summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CloudFormation/readme.md12
-rw-r--r--CloudFormation/vyos-template-with-basic-configuration/readme.md65
-rw-r--r--CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml559
-rw-r--r--CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt57
-rw-r--r--CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md95
-rw-r--r--CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml812
6 files changed, 1600 insertions, 0 deletions
diff --git a/CloudFormation/readme.md b/CloudFormation/readme.md
new file mode 100644
index 0000000..b437838
--- /dev/null
+++ b/CloudFormation/readme.md
@@ -0,0 +1,12 @@
+# CloudFormation Templates for Deploying VyOS on AWS
+
+## Overview
+These CloudFormation templates automate the deployment of a VyOS instance on AWS, configuring essential components such as VPC, public/private subnets, internet gateway, route tables, Elastic IPs, and security groups.
+
+### Templates
+- **VyOS Deployment with Basic Configuration**: Includes essential VyOS instance configurations (for quick deployment).
+- **VyOS Deployment with Advanced Configuration**: Includes advanced VyOS instance configurations.
+
+## Deployment Scenarios
+- **Existing VPC**: Deploys VyOS within an existing VPC and subnet structure.
+- **New VPC**: Creates a fully configured VPC and subnet environment for VyOS deployment and deploys VyOS instance.
diff --git a/CloudFormation/vyos-template-with-basic-configuration/readme.md b/CloudFormation/vyos-template-with-basic-configuration/readme.md
new file mode 100644
index 0000000..5a953c1
--- /dev/null
+++ b/CloudFormation/vyos-template-with-basic-configuration/readme.md
@@ -0,0 +1,65 @@
+# VyOS Deployment with Basic Configuration
+
+## Template Overview
+
+This CloudFormation template automates the deployment of a VyOS instance, setting up:
+- A VPC with public and private subnets.
+- Internet Gateway, Route Tables, ENIs, Security Groups, and Elastic IP.
+- Configuration via cloud-init for a consistent, scalable setup.
+
+## Prerequisites
+
+Ensure the following prerequisites are met before deploying:
+- **AWS Account**: Active with necessary IAM permissions for VPCs, EC2 instances, etc.
+- **EC2 Key Pair**: Valid SSH key pair for instance access.
+- **AWS CLI/Console Access**: Familiarity with AWS Console or CLI for managing the CloudFormation stack.
+
+## Deployment Scenarios
+
+### Deploying to an Existing VPC
+
+1. Go to **AWS Console** > **CloudFormation**.
+2. Select **Create stack** - with new resources.
+3. Upload the `.yaml` template file.
+4. Specify stack details:
+ - **Stack name**.
+ - **Existing VPC and Subnet IDs** (must belong to the same AWS region and Availability Zone).
+5. Leave new VPC and Subnet CIDR fields empty.
+6. Configure VyOS Instance parameters:
+ - **Instance Type**.
+ - **EC2 Key Pair Name**.
+ - **ENI IPs** (according to the existing subnet CIDRs).
+ - **Primary and Secondary DNS** (optional).
+ - **SSH Allowed IP Subnet** (for remote access).
+
+ > **Note**: Setting `VyOS AMI Alias` to `latest` will deploy the latest version. Specify a specific version if needed, e.g., `/aws/service/marketplace/prod-ev235jujteaom/1.4.0`.
+
+7. Monitor stack creation until the **CREATE_COMPLETE** message appears.
+8. Retrieve the Public IP in the “Outputs” tab.
+
+### Deploying to a New VPC
+
+1. Go to **AWS Console** > **CloudFormation**.
+2. Select **Create stack** - with new resources.
+3. Upload the `.yaml` template file.
+4. Specify stack details:
+ - **New VPC name and CIDR**.
+ - **Public and Private Subnet CIDRs**.
+5. Leave existing VPC/Subnet IDs empty.
+6. Configure VyOS Instance parameters as listed above.
+7. Wait for **CREATE_COMPLETE** and find the Public IP under “Outputs”.
+
+## Access and Management
+
+To connect to the VyOS instance, use:
+- **VyOS Public IP** (from Outputs) and **EC2 Key Pair** with an SSH client.
+
+Sample command: `ssh vyos@<VyOS_Public_IP_Address> -i <test-key.pam>`
+
+### Common CLI Commands
+
+For VyOS configuration and interface checking:
+```bash
+show configuration commands
+show interfaces
+show ip route
diff --git a/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml b/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml
new file mode 100644
index 0000000..2dda6ce
--- /dev/null
+++ b/CloudFormation/vyos-template-with-basic-configuration/single-instance-with-basic-configuration.yml
@@ -0,0 +1,559 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: VyOS Networks CloudFormation template to deploy a VPC with public
+ and private subnets, an Internet gateway, Route tables, ENIs, Elastic IP
+ Address and a VyOS instance with subscription (Pay As You Go) and configures
+ VyOS instance via user-data (cloud-init).
+
+Parameters:
+ ExistingVPCId:
+ Description: ID of an existing VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^vpc-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid VPC ID or empty.
+
+ ExistingPublicSubnetId:
+ Description: ID of an existing public subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid public subnet ID or empty.
+
+ ExistingPrivateSubnetId:
+ Description: ID of an existing private subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid private subnet ID or empty.
+
+ VPCName:
+ Description: Name of the VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^.{1,128}$
+ MaxLength: 128
+ ConstraintDescription: Must be empty or between 1 and 128 characters.
+
+ VPCCidrBlock:
+ Description: CIDR block for the VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28, or can be empty if we deploy VyOS instance to the existig VPC.
+
+ PublicSubnetCidr:
+ Description: CIDR block for the Public Subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+ PrivateSubnetCidr:
+ Description: CIDR block for the Private Subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+ InstanceType:
+ Description: EC2 instance type for VyOS deployment
+ Type: String
+ Default: c5n.large
+ AllowedValues:
+ - t3.small
+ - t3.medium
+ - t3.large
+ - t3.xlarge
+ - t3.2xlarge
+ - t3a.small
+ - t3a.medium
+ - t3a.large
+ - t3a.xlarge
+ - t3a.2xlarge
+ - m4.large
+ - m4.xlarge
+ - m4.2xlarge
+ - m4.4xlarge
+ - m4.10xlarge
+ - m4.16xlarge
+ - m5.large
+ - m5.xlarge
+ - m5.2xlarge
+ - m5.4xlarge
+ - m5.8xlarge
+ - m5a.large
+ - m5a.xlarge
+ - m5a.2xlarge
+ - m5a.4xlarge
+ - m5a.8xlarge
+ - m5a.12xlarge
+ - m5n.large
+ - m5n.xlarge
+ - m5n.2xlarge
+ - m5n.4xlarge
+ - m5n.8xlarge
+ - m5n.12xlarge
+ - m5zn.large
+ - m5zn.xlarge
+ - m5zn.2xlarge
+ - m5zn.3xlarge
+ - m5zn.6xlarge
+ - m5zn.12xlarge
+ - m6i.large
+ - m6i.xlarge
+ - m6i.2xlarge
+ - m6i.4xlarge
+ - m6i.8xlarge
+ - m6i.12xlarge
+ - m6i.16xlarge
+ - c4.large
+ - c4.xlarge
+ - c4.2xlarge
+ - c4.4xlarge
+ - c4.8xlarge
+ - c5.large
+ - c5.xlarge
+ - c5.2xlarge
+ - c5.4xlarge
+ - c5.9xlarge
+ - c5d.large
+ - c5d.xlarge
+ - c5d.2xlarge
+ - c5d.4xlarge
+ - c5d.9xlarge
+ - c5a.large
+ - c5a.xlarge
+ - c5a.2xlarge
+ - c5a.4xlarge
+ - c5a.8xlarge
+ - c5n.large
+ - c5n.xlarge
+ - c5n.2xlarge
+ - c5n.4xlarge
+ - c5n.9xlarge
+ - c6i.large
+ - c6i.xlarge
+ - c6i.2xlarge
+ - c6i.4xlarge
+ - c6i.8xlarge
+ - c6i.12xlarge
+ - c6i.16xlarge
+ - c6i.24xlarge
+ - m6a.large
+ - m6a.xlarge
+ - m6a.2xlarge
+ - m6a.4xlarge
+ - m6a.8xlarge
+ - m6a.12xlarge
+ - m6a.16xlarge
+ - m6in.large
+ - m6in.xlarge
+ - m6in.2xlarge
+ - m6in.4xlarge
+ - m6in.8xlarge
+ - m6in.12xlarge
+ - m6in.16xlarge
+ - m6in.24xlarge
+ - m6in.32xlarge
+ - m6in.metal
+ - m7i.large
+ - m7i.xlarge
+ - m7i.2xlarge
+ - m7i.4xlarge
+ - m7i.8xlarge
+ - m7i-flex.large
+ - m7i-flex.xlarge
+ - m7i-flex.2xlarge
+ - m7i-flex.4xlarge
+ - m7i-flex.8xlarge
+
+ KeyName:
+ Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+ Type: AWS::EC2::KeyPair::KeyName
+ ConstraintDescription: Must not be empty
+
+ VyOSPublicENIip:
+ Description: Private IP address for VyOS instance ENI
+ Type: String
+ AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+ ConstraintDescription: Must be a valid IP address in the Public Subnet CIDR block
+
+ VyOSPrivENIip:
+ Description: Private IP address for VyOS instance ENI
+ Type: String
+ AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+ ConstraintDescription: Must be a valid IP address in the Private Subnet CIDR block
+
+ SSHAllowedIP:
+ Description: The IP subnet allowed to SSH into the VyOS instance
+ Type: String
+ Default: 192.0.2.0/24
+ AllowedPattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(2[4-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR within range /24 to /32
+
+ # VyOS AMI Aliase.
+ # If you set "latest" option CloudFormation will choose the latest version of the VyOS.
+ # But if you want to deploy a more specific version you should change the latest to part of the alias like /aws/.../1.3.6, /aws/.../1.4.0.
+ # After changing this please look at the Resources part "VyOSInstance"s User-Data field because there could be VyOS CLI commands changes.
+ # Check VyOS official documentation for command reference.
+
+ AmiAlias:
+ Type: "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>"
+ Default: "/aws/service/marketplace/prod-ev235jujteaom/latest"
+ Description: "AMI Alias of the VyOS instance"
+
+Metadata:
+ AWS::CloudFormation::Interface:
+ ParameterGroups:
+ - Label:
+ default: 'Current VPC configuration. If you want deploy instance to your
+ existing VPC please add VPC and Subnet IDs to regareded fields:'
+ Parameters:
+ - ExistingVPCId
+ - ExistingPublicSubnetId
+ - ExistingPrivateSubnetId
+ - Label:
+ default: 'New VPC and Subnet CIDRs configurations. If you want to deploy instance to new
+ VPC please fill regarded fields:'
+ Parameters:
+ - VPCName
+ - VPCCidrBlock
+ - PublicSubnetCidr
+ - PrivateSubnetCidr
+ - Label:
+ default: 'VyOS Instance Configuration:'
+ Parameters:
+ - InstanceType
+ - KeyName
+ - VyOSPublicENIip
+ - VyOSPrivENIip
+ - SSHAllowedIP
+
+ ParameterLabels:
+ ExistingVPCId:
+ default: Existing VPC ID (optional if deploy existing VPC)
+ ExistingPublicSubnetId:
+ default: Existing Public Subnet ID (optional if deploy existing VPC)
+ ExistingPrivateSubnetId:
+ default: Existing Private Subnet ID (optional if deploy existing VPC)
+ VPCName:
+ default: VPC Name (required if you deploy new VPC)
+ VPCCidrBlock:
+ default: VPC CIDR Block (required if you deploy new VPC)
+ PublicSubnetCidr:
+ default: Public Subnet CIDR (required if you deploy new VPC)
+ PrivateSubnetCidr:
+ default: Private Subnet CIDR (required if you deploy new VPC)
+ InstanceType:
+ default: Instance Type (required)
+ KeyName:
+ default: EC2 KeyPair Name (required)
+ VyOSPublicENIip:
+ default: VyOS Public ENI IP (required)
+ VyOSPrivENIip:
+ default: VyOS Private ENI IP (required)
+ OnPremPublicIPAddress:
+ default: On-Premies Public IP Address (required)
+ VyOSBGPASNumber:
+ default: VyOS BGP ASN (required)
+ OnPremBGPASNumber:
+ default: On-Premies BGP ASN (required)
+ SSHAllowedIP:
+ default: SSH Allowed IP Subnet (required)
+
+Conditions:
+ CreateVPC: !Equals
+ - !Ref ExistingVPCId
+ - ''
+ CreatePublicSubnet: !Equals
+ - !Ref ExistingPublicSubnetId
+ - ''
+ CreatePrivateSubnet: !Equals
+ - !Ref ExistingPrivateSubnetId
+ - ''
+
+Resources:
+ # VPC
+ VPC:
+ Type: AWS::EC2::VPC
+ Condition: CreateVPC
+ Properties:
+ CidrBlock: !Ref VPCCidrBlock
+ EnableDnsSupport: 'true'
+ EnableDnsHostnames: 'true'
+ Tags:
+ - Key: Name
+ Value: !Ref VPCName
+
+ # Subnets
+ PublicSubnet:
+ Type: AWS::EC2::Subnet
+ Condition: CreatePublicSubnet
+ DependsOn: VPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ CidrBlock: !Ref PublicSubnetCidr
+ MapPublicIpOnLaunch: 'true'
+ AvailabilityZone: !Select
+ - 0
+ - !GetAZs ''
+ Tags:
+ - Key: Name
+ Value: Public Subnet
+
+ PrivateSubnet:
+ Type: AWS::EC2::Subnet
+ Condition: CreatePrivateSubnet
+ DependsOn: VPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ CidrBlock: !Ref PrivateSubnetCidr
+ MapPublicIpOnLaunch: 'false'
+ AvailabilityZone: !Select
+ - 0
+ - !GetAZs ''
+ Tags:
+ - Key: Name
+ Value: Private Subnet
+
+ # Internet Gateway
+ InternetGateway:
+ Type: AWS::EC2::InternetGateway
+ Condition: CreateVPC
+ Properties:
+ Tags:
+ - Key: Name
+ Value: Internet Gateway
+ - Key: Created by
+ Value: CloudFormation
+
+ AttachGateway:
+ Type: AWS::EC2::VPCGatewayAttachment
+ Condition: CreateVPC
+ Properties:
+ VpcId: !Ref VPC
+ InternetGatewayId: !Ref InternetGateway
+
+ # Route Tables
+ PublicRouteTable:
+ Type: AWS::EC2::RouteTable
+ Condition: CreateVPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ Tags:
+ - Key: Name
+ Value: Public Route Table
+ - Key: Created by
+ Value: CloudFormation
+
+ PublicRoute:
+ Type: AWS::EC2::Route
+ Condition: CreateVPC
+ Properties:
+ RouteTableId: !Ref PublicRouteTable
+ DestinationCidrBlock: 0.0.0.0/0
+ GatewayId: !If
+ - CreateVPC
+ - !Ref InternetGateway
+ - !Ref ExistingPublicSubnetId
+
+ PublicSubnetRouteTableAssociation:
+ Type: AWS::EC2::SubnetRouteTableAssociation
+ Condition: CreateVPC
+ Properties:
+ SubnetId: !Ref PublicSubnet
+ RouteTableId: !Ref PublicRouteTable
+
+ # Security Groups
+ VyOSPublicSG:
+ Type: AWS::EC2::SecurityGroup
+ Properties:
+ GroupDescription: Enable access from outside
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ SecurityGroupIngress:
+ - IpProtocol: tcp
+ FromPort: 22
+ ToPort: 22
+ CidrIp: !Ref SSHAllowedIP
+ Description: Allow SSH access
+ - IpProtocol: udp
+ FromPort: 51820
+ ToPort: 51820
+ CidrIp: 0.0.0.0/0
+ Description: Allow WireGuard VPN access
+ - IpProtocol: udp
+ FromPort: 1194
+ ToPort: 1194
+ CidrIp: 0.0.0.0/0
+ Description: Allow OpenVPN access
+ - IpProtocol: udp
+ FromPort: 500
+ ToPort: 500
+ CidrIp: 0.0.0.0/0
+ Description: Allow IPSec VPN access (ISAKMP)
+ - IpProtocol: udp
+ FromPort: 1701
+ ToPort: 1701
+ CidrIp: 0.0.0.0/0
+ Description: Allow L2TP VPN access
+ - IpProtocol: udp
+ FromPort: 4500
+ ToPort: 4500
+ CidrIp: 0.0.0.0/0
+ Description: Allow IPSec NAT Traversal
+ Tags:
+ - Key: Name
+ Value: PublicSG
+ - Key: Created by
+ Value: CloudFormation
+
+ VyOSPrivateSG:
+ Type: AWS::EC2::SecurityGroup
+ Properties:
+ GroupDescription: Enable access from inside
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ SecurityGroupIngress:
+ - IpProtocol: -1
+ CidrIp: 0.0.0.0/0
+ Description: Allow all protocols and ports
+ Tags:
+ - Key: Name
+ Value: PrivateSG
+ - Key: Created by
+ Value: CloudFormation
+
+ # ENIs
+ PublicENI:
+ Type: AWS::EC2::NetworkInterface
+ Properties:
+ SubnetId: !If
+ - CreatePublicSubnet
+ - !Ref PublicSubnet
+ - !Ref ExistingPublicSubnetId
+ Description: Public Network Interface
+ PrivateIpAddress: !Ref VyOSPublicENIip
+ GroupSet:
+ - !Ref VyOSPublicSG
+ Tags:
+ - Key: Name
+ Value: PublicENI
+ - Key: Created by
+ Value: CloudFormation
+
+ PrivateENI:
+ Type: AWS::EC2::NetworkInterface
+ Properties:
+ SubnetId: !If
+ - CreatePrivateSubnet
+ - !Ref PrivateSubnet
+ - !Ref ExistingPrivateSubnetId
+ Description: Private Network Interface
+ PrivateIpAddress: !Ref VyOSPrivENIip
+ GroupSet:
+ - !Ref VyOSPrivateSG
+ Tags:
+ - Key: Name
+ Value: PrivateENI
+ - Key: Created by
+ Value: CloudFormation
+
+ # VyOS Instance
+ VyOSInstance:
+ Type: AWS::EC2::Instance
+ Properties:
+ InstanceType: !Ref InstanceType
+ KeyName: !Ref KeyName
+ ImageId: !Ref AmiAlias
+ NetworkInterfaces:
+ - NetworkInterfaceId: !Ref PublicENI
+ DeviceIndex: 0
+ - NetworkInterfaceId: !Ref PrivateENI
+ DeviceIndex: 1
+ UserData: !Base64
+ Fn::Sub: |
+ #cloud-config
+ vyos_config_commands:
+ # Basic VyOS Configuration
+ - set system host-name 'VyOS-on-AWS'
+ - set interfaces ethernet eth0 description 'OUTSIDE'
+ - set interfaces ethernet eth1 description 'INSIDE'
+ - set interfaces ethernet eth1 dhcp-options no-default-route
+ - set system login banner pre-login 'Welcome to the VyOS on AWS'
+ Tags:
+ - Key: Name
+ Value: VyOS-Instance
+ - Key: Created by
+ Value: CloudFormation
+
+ # Elastic IP
+ VyOSPublicIPAddress:
+ Type: AWS::EC2::EIP
+ Properties:
+ Domain: vpc
+ Tags:
+ - Key: Name
+ Value: VyOS-Instance-EIP
+ - Key: Created by
+ Value: CloudFormation
+
+ # Elastic IP Association
+ EIPAssociation:
+ Type: AWS::EC2::EIPAssociation
+ Properties:
+ NetworkInterfaceId: !Ref PublicENI
+ AllocationId: !GetAtt VyOSPublicIPAddress.AllocationId
+
+# Outputs
+Outputs:
+ VPCId:
+ Description: VPC Id
+ Value: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ VPCPublicSubnetId:
+ Description: Public Subnet Id
+ Value: !If
+ - CreatePublicSubnet
+ - !Ref PublicSubnet
+ - !Ref ExistingPublicSubnetId
+ VPCPrivateSubnetId:
+ Description: Private Subnet Id
+ Value: !If
+ - CreatePrivateSubnet
+ - !Ref PrivateSubnet
+ - !Ref ExistingPrivateSubnetId
+ VyOSInstanceId:
+ Description: Instance ID of the VyOS instance
+ Value: !Ref VyOSInstance
+ VyOSPublicIp:
+ Description: Public IP address of the VyOS instance
+ Value: !Ref VyOSPublicIPAddress
+ VyOSMgmtUsername:
+ Description: Username for SSH access to the VyOS instance
+ Value: vyos
+ VyOSMgmtKeyPair:
+ Description: Name of the KeyPair used for SSH access
+ Value: !Ref KeyName
+ VyOSMgmtInfo:
+ Description: VyOS managment information
+ Value: !Join
+ - "\n"
+ - - "Management allowed via SSH protocol default port 22. "
+ - "To access VyOS instance you need to have SSH client software (like Putty, MobaXterm etc). "
+ - "SSH access example: ssh vyos@192.0.2.1 -i /tmp/test.pem"
diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt b/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt
new file mode 100644
index 0000000..692feac
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/opposide-side-vyos-instance-config-example.txt
@@ -0,0 +1,57 @@
+ set system host-name 'VyOS-in-Corporate-Data-Center'
+ set system login banner pre-login 'Welcome to the VyOS on Corporate Data Center'
+ set interfaces ethernet eth0 description 'OUTSIDE'
+ set interfaces ethernet eth0 address '10.1.1.4/24'
+ set interfaces ethernet eth1 description 'INSIDE'
+ set interfaces ethernet eth1 address '10.1.11.4/24'
+ set system name-server '8.8.8.8'
+ set system name-server '8.8.4.8'
+ set service dns forwarding name-server '8.8.8.8'
+ set service dns forwarding listen-address '10.1.11.4'
+ set service dns forwarding allow-from '10.1.11.0/24'
+ set service dns forwarding no-serve-rfc1918
+ set nat source rule 10 outbound-interface name 'eth0'
+ set nat source rule 10 source address '10.1.11.0/24'
+ set nat source rule 10 translation address 'masquerade'
+ set vpn ipsec interface 'eth0'
+ set vpn ipsec esp-group AWS lifetime '3600'
+ set vpn ipsec esp-group AWS mode 'tunnel'
+ set vpn ipsec esp-group AWS pfs 'dh-group2'
+ set vpn ipsec esp-group AWS proposal 1 encryption 'aes256'
+ set vpn ipsec esp-group AWS proposal 1 hash 'sha1'
+ set vpn ipsec ike-group AWS dead-peer-detection action 'restart'
+ set vpn ipsec ike-group AWS dead-peer-detection interval '15'
+ set vpn ipsec ike-group AWS dead-peer-detection timeout '30'
+ set vpn ipsec ike-group AWS ikev2-reauth
+ set vpn ipsec ike-group AWS key-exchange 'ikev2'
+ set vpn ipsec ike-group AWS lifetime '28800'
+ set vpn ipsec ike-group AWS proposal 1 dh-group '2'
+ set vpn ipsec ike-group AWS proposal 1 encryption 'aes256'
+ set vpn ipsec ike-group AWS proposal 1 hash 'sha1'
+ set vpn ipsec ike-group AWS close-action start
+ set vpn ipsec option disable-route-autoinstall
+ set interfaces vti vti1 address '10.2.100.11/32'
+ set interfaces vti vti1 description 'Tunnel to VyOS on AWS'
+ set interfaces vti vti1 ip adjust-mss '1350'
+ set protocols static route 10.1.100.11/32 interface vti1
+ set vpn ipsec authentication psk VyOS id '10.1.1.4'
+ set vpn ipsec authentication psk VyOS id '10.0.1.10'
+ set vpn ipsec authentication psk VyOS secret 'ch00s3-4-s3cur3-psk'
+ set vpn ipsec site-to-site peer VyOS-on-AWS authentication local-id '10.1.1.4'
+ set vpn ipsec site-to-site peer VyOS-on-AWS authentication mode 'pre-shared-secret'
+ set vpn ipsec site-to-site peer VyOS-on-AWS authentication remote-id '10.0.1.10'
+ set vpn ipsec site-to-site peer VyOS-on-AWS connection-type 'initiate'
+ set vpn ipsec site-to-site peer VyOS-on-AWS description 'AWS TUNNEL to VyOS on AWS'
+ set vpn ipsec site-to-site peer VyOS-on-AWS ike-group 'AWS'
+ set vpn ipsec site-to-site peer VyOS-on-AWS ikev2-reauth 'inherit'
+ set vpn ipsec site-to-site peer VyOS-on-AWS local-address '10.1.1.4'
+ set vpn ipsec site-to-site peer VyOS-on-AWS remote-address '192.0.2.2'
+ set vpn ipsec site-to-site peer VyOS-on-AWS vti bind 'vti1'
+ set vpn ipsec site-to-site peer VyOS-on-AWS vti esp-group 'AWS'
+ set protocols bgp system-as '65002'
+ set protocols bgp address-family ipv4-unicast network 10.1.11.0/24
+ set protocols bgp neighbor 10.1.100.11 remote-as '192.0.2.1'
+ set protocols bgp neighbor 10.1.100.11 address-family ipv4-unicast soft-reconfiguration inbound
+ set protocols bgp neighbor 10.1.100.11 timers holdtime '30'
+ set protocols bgp neighbor 10.1.100.11 timers keepalive '10'
+ set protocols bgp neighbor 10.1.100.11 ebgp-multihop '10' \ No newline at end of file
diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md b/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md
new file mode 100644
index 0000000..7845fb4
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/readme.md
@@ -0,0 +1,95 @@
+# VyOS Deployment with Advanced Configuration
+
+## Overview
+This manual guides the deployment of a VyOS instance in AWS using CloudFormation. The template sets up:
+- VPC with public and private subnets
+- Internet Gateway, Route Tables, ENIs, Security Groups, Elastic IP
+- Configuration via cloud-init
+
+This automated setup ensures a consistent, efficient deployment process.
