to-Site VPN บน VPC ใน Thailand Region
https://dev.classmethod.jp/articles/aws-site-to-site-vpn-vpc-thailand-region/

#dev_classmethod #Classmethod_Thailand #Thai_Language #AWS #AWS_Thai #AWS_VPN #VyOS

การลบ AWS Site-to-Site VPN บน VPC ใน Thailand Region
https://dev.classmethod.jp/articles/delete-aws-site-to-site-vpn-vpc-thailand-region/

#dev_classmethod #Classmethod_Thailand #Thai_Language #AWS #AWS_Thai #AWS_VPN #VyOS

Yow! I've been running #Minisforum MS-A2 #VyOS router performance benchmarks in the background for most of the weekend. I'll make a relatively small config, reboot, re-run the multi-hour NDR sweep with trex, lather, rinse, repeat.

When I set the BIOS to "performance" power mode instead of "balanced" (the default), I notice that it spikes to drawing 185W from the wall and runs like a bat out of hell for 6 seconds before throttling itself back down to 155W.

That's a spicy little mini PC -- I don't know how it expects to cool 185W. I mean, obviously it isn't, but it seems like a weirdly aggressive thing to even attempt.

This is *obviously* optimized for gaming/desktop uses, where a 6s spike in performance followed by slowing back down is a good thing. It benchmarks fairly poorly this way, though. Dropping back to "balanced" seems to give much better numbers overall.

I tried turning on AMD PBO, which will boost clock speeds even more when thermals permit it.

Thermals didn't permit it.

I'm running each test 3x, and with PBO I was seeing giant differences from run to run. Like 5.84/14.83/5.85 Mpps across 3 runs. In "balanced" mode without PBO it consistently got >15 Mpps, so enabling PBO isn't even slightly helpful.

This box feels like it should be faster than it is on routing; it's clearly faster than my previously-measured numbers on this thing's Intel twin, but throughput doesn't seem to be linear with CPU load. At 80% of peak load, it's using something like 50% of its CPU, but increasing past that rapidly swamps the CPU.

I saw similar with the Intel system, but I blamed it on Alder Lake's mix of P and E cores. The AMD model has 16 equal cores, so *that*'s not the problem.

I'm not sure if I'm hitting kernel-tunable issues (I've found at least one so far), hardware-tunable issues (Mellanox *loves* knobs), cache-size issues, or memory-bandwidth issues.

I probably have the tools to figure it out, though, so I'll leave tests running in the background for a day or two and keep making little tweaks to see what helps.

Firewall Upgrade.

I just replaced the miniPC I use as firewall running #VyOS

It has been upgraded to a "Mele Quieter DL" - more info here:

https://mele.cn/product/QuieterDL-en.html

This is an extremely compact, fanless PC with two NICs (RTL8125B 2.5GbE) and an Intel N100 CPU.

I got a lower spec model with 4G RAM and 128G eMMC storage as that will be fine for firewall use.

It can be configured in the BIOS to turn on when power applied, handy for firewall use.

I ran up Xubuntu linux for desktop use as a quick test and it was great for that as well, though I'd get one with more RAM if I was using it as a desktop machine.

One (not a showstopper) oddity with it is the bad design of the PSU socket, more details here: https://jauntygoat.net/@zog/114872639754152299

There is heaps of general info on youtube about these PCs for further info. Plus they seem to be popular with the astronomy crowd.

Sharing my router configs for DN42

https://dn42.f333.net/posts/2025/05/18/
https://f333.dn42/posts/2025/05/18/

#dn42 #vyos

@vax_ I concur 100%

Reading about it's hard to find a definitive list of affected routers but this link mentions the 3 I mentioned: https://www.bleepingcomputer.com/news/security/botnet-hacks-9-000-plus-asus-routers-to-add-persistent-ssh-backdoor/

I'm even recommending people get ones from GL-INET which supports #OpenWRT out of the box - although I still prefer to install the stock OpenWRT from the OpenWRT site on GL-INET devices instead of the slightly "slick UI" version of OpenWRT that GL-INET provide with the device.

In another post I just purchased an #OpenWRTOne to check it out - since I'm all sorted at home with my #VyOS firewall and #Unifi wifi I'm going to upgrade my mum's home internet with the OpenWRT One 🙂

edit: add GL-INET link https://www.gl-inet.com/support/firmware-versions/

time to fork VyoS?

#VyoS

https://old.reddit.com/r/vyos/comments/1hpbzx5/i_have_a_plan_for_making_vyos_free_again_but_ill/

an exciting friday night in debugging this, I now think it is a bug in VyOS that has been there for a while:

https://forum.vyos.io/t/ipv6-does-not-seem-to-be-working-on-pppoe-interfaces-since-1-3rolling/16602

#VyOS
#IPV6
#PPPOE

#VyOS
#ipv6
#pppoe

not critical, but mildly annoying that ipv6 almost works completely proper with VyOS and PPPOE for me.

https://forum.vyos.io/t/pppoe-does-not-get-ipv6-address-but-i-do-get-ipv6-prefix-delegation/16598

Домашнее облако: как я построил цифровой «бункер» для важных данных

Фото важных семейных событий и видео из путешествий, копии важных документов, музыка, фильмы, которых не найти на стримингах — многие задумывались, как сохранить все самое важное так, чтобы ситуация с не вовремя сломавшейся флешкой не обернулась потерей ценных данных навсегда. Кому-то для спокойствия достаточно Google Drive или Яндекс.Диска, но я решил пойти чуть дальше и построить собственное домашнее облако с приложениями Immich и Nextcloud. Кстати, привет, Хабр! Я Денис Петухов, Python-разработчик Читать дальше

https://habr.com/ru/companies/cloud_ru/articles/895328/

#nextcloud #immich #kubernetes #vyos #synology #домашнее_облако #облачный_диск

I think I might actually migrate my #firewall to #vyos. Just the fact that I can easily deploy #podman #container onto my firewall this is also possible with #OpenWrt but sadly it's a bit hacky as their partitioning is ephemeral in it's nature.
I'm still struggling a bit with managing core functionalities like firewalling but I will manage. Why isn't there already a GUI? Isn't their API supposed to be ready to use idk?
Solutions like #pfSense or #OPNsense are just a bit too inflexible for me.

After a couple of years of abstence I have to try #vyos once again. I have been also trying to go back to #opnsense lately but it seems I like #linux based firewalls better, even though somehow #BSD's #pf is really good.

Al final #VyOS corre en una maquina virtual. Y corre bien hasta ahora. :coffee_mug: :coffeepot: