Added CloudFormation templates for VyOS deployment on AWS

6 files changed, 1600 insertions, 0 deletions

diff --git a/CloudFormation/readme.md b/CloudFormation/readme.md
new file mode 100644
index 0000000..b437838
--- /dev/null
+++ b/CloudFormation/readme.md
@@ -0,0 +1,12 @@
+# CloudFormation Templates for Deploying VyOS on AWS

+

+## Overview

+These CloudFormation templates automate the deployment of a VyOS instance on AWS, configuring essential components such as VPC, public/private subnets, internet gateway, route tables, Elastic IPs, and security groups. 

+

+### Templates 

+- **VyOS Deployment with Basic Configuration**: Includes essential VyOS instance configurations (for quick deployment).

+- **VyOS Deployment with Advanced Configuration**: Includes advanced VyOS instance configurations.

+

+## Deployment Scenarios

+- **Existing VPC**: Deploys VyOS within an existing VPC and subnet structure.

+- **New VPC**: Creates a fully configured VPC and subnet environment for VyOS deployment and deploys VyOS instance.

diff --git a/CloudFormation/vyos-template-with-basic-configuration/readme.md b/CloudFormation/vyos-template-with-basic-configuration/readme.md
new file mode 100644
index 0000000..5a953c1
--- /dev/null
+++ b/CloudFormation/vyos-template-with-basic-configuration/readme.md
@@ -0,0 +1,65 @@
+# VyOS Deployment with Basic Configuration

+

+## Template Overview

+

+This CloudFormation template automates the deployment of a VyOS instance, setting up:

+- A VPC with public and private subnets.

+- Internet Gateway, Route Tables, ENIs, Security Groups, and Elastic IP.

+- Configuration via cloud-init for a consistent, scalable setup.

+

+## Prerequisites

+

+Ensure the following prerequisites are met before deploying:

+- **AWS Account**: Active with necessary IAM permissions for VPCs, EC2 instances, etc.

+- **EC2 Key Pair**: Valid SSH key pair for instance access.

+- **AWS CLI/Console Access**: Familiarity with AWS Console or CLI for managing the CloudFormation stack.

+

+## Deployment Scenarios

+

+### Deploying to an Existing VPC

+

+1. Go to **AWS Console** > **CloudFormation**.

+2. Select **Create stack** - with new resources.

+3. Upload the `.yaml` template file.

+4. Specify stack details:

+   - **Stack name**.

+   - **Existing VPC and Subnet IDs** (must belong to the same AWS region and Availability Zone).

+5. Leave new VPC and Subnet CIDR fields empty.

+6. Configure VyOS Instance parameters:

+   - **Instance Type**.

+   - **EC2 Key Pair Name**.

+   - **ENI IPs** (according to the existing subnet CIDRs).

+   - **Primary and Secondary DNS** (optional).

+   - **SSH Allowed IP Subnet** (for remote access).

+

+    > **Note**: Setting `VyOS AMI Alias` to `latest` will deploy the latest version. Specify a specific version if needed, e.g., `/aws/service/marketplace/prod-ev235jujteaom/1.4.0`.

+

+7. Monitor stack creation until the **CREATE_COMPLETE** message appears.

+8. Retrieve the Public IP in the “Outputs” tab.

+

+### Deploying to a New VPC

+

+1. Go to **AWS Console** > **CloudFormation**.

+2. Select **Create stack** - with new resources.

+3. Upload the `.yaml` template file.

+4. Specify stack details:

+   - **New VPC name and CIDR**.

+   - **Public and Private Subnet CIDRs**.

+5. Leave existing VPC/Subnet IDs empty.

+6. Configure VyOS Instance parameters as listed above.

+7. Wait for **CREATE_COMPLETE** and find the Public IP under “Outputs”.

+

+## Access and Management

+

+To connect to the VyOS instance, use:

+- **VyOS Public IP** (from Outputs) and **EC2 Key Pair** with an SSH client.

+

+Sample command: `ssh vyos@<VyOS_Public_IP_Address> -i <test-key.pam>`

+

+### Common CLI Commands

+

+For VyOS configuration and interface checking:

+```bash

+show configuration commands

+show interfaces

+show ip route

diff --git a/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml b/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml
new file mode 100644
index 0000000..2dda6ce
--- /dev/null
+++ b/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml
@@ -0,0 +1,559 @@
+AWSTemplateFormatVersion: '2010-09-09'

+Description: VyOS Networks CloudFormation template to deploy a VPC with public

+  and private subnets, an Internet gateway, Route tables, ENIs, Elastic IP

+  Address and a VyOS instance with subscription (Pay As You Go) and configures

+  VyOS instance via user-data (cloud-init).

+

+Parameters:

+  ExistingVPCId:

+    Description: ID of an existing VPC

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^vpc-[0-9a-fA-F]{8,17}$

+    ConstraintDescription: Must be a valid VPC ID or empty.

+

+  ExistingPublicSubnetId:

+    Description: ID of an existing public subnet

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$

+    ConstraintDescription: Must be a valid public subnet ID or empty.

+

+  ExistingPrivateSubnetId:

+    Description: ID of an existing private subnet

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$

+    ConstraintDescription: Must be a valid private subnet ID or empty.

+

+  VPCName:

+    Description: Name of the VPC

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^.{1,128}$

+    MaxLength: 128

+    ConstraintDescription: Must be empty or between 1 and 128 characters.

+

+  VPCCidrBlock:

+    Description: CIDR block for the VPC

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$

+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28, or can be empty if we deploy VyOS instance to the existig VPC.

+

+  PublicSubnetCidr:

+    Description: CIDR block for the Public Subnet

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$

+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28.

+

+  PrivateSubnetCidr:

+    Description: CIDR block for the Private Subnet

+    Type: String

+    Default: ''

+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$

+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28.

+

+  InstanceType:

+    Description: EC2 instance type for VyOS deployment

+    Type: String

+    Default: c5n.large

+    AllowedValues:

+      - t3.small

+      - t3.medium

+      - t3.large

+      - t3.xlarge

+      - t3.2xlarge

+      - t3a.small

+      - t3a.medium

+      - t3a.large

+      - t3a.xlarge

+      - t3a.2xlarge

+      - m4.large

+      - m4.xlarge

+      - m4.2xlarge

+      - m4.4xlarge

+      - m4.10xlarge

+      - m4.16xlarge

+      - m5.large

+      - m5.xlarge

+      - m5.2xlarge

+      - m5.4xlarge

+      - m5.8xlarge

+      - m5a.large

+      - m5a.xlarge

+      - m5a.2xlarge

+      - m5a.4xlarge

+      - m5a.8xlarge

+      - m5a.12xlarge

+      - m5n.large

+      - m5n.xlarge

+      - m5n.2xlarge

+      - m5n.4xlarge

+      - m5n.8xlarge

+      - m5n.12xlarge

+      - m5zn.large

+      - m5zn.xlarge

+      - m5zn.2xlarge

+      - m5zn.3xlarge

+      - m5zn.6xlarge

+      - m5zn.12xlarge

+      - m6i.large

+      - m6i.xlarge

+      - m6i.2xlarge

+      - m6i.4xlarge

+      - m6i.8xlarge

+      - m6i.12xlarge

+      - m6i.16xlarge

+      - c4.large

+      - c4.xlarge

+      - c4.2xlarge

+      - c4.4xlarge

+      - c4.8xlarge

+      - c5.large

+      - c5.xlarge

+      - c5.2xlarge

+      - c5.4xlarge

+      - c5.9xlarge

+      - c5d.large

+      - c5d.xlarge

+      - c5d.2xlarge

+      - c5d.4xlarge

+      - c5d.9xlarge

+      - c5a.large

+      - c5a.xlarge

+      - c5a.2xlarge

+      - c5a.4xlarge

+      - c5a.8xlarge

+      - c5n.large

+      - c5n.xlarge

+      - c5n.2xlarge

+      - c5n.4xlarge

+      - c5n.9xlarge

+      - c6i.large

+      - c6i.xlarge

+      - c6i.2xlarge

+      - c6i.4xlarge

+      - c6i.8xlarge

+      - c6i.12xlarge

+      - c6i.16xlarge

+      - c6i.24xlarge

+      - m6a.large

+      - m6a.xlarge

+      - m6a.2xlarge

+      - m6a.4xlarge

+      - m6a.8xlarge

+      - m6a.12xlarge

+      - m6a.16xlarge

+      - m6in.large

+      - m6in.xlarge

+      - m6in.2xlarge

+      - m6in.4xlarge

+      - m6in.8xlarge

+      - m6in.12xlarge

+      - m6in.16xlarge

+      - m6in.24xlarge

+      - m6in.32xlarge

+      - m6in.metal

+      - m7i.large

+      - m7i.xlarge

+      - m7i.2xlarge

+      - m7i.4xlarge

+      - m7i.8xlarge

+      - m7i-flex.large

+      - m7i-flex.xlarge

+      - m7i-flex.2xlarge

+      - m7i-flex.4xlarge

+      - m7i-flex.8xlarge

+

+  KeyName:

+    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances

+    Type: AWS::EC2::KeyPair::KeyName

+    ConstraintDescription: Must not be empty

+

+  VyOSPublicENIip:

+    Description: Private IP address for VyOS instance ENI

+    Type: String

+    AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$

+    ConstraintDescription: Must be a valid IP address in the Public Subnet CIDR block

+

+  VyOSPrivENIip:

+    Description: Private IP address for VyOS instance ENI

+    Type: String

+    AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$

+    ConstraintDescription: Must be a valid IP address in the Private Subnet CIDR block

+

+  SSHAllowedIP:

+    Description: The IP subnet allowed to SSH into the VyOS instance

+    Type: String

+    Default: 192.0.2.0/24

+    AllowedPattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(2[4-9]|3[0-2]))$

+    ConstraintDescription: Must be a valid IPv4 CIDR within range /24 to /32

+

+  # VyOS AMI Aliase. 

+  # If you set "latest" option CloudFormation will choose the latest version of the VyOS. 

+  # But if you want to deploy a more specific version you should change the latest to part of the alias like /aws/.../1.3.6, /aws/.../1.4.0.

+  # After changing this please look at the Resources part "VyOSInstance"s User-Data field because there could be VyOS CLI commands changes.

+  # Check VyOS official documentation for command reference.

+

+  AmiAlias:

+    Type: "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>"

+    Default: "/aws/service/marketplace/prod-ev235jujteaom/latest"

+    Description: "AMI Alias of the VyOS instance"

+

+Metadata:

+  AWS::CloudFormation::Interface:

+    ParameterGroups:

+      - Label:

+          default: 'Current VPC configuration. If you want deploy instance to your

+            existing VPC please add VPC and Subnet IDs to regareded fields:'

+        Parameters:

+          - ExistingVPCId

+          - ExistingPublicSubnetId

+          - ExistingPrivateSubnetId

+      - Label:

+          default: 'New VPC and Subnet CIDRs configurations. If you want to deploy instance to new

+            VPC please fill regarded fields:'

+        Parameters:

+          - VPCName

+          - VPCCidrBlock

+          - PublicSubnetCidr

+          - PrivateSubnetCidr

+      - Label:

+          default: 'VyOS Instance Configuration:'

+        Parameters:

+          - InstanceType

+          - KeyName

+          - VyOSPublicENIip

+          - VyOSPrivENIip

+          - SSHAllowedIP

+

+    ParameterLabels:

+      ExistingVPCId:

+        default: Existing VPC ID (optional if deploy existing VPC)

+      ExistingPublicSubnetId:

+        default: Existing Public Subnet ID (optional if deploy existing VPC)

+      ExistingPrivateSubnetId:

+        default: Existing Private Subnet ID (optional if deploy existing VPC)

+      VPCName:

+        default: VPC Name (required if you deploy new VPC)

+      VPCCidrBlock:

+        default: VPC CIDR Block (required if you deploy new VPC)

+      PublicSubnetCidr:

+        default: Public Subnet CIDR (required if you deploy new VPC)

+      PrivateSubnetCidr:

+        default: Private Subnet CIDR (required if you deploy new VPC)

+      InstanceType:

+        default: Instance Type (required)

+      KeyName:

+        default: EC2 KeyPair Name (required)

+      VyOSPublicENIip:

+        default: VyOS Public ENI IP (required)

+      VyOSPrivENIip:

+        default: VyOS Private ENI IP (required)

+      OnPremPublicIPAddress:

+        default: On-Premies Public IP Address (required)

+      VyOSBGPASNumber:

+        default: VyOS BGP ASN (required)

+      OnPremBGPASNumber:

+        default: On-Premies BGP ASN (required)

+      SSHAllowedIP:

+        default: SSH Allowed IP Subnet (required)

+

+Conditions:

+  CreateVPC: !Equals

+    - !Ref ExistingVPCId

+    - ''

+  CreatePublicSubnet: !Equals

+    - !Ref ExistingPublicSubnetId

+    - ''

+  CreatePrivateSubnet: !Equals

+    - !Ref ExistingPrivateSubnetId

+    - ''

+

+Resources:

+  # VPC

+  VPC:

+    Type: AWS::EC2::VPC

+    Condition: CreateVPC

+    Properties:

+      CidrBlock: !Ref VPCCidrBlock

+      EnableDnsSupport: 'true'

+      EnableDnsHostnames: 'true'

+      Tags:

+        - Key: Name

+          Value: !Ref VPCName

+

+  # Subnets

+  PublicSubnet:

+    Type: AWS::EC2::Subnet

+    Condition: CreatePublicSubnet

+    DependsOn: VPC

+    Properties:

+      VpcId: !If

+        - CreateVPC

+        - !Ref VPC

+        - !Ref ExistingVPCId

+      CidrBlock: !Ref PublicSubnetCidr

+      MapPublicIpOnLaunch: 'true'

+      AvailabilityZone: !Select

+        - 0

+        - !GetAZs ''

+      Tags:

+        - Key: Name

+          Value: Public Subnet

+

+  PrivateSubnet:

+    Type: AWS::EC2::Subnet

+    Condition: CreatePrivateSubnet

+    DependsOn: VPC

+    Properties:

+      VpcId: !If

+        - CreateVPC

+        - !Ref VPC

+        - !Ref ExistingVPCId

+      CidrBlock: !Ref PrivateSubnetCidr

+      MapPublicIpOnLaunch: 'false'

+      AvailabilityZone: !Select

+        - 0

+        - !GetAZs ''

+      Tags:

+        - Key: Name

+          Value: Private Subnet

+

+  # Internet Gateway

+  InternetGateway:

+    Type: AWS::EC2::InternetGateway

+    Condition: CreateVPC

+    Properties:

+      Tags:

+        - Key: Name

+          Value: Internet Gateway

+        - Key: Created by

+          Value: CloudFormation

+

+  AttachGateway:

+    Type: AWS::EC2::VPCGatewayAttachment

+    Condition: CreateVPC

+    Properties:

+      VpcId: !Ref VPC

+      InternetGatewayId: !Ref InternetGateway

+

+  # Route Tables

+  PublicRouteTable:

+    Type: AWS::EC2::RouteTable

+    Condition: CreateVPC

+    Properties:

+      VpcId: !If

+        - CreateVPC

+        - !Ref VPC

+        - !Ref ExistingVPCId

+      Tags:

+        - Key: Name

+          Value: Public Route Table

+        - Key: Created by

+          Value: CloudFormation

+

+  PublicRoute:

+    Type: AWS::EC2::Route

+    Condition: CreateVPC

+    Properties:

+      RouteTableId: !Ref PublicRouteTable

+      DestinationCidrBlock: 0.0.0.0/0

+      GatewayId: !If

+        - CreateVPC

+        - !Ref InternetGateway

+        - !Ref ExistingPublicSubnetId

+

+  PublicSubnetRouteTableAssociation:

+    Type: AWS::EC2::SubnetRouteTableAssociation

+    Condition: CreateVPC

+    Properties:

+      SubnetId: !Ref PublicSubnet

+      RouteTableId: !Ref PublicRouteTable

+

+  # Security Groups

+  VyOSPublicSG:

+    Type: AWS::EC2::SecurityGroup

+    Properties:

+      GroupDescription: Enable access from outside

+      VpcId: !If

+        - CreateVPC

+        - !Ref VPC

+        - !Ref ExistingVPCId

+      SecurityGroupIngress:

+        - IpProtocol: tcp

+          FromPort: 22

+          ToPort: 22

+          CidrIp: !Ref SSHAllowedIP

+          Description: Allow SSH access

+        - IpProtocol: udp

+          FromPort: 51820

+          ToPort: 51820

+          CidrIp: 0.0.0.0/0

+          Description: Allow WireGuard VPN access

+        - IpProtocol: udp

+          FromPort: 1194

+          ToPort: 1194

+          CidrIp: 0.0.0.0/0

+          Description: Allow OpenVPN access

+        - IpProtocol: udp

+          FromPort: 500

+          ToPort: 500

+          CidrIp: 0.0.0.0/0

+          Description: Allow IPSec VPN access (ISAKMP)

+        - IpProtocol: udp

+          FromPort: 1701

+          ToPort: 1701

+          CidrIp: 0.0.0.0/0

+          Description: Allow L2TP VPN access

+        - IpProtocol: udp

+          FromPort: 4500

+          ToPort: 4500

+          CidrIp: 0.0.0.0/0

+          Description: Allow IPSec NAT Traversal

+      Tags:

+        - Key: Name

+          Value: PublicSG

+        - Key: Created by

+          Value: CloudFormation

+

+  VyOSPrivateSG:

+    Type: AWS::EC2::SecurityGroup

+    Properties:

+      GroupDescription: Enable access from inside

+      VpcId: !If

+        - CreateVPC

+        - !Ref VPC

+        - !Ref ExistingVPCId

+      SecurityGroupIngress:

+        - IpProtocol: -1 

+          CidrIp: 0.0.0.0/0

+          Description: Allow all protocols and ports

+      Tags:

+        - Key: Name

+          Value: PrivateSG

+        - Key: Created by

+          Value: CloudFormation

+

+  # ENIs

+  PublicENI:

+    Type: AWS::EC2::NetworkInterface

+    Properties:

+      SubnetId: !If

+        - CreatePublicSubnet

+        - !Ref PublicSubnet

+        - !Ref ExistingPublicSubnetId

+      Description: Public Network Interface

+      PrivateIpAddress: !Ref VyOSPublicENIip

+      GroupSet:

+        - !Ref VyOSPublicSG

+      Tags:

+        - Key: Name

+          Value: PublicENI

+        - Key: Created by

+          Value: CloudFormation

+

+  PrivateENI:

+    Type: AWS::EC2::NetworkInterface

+    Properties:

+      SubnetId: !If

+        - CreatePrivateSubnet

+        - !Ref PrivateSubnet

+        - !Ref ExistingPrivateSubnetId

+      Description: Private Network Interface

+      PrivateIpAddress: !Ref VyOSPrivENIip

+      GroupSet:

+        - !Ref VyOSPrivateSG

+      Tags:

+        - Key: Name

+          Value: PrivateENI

+        - Key: Created by

+          Value: CloudFormation

+

+  # VyOS Instance

+  VyOSInstance:

+    Type: AWS::EC2::Instance

+    Properties:

+      InstanceType: !Ref InstanceType

+      KeyName: !Ref KeyName

+      ImageId: !Ref AmiAlias

+      NetworkInterfaces:

+        - NetworkInterfaceId: !Ref PublicENI

+          DeviceIndex: 0

+        - NetworkInterfaceId: !Ref PrivateENI

+          DeviceIndex: 1

+      UserData: !Base64

+        Fn::Sub: |

+          #cloud-config

+          vyos_config_commands:

+            # Basic VyOS Configuration

+            - set system host-name 'VyOS-on-AWS'

+            - set interfaces ethernet eth0 description 'OUTSIDE'

+            - set interfaces ethernet eth1 description 'INSIDE'

+            - set interfaces ethernet eth1 dhcp-options no-default-route

+            - set system login banner pre-login 'Welcome to the VyOS on AWS'

+      Tags:

+        - Key: Name

+          Value: VyOS-Instance

+        - Key: Created by

+          Value: CloudFormation

+

+  # Elastic IP

+  VyOSPublicIPAddress:

+    Type: AWS::EC2::EIP

+    Properties:

+      Domain: vpc

+      Tags:

+        - Key: Name

+          Value: VyOS-Instance-EIP

+        - Key: Created by

+          Value: CloudFormation

+

+  # Elastic IP Association

+  EIPAssociation:

+    Type: AWS::EC2::EIPAssociation

+    Properties:

+      NetworkInterfaceId: !Ref PublicENI

+      AllocationId: !GetAtt VyOSPublicIPAddress.AllocationId

+

+# Outputs

+Outputs:

+  VPCId:

+    Description: VPC Id

+    Value: !If

+      - CreateVPC

+      - !Ref VPC

+      - !Ref ExistingVPCId

+  VPCPublicSubnetId:

+    Description: Public Subnet Id

+    Value: !If

+      - CreatePublicSubnet

+      - !Ref PublicSubnet

+      - !Ref ExistingPublicSubnetId

+  VPCPrivateSubnetId:

+    Description: Private Subnet Id

+    Value: !If

+      - CreatePrivateSubnet

+      - !Ref PrivateSubnet

+      - !Ref ExistingPrivateSubnetId

+  VyOSInstanceId:

+    Description: Instance ID of the VyOS instance

+    Value: !Ref VyOSInstance

+  VyOSPublicIp:

+    Description: Public IP address of the VyOS instance

+    Value: !Ref VyOSPublicIPAddress

+  VyOSMgmtUsername:

+    Description: Username for SSH access to the VyOS instance

+    Value: vyos

+  VyOSMgmtKeyPair:

+    Description: Name of the KeyPair used for SSH access

+    Value: !Ref KeyName  

+  VyOSMgmtInfo:

+    Description: VyOS managment information

+    Value: !Join 

+      - "\n" 

+      - - "Management allowed via SSH protocol default port 22. "

+        - "To access VyOS instance you need to have SSH client software (like Putty, MobaXterm etc). "

+        - "SSH access example: ssh vyos@192.0.2.1 -i /tmp/test.pem"

diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt b/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt
new file mode 100644
index 0000000..692feac
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt
@@ -0,0 +1,57 @@
+    set system host-name 'VyOS-in-Corporate-Data-Center'

+    set system login banner pre-login 'Welcome to the VyOS on Corporate Data Center'

+    set interfaces ethernet eth0 description 'OUTSIDE'

+    set interfaces ethernet eth0 address '10.1.1.4/24'

+    set interfaces ethernet eth1 description 'INSIDE'

+    set interfaces ethernet eth1 address '10.1.11.4/24'

+    set system name-server '8.8.8.8'

+    set system name-server '8.8.4.8'

+    set service dns forwarding name-server '8.8.8.8'

+    set service dns forwarding listen-address '10.1.11.4'

+    set service dns forwarding allow-from '10.1.11.0/24'

+    set service dns forwarding no-serve-rfc1918

+    set nat source rule 10 outbound-interface name 'eth0'

+    set nat source rule 10 source address '10.1.11.0/24'

+    set nat source rule 10 translation address 'masquerade'

+    set vpn ipsec interface 'eth0'

+    set vpn ipsec esp-group AWS lifetime '3600'

+    set vpn ipsec esp-group AWS mode 'tunnel'

+    set vpn ipsec esp-group AWS pfs 'dh-group2'

+    set vpn ipsec esp-group AWS proposal 1 encryption 'aes256'

+    set vpn ipsec esp-group AWS proposal 1 hash 'sha1'

+    set vpn ipsec ike-group AWS dead-peer-detection action 'restart'

+    set vpn ipsec ike-group AWS dead-peer-detection interval '15'

+    set vpn ipsec ike-group AWS dead-peer-detection timeout '30'

+    set vpn ipsec ike-group AWS ikev2-reauth

+    set vpn ipsec ike-group AWS key-exchange 'ikev2'

+    set vpn ipsec ike-group AWS lifetime '28800'

+    set vpn ipsec ike-group AWS proposal 1 dh-group '2'

+    set vpn ipsec ike-group AWS proposal 1 encryption 'aes256'

+    set vpn ipsec ike-group AWS proposal 1 hash 'sha1'

+    set vpn ipsec ike-group AWS close-action start

+    set vpn ipsec option disable-route-autoinstall

+    set interfaces vti vti1 address '10.2.100.11/32'

+    set interfaces vti vti1 description 'Tunnel to VyOS on AWS'

+    set interfaces vti vti1 ip adjust-mss '1350'

+    set protocols static route 10.1.100.11/32 interface vti1

+    set vpn ipsec authentication psk VyOS id '10.1.1.4'

+    set vpn ipsec authentication psk VyOS id '10.0.1.10'

+    set vpn ipsec authentication psk VyOS secret 'ch00s3-4-s3cur3-psk'

+    set vpn ipsec site-to-site peer VyOS-on-AWS authentication local-id '10.1.1.4'

+    set vpn ipsec site-to-site peer VyOS-on-AWS authentication mode 'pre-shared-secret'

+    set vpn ipsec site-to-site peer VyOS-on-AWS authentication remote-id '10.0.1.10'

+    set vpn ipsec site-to-site peer VyOS-on-AWS connection-type 'initiate'

+    set vpn ipsec site-to-site peer VyOS-on-AWS description 'AWS TUNNEL to VyOS on AWS'

+    set vpn ipsec site-to-site peer VyOS-on-AWS ike-group 'AWS'

+    set vpn ipsec site-to-site peer VyOS-on-AWS ikev2-reauth 'inherit'

+    set vpn ipsec site-to-site peer VyOS-on-AWS local-address '10.1.1.4'

+    set vpn ipsec site-to-site peer VyOS-on-AWS remote-address '192.0.2.2'

+    set vpn ipsec site-to-site peer VyOS-on-AWS vti bind 'vti1'

+    set vpn ipsec site-to-site peer VyOS-on-AWS vti esp-group 'AWS'

+    set protocols bgp system-as '65002'

+    set protocols bgp address-family ipv4-unicast network 10.1.11.0/24

+    set protocols bgp neighbor 10.1.100.11 remote-as '192.0.2.1'

+    set protocols bgp neighbor 10.1.100.11 address-family ipv4-unicast soft-reconfiguration inbound

+    set protocols bgp neighbor 10.1.100.11 timers holdtime '30'

+    set protocols bgp neighbor 10.1.100.11 timers keepalive '10'

+    set protocols bgp neighbor 10.1.100.11 ebgp-multihop '10'
\ No newline at end of file
diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md b/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md
new file mode 100644
index 0000000..7845fb4
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md
@@ -0,0 +1,95 @@
+# VyOS Deployment with Advanced Configuration

+

+## Overview

+This manual guides the deployment of a VyOS instance in AWS using CloudFormation. The template sets up:

+- VPC with public and private subnets

+- Internet Gateway, Route Tables, ENIs, Security Groups, Elastic IP

+- Configuration via cloud-init

+

+This automated setup ensures a consistent, efficient deployment process.

+

+## Prerequisites

+- **AWS Account**: Permissions to manage VPCs, EC2 instances, etc.

+- **EC2 Key Pair**: Valid SSH key for accessing VyOS.

+- **AWS Console/CLI**: Familiarity with AWS Console or CLI for stack management.

+

+## CloudFormation Template Overview

+

+### Parameters

+

+#### Existing VPC and Subnet Parameters

+For deployment to an existing VPC, provide VPC and Subnet IDs; leave blank for a new VPC.

+- **ExistingVPCId**: (Optional) VPC ID

+- **ExistingPublicSubnetId**: (Optional) Public Subnet ID

+- **ExistingPrivateSubnetId**: (Optional) Private Subnet ID

+

+#### New VPC Parameters

+For a new VPC, specify:

+- **VPCName**: Name of the new VPC

+- **VPCCidrBlock**: CIDR block (e.g., 10.0.0.0/16)

+

+#### Subnet Parameters

+- **PublicSubnetCidr**: CIDR for the public subnet

+- **PrivateSubnetCidr**: CIDR for the private subnet

+

+#### VyOS Instance Parameters

+- **InstanceType**: EC2 instance type (e.g., t3.medium)

+- **KeyName**: Name of EC2 KeyPair

+- **VyOSPublicENIip**: Private IP in the public subnet

+- **VyOSPrivENIip**: Private IP in the private subnet

+- **VyOSBGPASNumber**: BGP ASN for VyOS

+- **DNS1/DNS2**: Primary/Secondary DNS IP

+- **SSHAllowedIP**: CIDR for SSH access (e.g., 192.0.2.0/24)

+- **AmiAlias**: Specify VyOS AMI alias (e.g., `latest` or version `/aws/.../1.4.0`)

+

+#### BGP/VPN Peer Parameters

+- **OnPremPublicIPAddress**: Public IP of on-premise VPN endpoint

+- **OnPremBGPASNumber**: BGP ASN for on-premise endpoint

+

+### Resources

+1. **VPC**: Creates a new VPC or uses an existing one

+2. **Subnets**: Public and private subnets

+3. **Internet Gateway**: For public subnet internet access

+4. **Route Tables**: Routing configuration for traffic between subnets and Internet Gateway

+5. **ENIs**: Elastic Network Interfaces for public and private IPs

+6. **Security Groups**: Public/Private Security Groups

+7. **VyOS Instance**: Configured via cloud-init with specified AMI and instance type

+

+### Conditions

+Conditions determine whether to create a new VPC or use an existing one.

+

+## Deployment Scenarios

+

+### Existing VPC Deployment

+1. In **AWS Console**, go to **CloudFormation** > **Create Stack**

+2. Choose **Upload a template** and select the `.yaml` file

+3. Enter **Stack Details** and existing **VPC/Subnet IDs**

+4. Configure **VyOS Instance Parameters**

+5. Add on-prem VyOS parameters and finish deployment

+6. Confirm **CREATE_COMPLETE** status and retrieve Public IP from **Outputs**

+

+### New VPC Deployment

+1. Follow the steps above but add new **VPC name, CIDR, and Subnet CIDRs**

+2. Complete **VyOS Instance Configuration**

+3. Confirm deployment and retrieve Public IP from **Outputs**

+

+## Access and Management

+Use SSH to connect:

+```bash

+ssh vyos@<VyOS_Public_IP_Address> -i <test-key.pem>

+```

+

+## Common Commands for VyOS Management

+

+- **show configuration commands**: Displays the current configuration.

+- **show interfaces**: Lists all network interfaces and their status.

+- **show ip route**: Shows the IP routing table.

+- **show ip bgp summary**: Summarizes BGP neighbors and sessions.

+- **show vpn ipsec sa**: Displays the status of IPsec Security Associations.

+- **show vpn ike sa**: Shows the status of IKE Security Associations.

+- **show vpn ipsec connections**: Lists current IPsec VPN connections.

+- **show firewall summary**: Summarizes firewall rules and statistics.

+- **show firewall statistics**: Provides detailed firewall statistics.

+

+For additional commands and configurations, refer to the [VyOS Documentation](https://docs.vyos.io/en/sagitta/).

+

diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml b/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml
new file mode 100644
index 0000000..063712e
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml
@@ -0,0 +1,812 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: VyOS Networks CloudFormation template to deploy a VPC with public
+  and private subnets, an Internet gateway, Route tables, ENIs, Elastic IP
+  Address and a VyOS instance with subscription (Pay As You Go) and configures
+  VyOS instance via user-data (cloud-init).
+
+Parameters:
+  ExistingVPCId:
+    Description: ID of an existing VPC
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^vpc-[0-9a-fA-F]{8,17}$
+    ConstraintDescription: Must be a valid VPC ID or empty.
+
+  ExistingPublicSubnetId:
+    Description: ID of an existing public subnet
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+    ConstraintDescription: Must be a valid public subnet ID or empty.
+
+  ExistingPrivateSubnetId:
+    Description: ID of an existing private subnet
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+    ConstraintDescription: Must be a valid private subnet ID or empty.
+
+  VPCName:
+    Description: Name of the VPC
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^.{1,128}$
+    MaxLength: 128
+    ConstraintDescription: Must be empty or between 1 and 128 characters.
+
+  VPCCidrBlock:
+    Description: CIDR block for the VPC
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+      ranges based on RFC 1918, with subnet sizes between /16 and /28, or can be
+      empty if we deploy VyOS instance to the existig VPC.
+
+  PublicSubnetCidr:
+    Description: CIDR block for the Public Subnet
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+      ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+  PrivateSubnetCidr:
+    Description: CIDR block for the Private Subnet
+    Type: String
+    Default: ''
+    AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+    ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+      ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+  InstanceType:
+    Description: EC2 instance type for VyOS deployment
+    Type: String
+    Default: c5n.large
+    AllowedValues:
+      - t3.small
+      - t3.medium
+      - t3.large
+      - t3.xlarge
+      - t3.2xlarge
+      - t3a.small
+      - t3a.medium
+      - t3a.large
+      - t3a.xlarge
+      - t3a.2xlarge
+      - m4.large
+      - m4.xlarge
+      - m4.2xlarge
+      - m4.4xlarge
+      - m4.10xlarge
+      - m4.16xlarge
+      - m5.large
+      - m5.xlarge
+      - m5.2xlarge
+      - m5.4xlarge
+      - m5.8xlarge
+      - m5a.large
+      - m5a.xlarge
+      - m5a.2xlarge
+      - m5a.4xlarge
+      - m5a.8xlarge
+      - m5a.12xlarge
+      - m5n.large
+      - m5n.xlarge
+      - m5n.2xlarge
+      - m5n.4xlarge
+      - m5n.8xlarge
+      - m5n.12xlarge
+      - m5zn.large
+      - m5zn.xlarge
+      - m5zn.2xlarge
+      - m5zn.3xlarge
+      - m5zn.6xlarge
+      - m5zn.12xlarge
+      - m6i.large
+      - m6i.xlarge
+      - m6i.2xlarge
+      - m6i.4xlarge
+      - m6i.8xlarge
+      - m6i.12xlarge
+      - m6i.16xlarge
+      - c4.large
+      - c4.xlarge
+      - c4.2xlarge
+      - c4.4xlarge
+      - c4.8xlarge
+      - c5.large
+      - c5.xlarge
+      - c5.2xlarge
+      - c5.4xlarge
+      - c5.9xlarge
+      - c5d.large
+      - c5d.xlarge
+      - c5d.2xlarge
+      - c5d.4xlarge
+      - c5d.9xlarge
+      - c5a.large
+      - c5a.xlarge
+      - c5a.2xlarge
+      - c5a.4xlarge
+      - c5a.8xlarge
+      - c5n.large
+      - c5n.xlarge
+      - c5n.2xlarge
+      - c5n.4xlarge
+      - c5n.9xlarge
+      - c6i.large
+      - c6i.xlarge
+      - c6i.2xlarge
+      - c6i.4xlarge
+      - c6i.8xlarge
+      - c6i.12xlarge
+      - c6i.16xlarge
+      - c6i.24xlarge
+      - m6a.large
+      - m6a.xlarge
+      - m6a.2xlarge
+      - m6a.4xlarge
+      - m6a.8xlarge
+      - m6a.12xlarge
+      - m6a.16xlarge
+      - m6in.large
+      - m6in.xlarge
+      - m6in.2xlarge
+      - m6in.4xlarge
+      - m6in.8xlarge
+      - m6in.12xlarge
+      - m6in.16xlarge
+      - m6in.24xlarge
+      - m6in.32xlarge
+      - m6in.metal
+      - m7i.large
+      - m7i.xlarge
+      - m7i.2xlarge
+      - m7i.4xlarge
+      - m7i.8xlarge
+      - m7i-flex.large
+      - m7i-flex.xlarge
+      - m7i-flex.2xlarge
+      - m7i-flex.4xlarge
+      - m7i-flex.8xlarge
+
+  KeyName:
+    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    Type: AWS::EC2::KeyPair::KeyName
+    ConstraintDescription: Must not be empty
+
+  VyOSPublicENIip:
+    Description: Private IP address for VyOS instance ENI
+    Type: String
+    AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+    ConstraintDescription: Must be a valid IP address in the Public Subnet CIDR block
+
+  VyOSPrivENIip:
+    Description: Private IP address for VyOS instance ENI
+    Type: String
+    AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+    ConstraintDescription: Must be a valid IP address in the Private Subnet CIDR block
+
+  OnPremPublicIPAddress:
+    Description: The public IP address for the on-premise VPN endpoint
+    Type: String
+    Default: 192.0.2.1
+    AllowedPattern: ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+    ConstraintDescription: Must be a valid IPv4 public address.
+
+  VyOSBGPASNumber:
+    Description: The BGP Autonomous System Number for VyOS
+    Type: Number
+    Default: 65001
+    MinValue: 1
+    MaxValue: 65535
+    ConstraintDescription: Must be a valid BGP ASN between 1 and 65535.
+
+  OnPremBGPASNumber:
+    Description: The BGP Autonomous System Number for the on-premise VPN endpoint
+    Type: Number
+    Default: 65002
+    MinValue: 1
+    MaxValue: 65535
+    ConstraintDescription: Must be a valid BGP ASN between 1 and 65535.
+
+  DNS1:
+    Description: Primary DNS server
+    Type: String
+    Default: 8.8.8.8
+    AllowedPattern: ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+    ConstraintDescription: Must be a valid DNS server IP address.
+
+  DNS2:
+    Description: Secondary DNS server
+    Type: String
+    Default: 8.8.4.4
+    AllowedPattern: ^$|^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+    ConstraintDescription: Must be a valid DNS server IP address.
+
+  SSHAllowedIP:
+    Description: The IP subnet allowed to SSH into the VyOS instance
+    Type: String
+    Default: 192.0.2.0/24
+    AllowedPattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(2[4-9]|3[0-2]))$
+    ConstraintDescription: Must be a valid IPv4 CIDR within range /24 to /32
+
+  # VyOS AMI Aliase. 
+  # If you set "latest" option CloudFormation will choose the latest version of the VyOS. 
+  # But if you want to deploy a more specific version you should change the latest to part of the alias like /aws/.../1.3.6, /aws/.../1.4.0.
+  # After changing this please look at the Resources part "VyOSInstance"s User-Data field because there could be VyOS CLI commands changes.
+  # Check VyOS official documentation for command reference.
+
+  AmiAlias:
+    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
+    Default: /aws/service/marketplace/prod-ev235jujteaom/latest
+    Description: AMI Alias of the VyOS instance
+
+Metadata:
+  AWS::CloudFormation::Interface:
+    ParameterGroups:
+      - Label:
+          default: 'Current VPC configuration. If you want deploy instance to your
+            existing VPC please add VPC and Subnet IDs to regareded fields:'
+        Parameters:
+          - ExistingVPCId
+          - ExistingPublicSubnetId
+          - ExistingPrivateSubnetId
+      - Label:
+          default: 'New VPC and CIDR configuration. If you want to deploy instance to new
+            VPC please fill regarded fields:'
+        Parameters:
+          - VPCName
+          - VPCCidrBlock
+      - Label:
+          default: 'Subnet CIDRs configurations. Add existing or new subnet CIDRs to the
+            regarded fields:'
+        Parameters:
+          - PublicSubnetCidr
+          - PrivateSubnetCidr
+      - Label:
+          default: 'VyOS Instance Configuration:'
+        Parameters:
+          - InstanceType
+          - KeyName
+          - VyOSPublicENIip
+          - VyOSPrivENIip
+          - VyOSBGPASNumber
+          - DNS1
+          - DNS2
+          - SSHAllowedIP
+      - Label:
+          default: 'On-Premise instance parameters:'
+        Parameters:
+          - OnPremPublicIPAddress
+          - OnPremBGPASNumber
+
+    ParameterLabels:
+      ExistingVPCId:
+        default: Existing VPC ID (optional if deploy existing VPC)
+      ExistingPublicSubnetId:
+        default: Existing Public Subnet ID (optional if deploy existing VPC)
+      ExistingPrivateSubnetId:
+        default: Existing Private Subnet ID (optional if deploy existing VPC)
+      VPCName:
+        default: VPC Name (required if you deploy new VPC)
+      VPCCidrBlock:
+        default: VPC CIDR Block (required if you deploy new VPC)
+      PublicSubnetCidr:
+        default: Public Subnet CIDR (required)
+      PrivateSubnetCidr:
+        default: Private Subnet CIDR (required)
+      InstanceType:
+        default: Instance Type (required)
+      KeyName:
+        default: EC2 KeyPair Name (required)
+      VyOSPublicENIip:
+        default: VyOS Public ENI IP (required)
+      VyOSPrivENIip:
+        default: VyOS Private ENI IP (required)
+      OnPremPublicIPAddress:
+        default: On-Premies Public IP Address (required)
+      VyOSBGPASNumber:
+        default: VyOS BGP ASN (required)
+      OnPremBGPASNumber:
+        default: On-Premies BGP ASN (required)
+      DNS1:
+        default: Primary DNS Server IP Address (required)
+      DNS2:
+        default: Secondary DNS Server IP Address (optional)
+      SSHAllowedIP:
+        default: SSH Allowed IP Subnet (required)
+
+Conditions:
+  CreateVPC: !Equals
+    - !Ref ExistingVPCId
+    - ''
+  CreatePublicSubnet: !Equals
+    - !Ref ExistingPublicSubnetId
+    - ''
+  CreatePrivateSubnet: !Equals
+    - !Ref ExistingPrivateSubnetId
+    - ''
+
+Resources:
+  # VPC
+  VPC:
+    Type: AWS::EC2::VPC
+    Condition: CreateVPC
+    Properties:
+      CidrBlock: !Ref VPCCidrBlock
+      EnableDnsSupport: 'true'
+      EnableDnsHostnames: 'true'
+      Tags:
+        - Key: Name
+          Value: !Ref VPCName
+
+  # Subnets
+  PublicSubnet:
+    Type: AWS::EC2::Subnet
+    Condition: CreatePublicSubnet
+    DependsOn: VPC
+    Properties:
+      VpcId: !If
+        - CreateVPC
+        - !Ref VPC
+        - !Ref ExistingVPCId
+      CidrBlock: !Ref PublicSubnetCidr
+      MapPublicIpOnLaunch: 'true'
+      AvailabilityZone: !Select
+        - 0
+        - !GetAZs ''
+      Tags:
+        - Key: Name
+          Value: Public Subnet
+
+  PrivateSubnet:
+    Type: AWS::EC2::Subnet
+    Condition: CreatePrivateSubnet
+    DependsOn: VPC
+    Properties:
+      VpcId: !If
+        - CreateVPC
+        - !Ref VPC
+        - !Ref ExistingVPCId
+      CidrBlock: !Ref PrivateSubnetCidr
+      MapPublicIpOnLaunch: 'false'
+      AvailabilityZone: !Select
+        - 0
+        - !GetAZs ''
+      Tags:
+        - Key: Name
+          Value: Private Subnet
+
+  # Internet Gateway
+  InternetGateway:
+    Type: AWS::EC2::InternetGateway
+    Condition: CreateVPC
+    Properties:
+      Tags:
+        - Key: Name
+          Value: Internet Gateway
+        - Key: Created by
+          Value: CloudFormation
+
+  AttachGateway:
+    Type: AWS::EC2::VPCGatewayAttachment
+    Condition: CreateVPC
+    Properties:
+      VpcId: !Ref VPC
+      InternetGatewayId: !Ref InternetGateway
+
+  # Route Tables
+  PublicRouteTable:
+    Type: AWS::EC2::RouteTable
+    Condition: CreateVPC
+    Properties:
+      VpcId: !If
+        - CreateVPC
+        - !Ref VPC
+        - !Ref ExistingVPCId
+      Tags:
+        - Key: Name
+          Value: Public Route Table
+        - Key: Created by
+          Value: CloudFormation
+
+  PublicRoute:
+    Type: AWS::EC2::Route
+    Condition: CreateVPC
+    Properties:
+      RouteTableId: !Ref PublicRouteTable
+      DestinationCidrBlock: 0.0.0.0/0
+      GatewayId: !If
+        - CreateVPC
+        - !Ref InternetGateway
+        - !Ref ExistingPublicSubnetId
+
+  PublicSubnetRouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Condition: CreateVPC
+    Properties:
+      SubnetId: !Ref PublicSubnet
+      RouteTableId: !Ref PublicRouteTable
+
+  # Security Groups
+  VyOSPublicSG:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: Enable access from outside
+      VpcId: !If
+        - CreateVPC
+        - !Ref VPC
+        - !Ref ExistingVPCId
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 22
+          ToPort: 22
+          CidrIp: !Ref SSHAllowedIP
+          Description: Allow SSH access
+        - IpProtocol: udp
+          FromPort: 51820
+          ToPort: 51820
+          CidrIp: 0.0.0.0/0
+          Description: Allow WireGuard VPN access
+        - IpProtocol: udp
+          FromPort: 1194
+          ToPort: 1194
+          CidrIp: 0.0.0.0/0
+          Description: Allow OpenVPN access
+        - IpProtocol: udp
+          FromPort: 500
+          ToPort: 500
+          CidrIp: 0.0.0.0/0
+          Description: Allow IPSec VPN access (ISAKMP)
+        - IpProtocol: udp
+          FromPort: 1701
+          ToPort: 1701
+          CidrIp: 0.0.0.0/0
+          Description: Allow L2TP VPN access
+        - IpProtocol: udp
+          FromPort: 4500
+          ToPort: 4500
+          CidrIp: 0.0.0.0/0
+          Description: Allow IPSec NAT Traversal
+      Tags:
+        - Key: Name
+          Value: PublicSG
+        - Key: Created by
+          Value: CloudFormation
+
+  VyOSPrivateSG:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: Enable access from inside
+      VpcId: !If
+        - CreateVPC
+        - !Ref VPC
+        - !Ref ExistingVPCId
+      SecurityGroupIngress:
+        - IpProtocol: -1 
+          CidrIp: 0.0.0.0/0
+          Description: Allow all protocols and ports
+      Tags:
+        - Key: Name
+          Value: PrivateSG
+        - Key: Created by
+          Value: CloudFormation
+
+  # ENIs
+  PublicENI:
+    Type: AWS::EC2::NetworkInterface
+    Properties:
+      SubnetId: !If
+        - CreatePublicSubnet
+        - !Ref PublicSubnet
+        - !Ref ExistingPublicSubnetId
+      Description: Public Network Interface
+      PrivateIpAddress: !Ref VyOSPublicENIip
+      GroupSet:
+        - !Ref VyOSPublicSG
+      Tags:
+        - Key: Name
+          Value: PublicENI
+        - Key: Created by
+          Value: CloudFormation
+
+  PrivateENI:
+    Type: AWS::EC2::NetworkInterface
+    Properties:
+      SubnetId: !If
+        - CreatePrivateSubnet
+        - !Ref PrivateSubnet
+        - !Ref ExistingPrivateSubnetId
+      Description: Private Network Interface
+      PrivateIpAddress: !Ref VyOSPrivENIip
+      GroupSet:
+        - !Ref VyOSPrivateSG
+      Tags:
+        - Key: Name
+          Value: PrivateENI
+        - Key: Created by
+          Value: CloudFormation
+
+  # VyOS Instance
+  VyOSInstance:
+    Type: AWS::EC2::Instance
+    Properties:
+      InstanceType: !Ref InstanceType
+      KeyName: !Ref KeyName
+      ImageId: !Ref AmiAlias
+      NetworkInterfaces:
+        - NetworkInterfaceId: !Ref PublicENI
+          DeviceIndex: 0
+        - NetworkInterfaceId: !Ref PrivateENI
+          DeviceIndex: 1
+      UserData: !Base64
+        Fn::Sub: |
+          #cloud-config
+          vyos_config_commands:
+            # Basic VyOS Configuration
+            - set system host-name 'VyOS-on-AWS'
+            - set interfaces ethernet eth0 description 'OUTSIDE'
+            - set interfaces ethernet eth1 description 'INSIDE'
+            - set system login banner pre-login 'Welcome to the VyOS on AWS'
+            - set interfaces ethernet eth1 dhcp-options no-default-route
+            # DNS and DNS Forwarding Configuration
+            - set system name-server '${DNS1}'
+            - set system name-server '${DNS2}'
+            - set service dns forwarding name-server '${DNS1}'
+            - set service dns forwarding listen-address '${VyOSPrivENIip}'
+            - set service dns forwarding allow-from '${PrivateSubnetCidr}'
+            - set service dns forwarding no-serve-rfc1918
+            # Source NAT (SNAT) Configuration
+            - set nat source rule 10 outbound-interface name 'eth0'
+            - set nat source rule 10 source address '${PrivateSubnetCidr}'
+            - set nat source rule 10 translation address 'masquerade'
+            # Site-to-Site VPN Configuration
+            - set vpn ipsec interface 'eth0'
+            - set vpn ipsec esp-group AWS-POC lifetime '3600'
+            - set vpn ipsec esp-group AWS-POC mode 'tunnel'
+            - set vpn ipsec esp-group AWS-POC pfs 'dh-group2'
+            - set vpn ipsec esp-group AWS-POC proposal 1 encryption 'aes256'
+            - set vpn ipsec esp-group AWS-POC proposal 1 hash 'sha1'
+            - set vpn ipsec ike-group AWS-POC dead-peer-detection action 'restart'
+            - set vpn ipsec ike-group AWS-POC dead-peer-detection interval '15'
+            - set vpn ipsec ike-group AWS-POC dead-peer-detection timeout '30'
+            - set vpn ipsec ike-group AWS-POC ikev2-reauth
+            - set vpn ipsec ike-group AWS-POC key-exchange 'ikev2'
+            - set vpn ipsec ike-group AWS-POC lifetime '28800'
+            - set vpn ipsec ike-group AWS-POC proposal 1 dh-group '2'
+            - set vpn ipsec ike-group AWS-POC proposal 1 encryption 'aes256'
+            - set vpn ipsec ike-group AWS-POC proposal 1 hash 'sha1'
+            - set vpn ipsec ike-group AWS-POC close-action start
+            - set vpn ipsec option disable-route-autoinstall
+            - set interfaces vti vti1 address '10.1.100.11/32'
+            - set interfaces vti vti1 description 'Tunnel VyOS 02'
+            - set interfaces vti vti1 ip adjust-mss '1350'
+            - set protocols static route 10.2.100.11/32 interface vti1
+            - set vpn ipsec authentication psk VyOS id '${VyOSPublicENIip}'
+            - set vpn ipsec authentication psk VyOS id '${OnPremPublicIPAddress}'
+            - set vpn ipsec authentication psk VyOS secret 'ch00s3-4-s3cur3-psk'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem authentication local-id '${VyOSPublicENIip}'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem authentication mode 'pre-shared-secret'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem authentication remote-id '${OnPremPublicIPAddress}'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem connection-type 'none'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem description 'AWS-POC TUNNEL to VyOS on Prem'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem ike-group 'AWS-POC'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem ikev2-reauth 'inherit'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem local-address '${VyOSPublicENIip}'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem remote-address '${OnPremPublicIPAddress}'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem vti bind 'vti1'
+            - set vpn ipsec site-to-site peer VyOS-on-Prem vti esp-group 'AWS-POC'
+            # BGP Configuration
+            - set protocols bgp system-as '${VyOSBGPASNumber}'
+            - set protocols bgp address-family ipv4-unicast network ${PrivateSubnetCidr}
+            - set protocols bgp neighbor 10.2.100.11 remote-as '${OnPremBGPASNumber}'
+            - set protocols bgp neighbor 10.2.100.11 address-family ipv4-unicast soft-reconfiguration inbound
+            - set protocols bgp neighbor 10.2.100.11 timers holdtime '30'
+            - set protocols bgp neighbor 10.2.100.11 timers keepalive '10'
+            - set protocols bgp neighbor 10.2.100.11 disable-connected-check
+            # Firewall Groups (Collections of IP addresses, networks, ports, MAC addresses, domains, or interfaces)
+            - set firewall group network-group Local network '${PrivateSubnetCidr}'
+            - set firewall group port-group dns_ports port '53'
+            - set firewall group port-group mail_ports port '110'
+            - set firewall group port-group mail_ports port '25'
+            - set firewall group port-group web_ports port '443'
+            - set firewall group port-group web_ports port '8080'
+            - set firewall group port-group web_ports port '80'
+            # Firewall Forwarding Rules (Traffic Transiting Through the VyOS Instance)
+            - set firewall ipv4 forward filter default-action 'drop'    #  Default-action 'drop' means drop non allowed (which allowed by rules) transit traffic.
+            # These rules blocks all traffic which was not initiated from the internal/LAN side first.
+            - set firewall ipv4 forward filter rule 10 action 'accept'
+            - set firewall ipv4 forward filter rule 10 state 'established'
+            - set firewall ipv4 forward filter rule 10 state 'related'
+            - set firewall ipv4 forward filter rule 11 action 'drop'
+            - set firewall ipv4 forward filter rule 11 state 'invalid'
+            # These rules allow ICMP traffic from outside in (from WAN to LAN)
+            - set firewall ipv4 forward filter rule 20 action 'accept'
+            - set firewall ipv4 forward filter rule 20 description 'Allow ICMP'
+            - set firewall ipv4 forward filter rule 20 icmp type-name 'echo-request'
+            - set firewall ipv4 forward filter rule 20 inbound-interface name 'eth0'
+            - set firewall ipv4 forward filter rule 20 protocol 'icmp'
+            - set firewall ipv4 forward filter rule 20 state 'new'
+            # These rules allow forward SSH traffic from outside in (from WAN to LAN) and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+            - set firewall ipv4 forward filter rule 30 action 'drop'
+            - set firewall ipv4 forward filter rule 30 description 'Mitigate SSH brute-forcing'
+            - set firewall ipv4 forward filter rule 30 destination port '22'
+            - set firewall ipv4 forward filter rule 30 inbound-interface name 'eth0'
+            - set firewall ipv4 forward filter rule 30 protocol 'tcp'
+            - set firewall ipv4 forward filter rule 30 recent count '4'
+            - set firewall ipv4 forward filter rule 30 recent time 'minute'
+            - set firewall ipv4 forward filter rule 30 state 'new'
+            - set firewall ipv4 forward filter rule 31 action 'accept'
+            - set firewall ipv4 forward filter rule 31 description 'Allow SSH'
+            - set firewall ipv4 forward filter rule 31 destination port '22'
+            - set firewall ipv4 forward filter rule 31 inbound-interface name 'eth0'
+            - set firewall ipv4 forward filter rule 31 protocol 'tcp'
+            - set firewall ipv4 forward filter rule 31 state 'new'
+            # These rules allow ICMP traffic from inside out (from LAN to WAN)
+            - set firewall ipv4 forward filter rule 110 action 'accept'
+            - set firewall ipv4 forward filter rule 110 description 'LAN clients ICMP'
+            - set firewall ipv4 forward filter rule 110 icmp type-name 'echo-request'
+            - set firewall ipv4 forward filter rule 110 inbound-interface name 'eth1'
+            - set firewall ipv4 forward filter rule 110 state 'new'
+            # These rules allow forward SSH traffic from indide out (from LAN to WAN) and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+            - set firewall ipv4 forward filter rule 120 action 'drop'
+            - set firewall ipv4 forward filter rule 120 description 'Mitigate clients SSH brute-forcing'
+            - set firewall ipv4 forward filter rule 120 destination port '22'
+            - set firewall ipv4 forward filter rule 120 inbound-interface name 'eth1'
+            - set firewall ipv4 forward filter rule 120 protocol 'tcp'
+            - set firewall ipv4 forward filter rule 120 recent count '4'
+            - set firewall ipv4 forward filter rule 120 recent time 'minute'
+            - set firewall ipv4 forward filter rule 120 state 'new'
+            - set firewall ipv4 forward filter rule 121 action 'accept'
+            - set firewall ipv4 forward filter rule 121 description 'Allow clients SSH'
+            - set firewall ipv4 forward filter rule 121 destination port '22'
+            - set firewall ipv4 forward filter rule 121 inbound-interface name 'eth1'
+            - set firewall ipv4 forward filter rule 121 protocol 'tcp'
+            - set firewall ipv4 forward filter rule 121 state 'new'
+            # Firewall input rules means firewall (VyOS instance) traffic toward the instance itself
+            - set firewall ipv4 input filter default-action 'drop'  #  Default-action 'drop' means drop non allowed (which allowed by rules) inbound traffic.
+            # This configuration creates a proper stateful firewall that blocks all traffic which was not initiated from the internal/LAN side first.
+            - set firewall ipv4 input filter rule 10 action 'accept'
+            - set firewall ipv4 input filter rule 10 description 'Allow established/related'
+            - set firewall ipv4 input filter rule 10 state 'established'
+            - set firewall ipv4 input filter rule 10 state 'related'
+            - set firewall ipv4 input filter rule 11 action 'drop'
+            - set firewall ipv4 input filter rule 11 state 'invalid'
+            # These rules allowes WireGuard, OpenVPN, ESP, ISAKMP, IPSec NAT Traversal, L2TP and ICMP traffic towards VyOS instance via eth0 interface (WAN interface)
+            - set firewall ipv4 input filter rule 20 action 'accept'
+            - set firewall ipv4 input filter rule 20 description 'WireGuard_IN'
+            - set firewall ipv4 input filter rule 20 destination port '51820'
+            - set firewall ipv4 input filter rule 20 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 20 log
+            - set firewall ipv4 input filter rule 20 protocol 'udp'
+            - set firewall ipv4 input filter rule 30 action 'accept'
+            - set firewall ipv4 input filter rule 30 description 'OpenVPN_IN'
+            - set firewall ipv4 input filter rule 30 destination port '1194'
+            - set firewall ipv4 input filter rule 30 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 30 log
+            - set firewall ipv4 input filter rule 30 protocol 'udp'
+            - set firewall ipv4 input filter rule 40 action 'accept'
+            - set firewall ipv4 input filter rule 40 description 'Allow ESP'
+            - set firewall ipv4 input filter rule 40 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 40 protocol 'esp'
+            - set firewall ipv4 input filter rule 50 action 'accept'
+            - set firewall ipv4 input filter rule 50 description 'Allow ISAKMP'
+            - set firewall ipv4 input filter rule 50 destination port '500'
+            - set firewall ipv4 input filter rule 50 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 50 protocol 'udp'
+            - set firewall ipv4 input filter rule 60 action 'accept'
+            - set firewall ipv4 input filter rule 60 description 'IPSec NAT Traversal'
+            - set firewall ipv4 input filter rule 60 destination port '4500'
+            - set firewall ipv4 input filter rule 60 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 60 protocol 'udp'
+            - set firewall ipv4 input filter rule 70 action 'accept'
+            - set firewall ipv4 input filter rule 70 description 'Allow L2TP'
+            - set firewall ipv4 input filter rule 70 destination port '1701'
+            - set firewall ipv4 input filter rule 70 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 70 ipsec match-ipsec
+            - set firewall ipv4 input filter rule 70 protocol 'udp'
+            - set firewall ipv4 input filter rule 80 action 'accept'
+            - set firewall ipv4 input filter rule 80 description 'Allow ICMP'
+            - set firewall ipv4 input filter rule 80 icmp type-name 'echo-request'
+            - set firewall ipv4 input filter rule 80 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 80 protocol 'icmp'
+            - set firewall ipv4 input filter rule 80 state 'new'
+            # These rules allow forward SSH traffic towards VyOS instance and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+            - set firewall ipv4 input filter rule 90 action 'drop'
+            - set firewall ipv4 input filter rule 90 description 'Mitigate SSH brute-forcing'
+            - set firewall ipv4 input filter rule 90 destination port '22'
+            - set firewall ipv4 input filter rule 90 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 90 protocol 'tcp'
+            - set firewall ipv4 input filter rule 90 recent count '4'
+            - set firewall ipv4 input filter rule 90 recent time 'minute'
+            - set firewall ipv4 input filter rule 90 state 'new'
+            - set firewall ipv4 input filter rule 91 action 'accept'
+            - set firewall ipv4 input filter rule 91 description 'Allow SSH'
+            - set firewall ipv4 input filter rule 91 destination port '22'
+            - set firewall ipv4 input filter rule 91 inbound-interface name 'eth0'
+            - set firewall ipv4 input filter rule 91 protocol 'tcp'
+            - set firewall ipv4 input filter rule 91 state 'new'
+            # These rules allowes ESP, ISAKMP, IPSec NAT Traversal, BGP and ICMP traffic towards VyOS instance via VTI interface
+            - set firewall ipv4 input filter rule 140 action 'accept'
+            - set firewall ipv4 input filter rule 140 description 'Allow ESP'
+            - set firewall ipv4 input filter rule 140 inbound-interface name 'vti1'
+            - set firewall ipv4 input filter rule 140 protocol 'esp'
+            - set firewall ipv4 input filter rule 150 action 'accept'
+            - set firewall ipv4 input filter rule 150 description 'Allow ISAKMP'
+            - set firewall ipv4 input filter rule 150 destination port '500'
+            - set firewall ipv4 input filter rule 150 inbound-interface name 'vti1'
+            - set firewall ipv4 input filter rule 150 protocol 'udp'
+            - set firewall ipv4 input filter rule 160 action 'accept'
+            - set firewall ipv4 input filter rule 160 description 'IPSec NAT Traversal'
+            - set firewall ipv4 input filter rule 160 destination port '4500'
+            - set firewall ipv4 input filter rule 160 inbound-interface name 'vti1'
+            - set firewall ipv4 input filter rule 160 protocol 'udp'
+            - set firewall ipv4 input filter rule 170 action 'accept'
+            - set firewall ipv4 input filter rule 170 description 'Allow ICMP'
+            - set firewall ipv4 input filter rule 170 icmp type-name 'echo-request'
+            - set firewall ipv4 input filter rule 170 inbound-interface name 'vti1'
+            - set firewall ipv4 input filter rule 170 protocol 'icmp'
+            - set firewall ipv4 input filter rule 170 state 'new'
+            - set firewall ipv4 input filter rule 180 action 'accept'
+            - set firewall ipv4 input filter rule 180 description 'Allow BGP'
+            - set firewall ipv4 input filter rule 180 destination port '179'
+            - set firewall ipv4 input filter rule 180 inbound-interface name 'vti1'
+            - set firewall ipv4 input filter rule 180 protocol 'tcp'
+      Tags:
+        - Key: Name
+          Value: VyOS-Instance
+        - Key: Created by
+          Value: CloudFormation
+
+  # Elastic IP
+  VyOSPublicIPAddress:
+    Type: AWS::EC2::EIP
+    Properties:
+      Domain: vpc
+      Tags:
+        - Key: Name
+          Value: VyOS-Instance-EIP
+        - Key: Created by
+          Value: CloudFormation
+
+  # Elastic IP Association
+  EIPAssociation:
+    Type: AWS::EC2::EIPAssociation
+    Properties:
+      NetworkInterfaceId: !Ref PublicENI
+      AllocationId: !GetAtt VyOSPublicIPAddress.AllocationId
+
+# Outputs
+Outputs:
+  VPCId:
+    Description: VPC Id
+    Value: !If
+      - CreateVPC
+      - !Ref VPC
+      - !Ref ExistingVPCId
+  PublicSubnetId:
+    Description: Public Subnet Id
+    Value: !If
+      - CreatePublicSubnet
+      - !Ref PublicSubnet
+      - !Ref ExistingPublicSubnetId
+  PrivateSubnetId:
+    Description: Private Subnet Id
+    Value: !If
+      - CreatePrivateSubnet
+      - !Ref PrivateSubnet
+      - !Ref ExistingPrivateSubnetId
+  VyOSInstanceId:
+    Description: Instance ID of the VyOS instance
+    Value: !Ref VyOSInstance
+  VyOSPublicIp:
+    Description: Public IP address of the VyOS instance
+    Value: !Ref VyOSPublicIPAddress
+  VyOSUsername:
+    Description: Username for SSH access to the VyOS instance
+    Value: vyos
+  KeyPairName:
+    Description: Name of the KeyPair used for SSH access
+    Value: !Ref KeyName
\ No newline at end of file