+
+## Prerequisites
+- **AWS Account**: Permissions to manage VPCs, EC2 instances, etc.
+- **EC2 Key Pair**: Valid SSH key for accessing VyOS.
+- **AWS Console/CLI**: Familiarity with AWS Console or CLI for stack management.
+
+## CloudFormation Template Overview
+
+### Parameters
+
+#### Existing VPC and Subnet Parameters
+For deployment to an existing VPC, provide VPC and Subnet IDs; leave blank for a new VPC.
+- **ExistingVPCId**: (Optional) VPC ID
+- **ExistingPublicSubnetId**: (Optional) Public Subnet ID
+- **ExistingPrivateSubnetId**: (Optional) Private Subnet ID
+
+#### New VPC Parameters
+For a new VPC, specify:
+- **VPCName**: Name of the new VPC
+- **VPCCidrBlock**: CIDR block (e.g., 10.0.0.0/16)
+
+#### Subnet Parameters
+- **PublicSubnetCidr**: CIDR for the public subnet
+- **PrivateSubnetCidr**: CIDR for the private subnet
+
+#### VyOS Instance Parameters
+- **InstanceType**: EC2 instance type (e.g., t3.medium)
+- **KeyName**: Name of EC2 KeyPair
+- **VyOSPublicENIip**: Private IP in the public subnet
+- **VyOSPrivENIip**: Private IP in the private subnet
+- **VyOSBGPASNumber**: BGP ASN for VyOS
+- **DNS1/DNS2**: Primary/Secondary DNS IP
+- **SSHAllowedIP**: CIDR for SSH access (e.g., 192.0.2.0/24)
+- **AmiAlias**: Specify VyOS AMI alias (e.g., `latest` or version `/aws/.../1.4.0`)
+
+#### BGP/VPN Peer Parameters
+- **OnPremPublicIPAddress**: Public IP of on-premise VPN endpoint
+- **OnPremBGPASNumber**: BGP ASN for on-premise endpoint
+
+### Resources
+1. **VPC**: Creates a new VPC or uses an existing one
+2. **Subnets**: Public and private subnets
+3. **Internet Gateway**: For public subnet internet access
+4. **Route Tables**: Routing configuration for traffic between subnets and Internet Gateway
+5. **ENIs**: Elastic Network Interfaces for public and private IPs
+6. **Security Groups**: Public/Private Security Groups
+7. **VyOS Instance**: Configured via cloud-init with specified AMI and instance type
+
+### Conditions
+Conditions determine whether to create a new VPC or use an existing one.
+
+## Deployment Scenarios
+
+### Existing VPC Deployment
+1. In **AWS Console**, go to **CloudFormation** > **Create Stack**
+2. Choose **Upload a template** and select the `.yaml` file
+3. Enter **Stack Details** and existing **VPC/Subnet IDs**
+4. Configure **VyOS Instance Parameters**
+5. Add on-prem VyOS parameters and finish deployment
+6. Confirm **CREATE_COMPLETE** status and retrieve Public IP from **Outputs**
+
+### New VPC Deployment
+1. Follow the steps above but add new **VPC name, CIDR, and Subnet CIDRs**
+2. Complete **VyOS Instance Configuration**
+3. Confirm deployment and retrieve Public IP from **Outputs**
+
+## Access and Management
+Use SSH to connect:
+```bash
+ssh vyos@<VyOS_Public_IP_Address> -i <test-key.pem>
+```
+
+## Common Commands for VyOS Management
+
+- **show configuration commands**: Displays the current configuration.
+- **show interfaces**: Lists all network interfaces and their status.
+- **show ip route**: Shows the IP routing table.
+- **show ip bgp summary**: Summarizes BGP neighbors and sessions.
+- **show vpn ipsec sa**: Displays the status of IPsec Security Associations.
+- **show vpn ike sa**: Shows the status of IKE Security Associations.
+- **show vpn ipsec connections**: Lists current IPsec VPN connections.
+- **show firewall summary**: Summarizes firewall rules and statistics.
+- **show firewall statistics**: Provides detailed firewall statistics.
+
+For additional commands and configurations, refer to the [VyOS Documentation](https://docs.vyos.io/en/sagitta/).
+
diff --git a/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml b/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml
new file mode 100644
index 0000000..063712e
--- /dev/null
+++ b/CloudFormation/vyos-vyos-template-with-advanced-configuration/single-instance-with-advanced-configuration.yml
@@ -0,0 +1,812 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: VyOS Networks CloudFormation template to deploy a VPC with public
+ and private subnets, an Internet gateway, Route tables, ENIs, Elastic IP
+ Address and a VyOS instance with subscription (Pay As You Go) and configures
+ VyOS instance via user-data (cloud-init).
+
+Parameters:
+ ExistingVPCId:
+ Description: ID of an existing VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^vpc-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid VPC ID or empty.
+
+ ExistingPublicSubnetId:
+ Description: ID of an existing public subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid public subnet ID or empty.
+
+ ExistingPrivateSubnetId:
+ Description: ID of an existing private subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^subnet-[0-9a-fA-F]{8,17}$
+ ConstraintDescription: Must be a valid private subnet ID or empty.
+
+ VPCName:
+ Description: Name of the VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^.{1,128}$
+ MaxLength: 128
+ ConstraintDescription: Must be empty or between 1 and 128 characters.
+
+ VPCCidrBlock:
+ Description: CIDR block for the VPC
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+ ranges based on RFC 1918, with subnet sizes between /16 and /28, or can be
+ empty if we deploy VyOS instance to the existig VPC.
+
+ PublicSubnetCidr:
+ Description: CIDR block for the Public Subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+ ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+ PrivateSubnetCidr:
+ Description: CIDR block for the Private Subnet
+ Type: String
+ Default: ''
+ AllowedPattern: ^$|^(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$|^(192\.168\.[0-9]{1,3}\.[0-9]{1,3}\/([1-9]|[1-2][0-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR notation within private IP
+ ranges based on RFC 1918, with subnet sizes between /16 and /28.
+
+ InstanceType:
+ Description: EC2 instance type for VyOS deployment
+ Type: String
+ Default: c5n.large
+ AllowedValues:
+ - t3.small
+ - t3.medium
+ - t3.large
+ - t3.xlarge
+ - t3.2xlarge
+ - t3a.small
+ - t3a.medium
+ - t3a.large
+ - t3a.xlarge
+ - t3a.2xlarge
+ - m4.large
+ - m4.xlarge
+ - m4.2xlarge
+ - m4.4xlarge
+ - m4.10xlarge
+ - m4.16xlarge
+ - m5.large
+ - m5.xlarge
+ - m5.2xlarge
+ - m5.4xlarge
+ - m5.8xlarge
+ - m5a.large
+ - m5a.xlarge
+ - m5a.2xlarge
+ - m5a.4xlarge
+ - m5a.8xlarge
+ - m5a.12xlarge
+ - m5n.large
+ - m5n.xlarge
+ - m5n.2xlarge
+ - m5n.4xlarge
+ - m5n.8xlarge
+ - m5n.12xlarge
+ - m5zn.large
+ - m5zn.xlarge
+ - m5zn.2xlarge
+ - m5zn.3xlarge
+ - m5zn.6xlarge
+ - m5zn.12xlarge
+ - m6i.large
+ - m6i.xlarge
+ - m6i.2xlarge
+ - m6i.4xlarge
+ - m6i.8xlarge
+ - m6i.12xlarge
+ - m6i.16xlarge
+ - c4.large
+ - c4.xlarge
+ - c4.2xlarge
+ - c4.4xlarge
+ - c4.8xlarge
+ - c5.large
+ - c5.xlarge
+ - c5.2xlarge
+ - c5.4xlarge
+ - c5.9xlarge
+ - c5d.large
+ - c5d.xlarge
+ - c5d.2xlarge
+ - c5d.4xlarge
+ - c5d.9xlarge
+ - c5a.large
+ - c5a.xlarge
+ - c5a.2xlarge
+ - c5a.4xlarge
+ - c5a.8xlarge
+ - c5n.large
+ - c5n.xlarge
+ - c5n.2xlarge
+ - c5n.4xlarge
+ - c5n.9xlarge
+ - c6i.large
+ - c6i.xlarge
+ - c6i.2xlarge
+ - c6i.4xlarge
+ - c6i.8xlarge
+ - c6i.12xlarge
+ - c6i.16xlarge
+ - c6i.24xlarge
+ - m6a.large
+ - m6a.xlarge
+ - m6a.2xlarge
+ - m6a.4xlarge
+ - m6a.8xlarge
+ - m6a.12xlarge
+ - m6a.16xlarge
+ - m6in.large
+ - m6in.xlarge
+ - m6in.2xlarge
+ - m6in.4xlarge
+ - m6in.8xlarge
+ - m6in.12xlarge
+ - m6in.16xlarge
+ - m6in.24xlarge
+ - m6in.32xlarge
+ - m6in.metal
+ - m7i.large
+ - m7i.xlarge
+ - m7i.2xlarge
+ - m7i.4xlarge
+ - m7i.8xlarge
+ - m7i-flex.large
+ - m7i-flex.xlarge
+ - m7i-flex.2xlarge
+ - m7i-flex.4xlarge
+ - m7i-flex.8xlarge
+
+ KeyName:
+ Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+ Type: AWS::EC2::KeyPair::KeyName
+ ConstraintDescription: Must not be empty
+
+ VyOSPublicENIip:
+ Description: Private IP address for VyOS instance ENI
+ Type: String
+ AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+ ConstraintDescription: Must be a valid IP address in the Public Subnet CIDR block
+
+ VyOSPrivENIip:
+ Description: Private IP address for VyOS instance ENI
+ Type: String
+ AllowedPattern: ^(10\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|192\.168\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))$
+ ConstraintDescription: Must be a valid IP address in the Private Subnet CIDR block
+
+ OnPremPublicIPAddress:
+ Description: The public IP address for the on-premise VPN endpoint
+ Type: String
+ Default: 192.0.2.1
+ AllowedPattern: ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+ ConstraintDescription: Must be a valid IPv4 public address.
+
+ VyOSBGPASNumber:
+ Description: The BGP Autonomous System Number for VyOS
+ Type: Number
+ Default: 65001
+ MinValue: 1
+ MaxValue: 65535
+ ConstraintDescription: Must be a valid BGP ASN between 1 and 65535.
+
+ OnPremBGPASNumber:
+ Description: The BGP Autonomous System Number for the on-premise VPN endpoint
+ Type: Number
+ Default: 65002
+ MinValue: 1
+ MaxValue: 65535
+ ConstraintDescription: Must be a valid BGP ASN between 1 and 65535.
+
+ DNS1:
+ Description: Primary DNS server
+ Type: String
+ Default: 8.8.8.8
+ AllowedPattern: ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+ ConstraintDescription: Must be a valid DNS server IP address.
+
+ DNS2:
+ Description: Secondary DNS server
+ Type: String
+ Default: 8.8.4.4
+ AllowedPattern: ^$|^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+ ConstraintDescription: Must be a valid DNS server IP address.
+
+ SSHAllowedIP:
+ Description: The IP subnet allowed to SSH into the VyOS instance
+ Type: String
+ Default: 192.0.2.0/24
+ AllowedPattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(2[4-9]|3[0-2]))$
+ ConstraintDescription: Must be a valid IPv4 CIDR within range /24 to /32
+
+ # VyOS AMI Aliase.
+ # If you set "latest" option CloudFormation will choose the latest version of the VyOS.
+ # But if you want to deploy a more specific version you should change the latest to part of the alias like /aws/.../1.3.6, /aws/.../1.4.0.
+ # After changing this please look at the Resources part "VyOSInstance"s User-Data field because there could be VyOS CLI commands changes.
+ # Check VyOS official documentation for command reference.
+
+ AmiAlias:
+ Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
+ Default: /aws/service/marketplace/prod-ev235jujteaom/latest
+ Description: AMI Alias of the VyOS instance
+
+Metadata:
+ AWS::CloudFormation::Interface:
+ ParameterGroups:
+ - Label:
+ default: 'Current VPC configuration. If you want deploy instance to your
+ existing VPC please add VPC and Subnet IDs to regareded fields:'
+ Parameters:
+ - ExistingVPCId
+ - ExistingPublicSubnetId
+ - ExistingPrivateSubnetId
+ - Label:
+ default: 'New VPC and CIDR configuration. If you want to deploy instance to new
+ VPC please fill regarded fields:'
+ Parameters:
+ - VPCName
+ - VPCCidrBlock
+ - Label:
+ default: 'Subnet CIDRs configurations. Add existing or new subnet CIDRs to the
+ regarded fields:'
+ Parameters:
+ - PublicSubnetCidr
+ - PrivateSubnetCidr
+ - Label:
+ default: 'VyOS Instance Configuration:'
+ Parameters:
+ - InstanceType
+ - KeyName
+ - VyOSPublicENIip
+ - VyOSPrivENIip
+ - VyOSBGPASNumber
+ - DNS1
+ - DNS2
+ - SSHAllowedIP
+ - Label:
+ default: 'On-Premise instance parameters:'
+ Parameters:
+ - OnPremPublicIPAddress
+ - OnPremBGPASNumber
+
+ ParameterLabels:
+ ExistingVPCId:
+ default: Existing VPC ID (optional if deploy existing VPC)
+ ExistingPublicSubnetId:
+ default: Existing Public Subnet ID (optional if deploy existing VPC)
+ ExistingPrivateSubnetId:
+ default: Existing Private Subnet ID (optional if deploy existing VPC)
+ VPCName:
+ default: VPC Name (required if you deploy new VPC)
+ VPCCidrBlock:
+ default: VPC CIDR Block (required if you deploy new VPC)
+ PublicSubnetCidr:
+ default: Public Subnet CIDR (required)
+ PrivateSubnetCidr:
+ default: Private Subnet CIDR (required)
+ InstanceType:
+ default: Instance Type (required)
+ KeyName:
+ default: EC2 KeyPair Name (required)
+ VyOSPublicENIip:
+ default: VyOS Public ENI IP (required)
+ VyOSPrivENIip:
+ default: VyOS Private ENI IP (required)
+ OnPremPublicIPAddress:
+ default: On-Premies Public IP Address (required)
+ VyOSBGPASNumber:
+ default: VyOS BGP ASN (required)
+ OnPremBGPASNumber:
+ default: On-Premies BGP ASN (required)
+ DNS1:
+ default: Primary DNS Server IP Address (required)
+ DNS2:
+ default: Secondary DNS Server IP Address (optional)
+ SSHAllowedIP:
+ default: SSH Allowed IP Subnet (required)
+
+Conditions:
+ CreateVPC: !Equals
+ - !Ref ExistingVPCId
+ - ''
+ CreatePublicSubnet: !Equals
+ - !Ref ExistingPublicSubnetId
+ - ''
+ CreatePrivateSubnet: !Equals
+ - !Ref ExistingPrivateSubnetId
+ - ''
+
+Resources:
+ # VPC
+ VPC:
+ Type: AWS::EC2::VPC
+ Condition: CreateVPC
+ Properties:
+ CidrBlock: !Ref VPCCidrBlock
+ EnableDnsSupport: 'true'
+ EnableDnsHostnames: 'true'
+ Tags:
+ - Key: Name
+ Value: !Ref VPCName
+
+ # Subnets
+ PublicSubnet:
+ Type: AWS::EC2::Subnet
+ Condition: CreatePublicSubnet
+ DependsOn: VPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ CidrBlock: !Ref PublicSubnetCidr
+ MapPublicIpOnLaunch: 'true'
+ AvailabilityZone: !Select
+ - 0
+ - !GetAZs ''
+ Tags:
+ - Key: Name
+ Value: Public Subnet
+
+ PrivateSubnet:
+ Type: AWS::EC2::Subnet
+ Condition: CreatePrivateSubnet
+ DependsOn: VPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ CidrBlock: !Ref PrivateSubnetCidr
+ MapPublicIpOnLaunch: 'false'
+ AvailabilityZone: !Select
+ - 0
+ - !GetAZs ''
+ Tags:
+ - Key: Name
+ Value: Private Subnet
+
+ # Internet Gateway
+ InternetGateway:
+ Type: AWS::EC2::InternetGateway
+ Condition: CreateVPC
+ Properties:
+ Tags:
+ - Key: Name
+ Value: Internet Gateway
+ - Key: Created by
+ Value: CloudFormation
+
+ AttachGateway:
+ Type: AWS::EC2::VPCGatewayAttachment
+ Condition: CreateVPC
+ Properties:
+ VpcId: !Ref VPC
+ InternetGatewayId: !Ref InternetGateway
+
+ # Route Tables
+ PublicRouteTable:
+ Type: AWS::EC2::RouteTable
+ Condition: CreateVPC
+ Properties:
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ Tags:
+ - Key: Name
+ Value: Public Route Table
+ - Key: Created by
+ Value: CloudFormation
+
+ PublicRoute:
+ Type: AWS::EC2::Route
+ Condition: CreateVPC
+ Properties:
+ RouteTableId: !Ref PublicRouteTable
+ DestinationCidrBlock: 0.0.0.0/0
+ GatewayId: !If
+ - CreateVPC
+ - !Ref InternetGateway
+ - !Ref ExistingPublicSubnetId
+
+ PublicSubnetRouteTableAssociation:
+ Type: AWS::EC2::SubnetRouteTableAssociation
+ Condition: CreateVPC
+ Properties:
+ SubnetId: !Ref PublicSubnet
+ RouteTableId: !Ref PublicRouteTable
+
+ # Security Groups
+ VyOSPublicSG:
+ Type: AWS::EC2::SecurityGroup
+ Properties:
+ GroupDescription: Enable access from outside
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ SecurityGroupIngress:
+ - IpProtocol: tcp
+ FromPort: 22
+ ToPort: 22
+ CidrIp: !Ref SSHAllowedIP
+ Description: Allow SSH access
+ - IpProtocol: udp
+ FromPort: 51820
+ ToPort: 51820
+ CidrIp: 0.0.0.0/0
+ Description: Allow WireGuard VPN access
+ - IpProtocol: udp
+ FromPort: 1194
+ ToPort: 1194
+ CidrIp: 0.0.0.0/0
+ Description: Allow OpenVPN access
+ - IpProtocol: udp
+ FromPort: 500
+ ToPort: 500
+ CidrIp: 0.0.0.0/0
+ Description: Allow IPSec VPN access (ISAKMP)
+ - IpProtocol: udp
+ FromPort: 1701
+ ToPort: 1701
+ CidrIp: 0.0.0.0/0
+ Description: Allow L2TP VPN access
+ - IpProtocol: udp
+ FromPort: 4500
+ ToPort: 4500
+ CidrIp: 0.0.0.0/0
+ Description: Allow IPSec NAT Traversal
+ Tags:
+ - Key: Name
+ Value: PublicSG
+ - Key: Created by
+ Value: CloudFormation
+
+ VyOSPrivateSG:
+ Type: AWS::EC2::SecurityGroup
+ Properties:
+ GroupDescription: Enable access from inside
+ VpcId: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ SecurityGroupIngress:
+ - IpProtocol: -1
+ CidrIp: 0.0.0.0/0
+ Description: Allow all protocols and ports
+ Tags:
+ - Key: Name
+ Value: PrivateSG
+ - Key: Created by
+ Value: CloudFormation
+
+ # ENIs
+ PublicENI:
+ Type: AWS::EC2::NetworkInterface
+ Properties:
+ SubnetId: !If
+ - CreatePublicSubnet
+ - !Ref PublicSubnet
+ - !Ref ExistingPublicSubnetId
+ Description: Public Network Interface
+ PrivateIpAddress: !Ref VyOSPublicENIip
+ GroupSet:
+ - !Ref VyOSPublicSG
+ Tags:
+ - Key: Name
+ Value: PublicENI
+ - Key: Created by
+ Value: CloudFormation
+
+ PrivateENI:
+ Type: AWS::EC2::NetworkInterface
+ Properties:
+ SubnetId: !If
+ - CreatePrivateSubnet
+ - !Ref PrivateSubnet
+ - !Ref ExistingPrivateSubnetId
+ Description: Private Network Interface
+ PrivateIpAddress: !Ref VyOSPrivENIip
+ GroupSet:
+ - !Ref VyOSPrivateSG
+ Tags:
+ - Key: Name
+ Value: PrivateENI
+ - Key: Created by
+ Value: CloudFormation
+
+ # VyOS Instance
+ VyOSInstance:
+ Type: AWS::EC2::Instance
+ Properties:
+ InstanceType: !Ref InstanceType
+ KeyName: !Ref KeyName
+ ImageId: !Ref AmiAlias
+ NetworkInterfaces:
+ - NetworkInterfaceId: !Ref PublicENI
+ DeviceIndex: 0
+ - NetworkInterfaceId: !Ref PrivateENI
+ DeviceIndex: 1
+ UserData: !Base64
+ Fn::Sub: |
+ #cloud-config
+ vyos_config_commands:
+ # Basic VyOS Configuration
+ - set system host-name 'VyOS-on-AWS'
+ - set interfaces ethernet eth0 description 'OUTSIDE'
+ - set interfaces ethernet eth1 description 'INSIDE'
+ - set system login banner pre-login 'Welcome to the VyOS on AWS'
+ - set interfaces ethernet eth1 dhcp-options no-default-route
+ # DNS and DNS Forwarding Configuration
+ - set system name-server '${DNS1}'
+ - set system name-server '${DNS2}'
+ - set service dns forwarding name-server '${DNS1}'
+ - set service dns forwarding listen-address '${VyOSPrivENIip}'
+ - set service dns forwarding allow-from '${PrivateSubnetCidr}'
+ - set service dns forwarding no-serve-rfc1918
+ # Source NAT (SNAT) Configuration
+ - set nat source rule 10 outbound-interface name 'eth0'
+ - set nat source rule 10 source address '${PrivateSubnetCidr}'
+ - set nat source rule 10 translation address 'masquerade'
+ # Site-to-Site VPN Configuration
+ - set vpn ipsec interface 'eth0'
+ - set vpn ipsec esp-group AWS-POC lifetime '3600'
+ - set vpn ipsec esp-group AWS-POC mode 'tunnel'
+ - set vpn ipsec esp-group AWS-POC pfs 'dh-group2'
+ - set vpn ipsec esp-group AWS-POC proposal 1 encryption 'aes256'
+ - set vpn ipsec esp-group AWS-POC proposal 1 hash 'sha1'
+ - set vpn ipsec ike-group AWS-POC dead-peer-detection action 'restart'
+ - set vpn ipsec ike-group AWS-POC dead-peer-detection interval '15'
+ - set vpn ipsec ike-group AWS-POC dead-peer-detection timeout '30'
+ - set vpn ipsec ike-group AWS-POC ikev2-reauth
+ - set vpn ipsec ike-group AWS-POC key-exchange 'ikev2'
+ - set vpn ipsec ike-group AWS-POC lifetime '28800'
+ - set vpn ipsec ike-group AWS-POC proposal 1 dh-group '2'
+ - set vpn ipsec ike-group AWS-POC proposal 1 encryption 'aes256'
+ - set vpn ipsec ike-group AWS-POC proposal 1 hash 'sha1'
+ - set vpn ipsec ike-group AWS-POC close-action start
+ - set vpn ipsec option disable-route-autoinstall
+ - set interfaces vti vti1 address '10.1.100.11/32'
+ - set interfaces vti vti1 description 'Tunnel VyOS 02'
+ - set interfaces vti vti1 ip adjust-mss '1350'
+ - set protocols static route 10.2.100.11/32 interface vti1
+ - set vpn ipsec authentication psk VyOS id '${VyOSPublicENIip}'
+ - set vpn ipsec authentication psk VyOS id '${OnPremPublicIPAddress}'
+ - set vpn ipsec authentication psk VyOS secret 'ch00s3-4-s3cur3-psk'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem authentication local-id '${VyOSPublicENIip}'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem authentication mode 'pre-shared-secret'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem authentication remote-id '${OnPremPublicIPAddress}'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem connection-type 'none'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem description 'AWS-POC TUNNEL to VyOS on Prem'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem ike-group 'AWS-POC'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem ikev2-reauth 'inherit'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem local-address '${VyOSPublicENIip}'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem remote-address '${OnPremPublicIPAddress}'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem vti bind 'vti1'
+ - set vpn ipsec site-to-site peer VyOS-on-Prem vti esp-group 'AWS-POC'
+ # BGP Configuration
+ - set protocols bgp system-as '${VyOSBGPASNumber}'
+ - set protocols bgp address-family ipv4-unicast network ${PrivateSubnetCidr}
+ - set protocols bgp neighbor 10.2.100.11 remote-as '${OnPremBGPASNumber}'
+ - set protocols bgp neighbor 10.2.100.11 address-family ipv4-unicast soft-reconfiguration inbound
+ - set protocols bgp neighbor 10.2.100.11 timers holdtime '30'
+ - set protocols bgp neighbor 10.2.100.11 timers keepalive '10'
+ - set protocols bgp neighbor 10.2.100.11 disable-connected-check
+ # Firewall Groups (Collections of IP addresses, networks, ports, MAC addresses, domains, or interfaces)
+ - set firewall group network-group Local network '${PrivateSubnetCidr}'
+ - set firewall group port-group dns_ports port '53'
+ - set firewall group port-group mail_ports port '110'
+ - set firewall group port-group mail_ports port '25'
+ - set firewall group port-group web_ports port '443'
+ - set firewall group port-group web_ports port '8080'
+ - set firewall group port-group web_ports port '80'
+ # Firewall Forwarding Rules (Traffic Transiting Through the VyOS Instance)
+ - set firewall ipv4 forward filter default-action 'drop' # Default-action 'drop' means drop non allowed (which allowed by rules) transit traffic.
+ # These rules blocks all traffic which was not initiated from the internal/LAN side first.
+ - set firewall ipv4 forward filter rule 10 action 'accept'
+ - set firewall ipv4 forward filter rule 10 state 'established'
+ - set firewall ipv4 forward filter rule 10 state 'related'
+ - set firewall ipv4 forward filter rule 11 action 'drop'
+ - set firewall ipv4 forward filter rule 11 state 'invalid'
+ # These rules allow ICMP traffic from outside in (from WAN to LAN)
+ - set firewall ipv4 forward filter rule 20 action 'accept'
+ - set firewall ipv4 forward filter rule 20 description 'Allow ICMP'
+ - set firewall ipv4 forward filter rule 20 icmp type-name 'echo-request'
+ - set firewall ipv4 forward filter rule 20 inbound-interface name 'eth0'
+ - set firewall ipv4 forward filter rule 20 protocol 'icmp'
+ - set firewall ipv4 forward filter rule 20 state 'new'
+ # These rules allow forward SSH traffic from outside in (from WAN to LAN) and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+ - set firewall ipv4 forward filter rule 30 action 'drop'
+ - set firewall ipv4 forward filter rule 30 description 'Mitigate SSH brute-forcing'
+ - set firewall ipv4 forward filter rule 30 destination port '22'
+ - set firewall ipv4 forward filter rule 30 inbound-interface name 'eth0'
+ - set firewall ipv4 forward filter rule 30 protocol 'tcp'
+ - set firewall ipv4 forward filter rule 30 recent count '4'
+ - set firewall ipv4 forward filter rule 30 recent time 'minute'
+ - set firewall ipv4 forward filter rule 30 state 'new'
+ - set firewall ipv4 forward filter rule 31 action 'accept'
+ - set firewall ipv4 forward filter rule 31 description 'Allow SSH'
+ - set firewall ipv4 forward filter rule 31 destination port '22'
+ - set firewall ipv4 forward filter rule 31 inbound-interface name 'eth0'
+ - set firewall ipv4 forward filter rule 31 protocol 'tcp'
+ - set firewall ipv4 forward filter rule 31 state 'new'
+ # These rules allow ICMP traffic from inside out (from LAN to WAN)
+ - set firewall ipv4 forward filter rule 110 action 'accept'
+ - set firewall ipv4 forward filter rule 110 description 'LAN clients ICMP'
+ - set firewall ipv4 forward filter rule 110 icmp type-name 'echo-request'
+ - set firewall ipv4 forward filter rule 110 inbound-interface name 'eth1'
+ - set firewall ipv4 forward filter rule 110 state 'new'
+ # These rules allow forward SSH traffic from indide out (from LAN to WAN) and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+ - set firewall ipv4 forward filter rule 120 action 'drop'
+ - set firewall ipv4 forward filter rule 120 description 'Mitigate clients SSH brute-forcing'
+ - set firewall ipv4 forward filter rule 120 destination port '22'
+ - set firewall ipv4 forward filter rule 120 inbound-interface name 'eth1'
+ - set firewall ipv4 forward filter rule 120 protocol 'tcp'
+ - set firewall ipv4 forward filter rule 120 recent count '4'
+ - set firewall ipv4 forward filter rule 120 recent time 'minute'
+ - set firewall ipv4 forward filter rule 120 state 'new'
+ - set firewall ipv4 forward filter rule 121 action 'accept'
+ - set firewall ipv4 forward filter rule 121 description 'Allow clients SSH'
+ - set firewall ipv4 forward filter rule 121 destination port '22'
+ - set firewall ipv4 forward filter rule 121 inbound-interface name 'eth1'
+ - set firewall ipv4 forward filter rule 121 protocol 'tcp'
+ - set firewall ipv4 forward filter rule 121 state 'new'
+ # Firewall input rules means firewall (VyOS instance) traffic toward the instance itself
+ - set firewall ipv4 input filter default-action 'drop' # Default-action 'drop' means drop non allowed (which allowed by rules) inbound traffic.
+ # This configuration creates a proper stateful firewall that blocks all traffic which was not initiated from the internal/LAN side first.
+ - set firewall ipv4 input filter rule 10 action 'accept'
+ - set firewall ipv4 input filter rule 10 description 'Allow established/related'
+ - set firewall ipv4 input filter rule 10 state 'established'
+ - set firewall ipv4 input filter rule 10 state 'related'
+ - set firewall ipv4 input filter rule 11 action 'drop'
+ - set firewall ipv4 input filter rule 11 state 'invalid'
+ # These rules allowes WireGuard, OpenVPN, ESP, ISAKMP, IPSec NAT Traversal, L2TP and ICMP traffic towards VyOS instance via eth0 interface (WAN interface)
+ - set firewall ipv4 input filter rule 20 action 'accept'
+ - set firewall ipv4 input filter rule 20 description 'WireGuard_IN'
+ - set firewall ipv4 input filter rule 20 destination port '51820'
+ - set firewall ipv4 input filter rule 20 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 20 log
+ - set firewall ipv4 input filter rule 20 protocol 'udp'
+ - set firewall ipv4 input filter rule 30 action 'accept'
+ - set firewall ipv4 input filter rule 30 description 'OpenVPN_IN'
+ - set firewall ipv4 input filter rule 30 destination port '1194'
+ - set firewall ipv4 input filter rule 30 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 30 log
+ - set firewall ipv4 input filter rule 30 protocol 'udp'
+ - set firewall ipv4 input filter rule 40 action 'accept'
+ - set firewall ipv4 input filter rule 40 description 'Allow ESP'
+ - set firewall ipv4 input filter rule 40 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 40 protocol 'esp'
+ - set firewall ipv4 input filter rule 50 action 'accept'
+ - set firewall ipv4 input filter rule 50 description 'Allow ISAKMP'
+ - set firewall ipv4 input filter rule 50 destination port '500'
+ - set firewall ipv4 input filter rule 50 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 50 protocol 'udp'
+ - set firewall ipv4 input filter rule 60 action 'accept'
+ - set firewall ipv4 input filter rule 60 description 'IPSec NAT Traversal'
+ - set firewall ipv4 input filter rule 60 destination port '4500'
+ - set firewall ipv4 input filter rule 60 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 60 protocol 'udp'
+ - set firewall ipv4 input filter rule 70 action 'accept'
+ - set firewall ipv4 input filter rule 70 description 'Allow L2TP'
+ - set firewall ipv4 input filter rule 70 destination port '1701'
+ - set firewall ipv4 input filter rule 70 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 70 ipsec match-ipsec
+ - set firewall ipv4 input filter rule 70 protocol 'udp'
+ - set firewall ipv4 input filter rule 80 action 'accept'
+ - set firewall ipv4 input filter rule 80 description 'Allow ICMP'
+ - set firewall ipv4 input filter rule 80 icmp type-name 'echo-request'
+ - set firewall ipv4 input filter rule 80 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 80 protocol 'icmp'
+ - set firewall ipv4 input filter rule 80 state 'new'
+ # These rules allow forward SSH traffic towards VyOS instance and rate limit it to 4 requests per minute. This blocks brute-forcing attempts
+ - set firewall ipv4 input filter rule 90 action 'drop'
+ - set firewall ipv4 input filter rule 90 description 'Mitigate SSH brute-forcing'
+ - set firewall ipv4 input filter rule 90 destination port '22'
+ - set firewall ipv4 input filter rule 90 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 90 protocol 'tcp'
+ - set firewall ipv4 input filter rule 90 recent count '4'
+ - set firewall ipv4 input filter rule 90 recent time 'minute'
+ - set firewall ipv4 input filter rule 90 state 'new'
+ - set firewall ipv4 input filter rule 91 action 'accept'
+ - set firewall ipv4 input filter rule 91 description 'Allow SSH'
+ - set firewall ipv4 input filter rule 91 destination port '22'
+ - set firewall ipv4 input filter rule 91 inbound-interface name 'eth0'
+ - set firewall ipv4 input filter rule 91 protocol 'tcp'
+ - set firewall ipv4 input filter rule 91 state 'new'
+ # These rules allowes ESP, ISAKMP, IPSec NAT Traversal, BGP and ICMP traffic towards VyOS instance via VTI interface
+ - set firewall ipv4 input filter rule 140 action 'accept'
+ - set firewall ipv4 input filter rule 140 description 'Allow ESP'
+ - set firewall ipv4 input filter rule 140 inbound-interface name 'vti1'
+ - set firewall ipv4 input filter rule 140 protocol 'esp'
+ - set firewall ipv4 input filter rule 150 action 'accept'
+ - set firewall ipv4 input filter rule 150 description 'Allow ISAKMP'
+ - set firewall ipv4 input filter rule 150 destination port '500'
+ - set firewall ipv4 input filter rule 150 inbound-interface name 'vti1'
+ - set firewall ipv4 input filter rule 150 protocol 'udp'
+ - set firewall ipv4 input filter rule 160 action 'accept'
+ - set firewall ipv4 input filter rule 160 description 'IPSec NAT Traversal'
+ - set firewall ipv4 input filter rule 160 destination port '4500'
+ - set firewall ipv4 input filter rule 160 inbound-interface name 'vti1'
+ - set firewall ipv4 input filter rule 160 protocol 'udp'
+ - set firewall ipv4 input filter rule 170 action 'accept'
+ - set firewall ipv4 input filter rule 170 description 'Allow ICMP'
+ - set firewall ipv4 input filter rule 170 icmp type-name 'echo-request'
+ - set firewall ipv4 input filter rule 170 inbound-interface name 'vti1'
+ - set firewall ipv4 input filter rule 170 protocol 'icmp'
+ - set firewall ipv4 input filter rule 170 state 'new'
+ - set firewall ipv4 input filter rule 180 action 'accept'
+ - set firewall ipv4 input filter rule 180 description 'Allow BGP'
+ - set firewall ipv4 input filter rule 180 destination port '179'
+ - set firewall ipv4 input filter rule 180 inbound-interface name 'vti1'
+ - set firewall ipv4 input filter rule 180 protocol 'tcp'
+ Tags:
+ - Key: Name
+ Value: VyOS-Instance
+ - Key: Created by
+ Value: CloudFormation
+
+ # Elastic IP
+ VyOSPublicIPAddress:
+ Type: AWS::EC2::EIP
+ Properties:
+ Domain: vpc
+ Tags:
+ - Key: Name
+ Value: VyOS-Instance-EIP
+ - Key: Created by
+ Value: CloudFormation
+
+ # Elastic IP Association
+ EIPAssociation:
+ Type: AWS::EC2::EIPAssociation
+ Properties:
+ NetworkInterfaceId: !Ref PublicENI
+ AllocationId: !GetAtt VyOSPublicIPAddress.AllocationId
+
+# Outputs
+Outputs:
+ VPCId:
+ Description: VPC Id
+ Value: !If
+ - CreateVPC
+ - !Ref VPC
+ - !Ref ExistingVPCId
+ PublicSubnetId:
+ Description: Public Subnet Id
+ Value: !If
+ - CreatePublicSubnet
+ - !Ref PublicSubnet
+ - !Ref ExistingPublicSubnetId
+ PrivateSubnetId:
+ Description: Private Subnet Id
+ Value: !If
+ - CreatePrivateSubnet
+ - !Ref PrivateSubnet
+ - !Ref ExistingPrivateSubnetId
+ VyOSInstanceId:
+ Description: Instance ID of the VyOS instance
+ Value: !Ref VyOSInstance
+ VyOSPublicIp:
+ Description: Public IP address of the VyOS instance
+ Value: !Ref VyOSPublicIPAddress
+ VyOSUsername:
+ Description: Username for SSH access to the VyOS instance
+ Value: vyos
+ KeyPairName:
+ Description: Name of the KeyPair used for SSH access
+ Value: !Ref KeyName \ No newline at end of file
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-31 14:14:33 +0000