mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-12-16 18:42:05 +01:00
grammar correction
This commit is contained in:
parent
128fb31171
commit
9eb90286c0
@ -34,8 +34,10 @@ The ``confirm`` command confirms the prior ``commit-confirm``.
|
|||||||
Comment
|
Comment
|
||||||
^^^^^^^
|
^^^^^^^
|
||||||
|
|
||||||
The ``comment`` commands allow you to insert a comment above the current configuration section.
|
The ``comment`` commands allow you to insert a comment above the current
|
||||||
The command cannot be used at the top of the configuration hierarchy, only on subsections. Comments needs to be commited, just like other config changes.
|
configuration section.
|
||||||
|
The command cannot be used at the top of the configuration hierarchy, only on
|
||||||
|
subsections. Comments need to be commited, just like other config changes.
|
||||||
|
|
||||||
To add a comment to a section, while being already at the proper section level:
|
To add a comment to a section, while being already at the proper section level:
|
||||||
|
|
||||||
@ -84,7 +86,10 @@ The comment would then appear like this:
|
|||||||
[...]
|
[...]
|
||||||
|
|
||||||
|
|
||||||
An important thing to note is that since the comment is added on top of the section, it will not appear if the ``show <section>`` command is used. With the above example, the ``show interfaces`` command would return starting after the "interfaces {" line, hiding the comment:
|
An important thing to note is that since the comment is added on top of the
|
||||||
|
section, it will not appear if the ``show <section>`` command is used. With the
|
||||||
|
above example, the ``show interfaces`` command would return starting after the
|
||||||
|
"interfaces {" line, hiding the comment:
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -102,7 +107,8 @@ To add a comment to the interfaces section from the top:
|
|||||||
vyos@vyos# comment interfaces "test"
|
vyos@vyos# comment interfaces "test"
|
||||||
|
|
||||||
|
|
||||||
The comment can be added to any node that already exists, even if it's multiple levels lower:
|
The comment can be added to any node that already exists, even if it's multiple
|
||||||
|
levels lower:
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -114,10 +120,15 @@ Commit
|
|||||||
^^^^^^
|
^^^^^^
|
||||||
|
|
||||||
The ``commit`` command commits the proposed changes to the configuration file.
|
The ``commit`` command commits the proposed changes to the configuration file.
|
||||||
Every changes done in the configuration session is only applied when the configuration is committed. To view the changes that will be applied, use the show command.
|
Every changes done in the configuration session is only applied when the
|
||||||
To discard the changes without committing, use the ``discard`` command. The ``commit`` command doesn't save the configuration, you need to manually use the ``save`` command.
|
configuration is committed. To view the changes that will be applied, use the
|
||||||
|
show command.
|
||||||
|
To discard the changes without committing, use the ``discard`` command. The
|
||||||
|
``commit`` command doesn't save the configuration, you need to manually use the
|
||||||
|
``save`` command.
|
||||||
|
|
||||||
The confirm keyword can be added, see ``commit-confirm``. A comment can be entered, it will appear in the commit log.
|
The confirm keyword can be added, see ``commit-confirm``. A comment can be
|
||||||
|
entered, it will appear in the commit log.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -130,8 +141,10 @@ The confirm keyword can be added, see ``commit-confirm``. A comment can be enter
|
|||||||
Commit-confirm
|
Commit-confirm
|
||||||
^^^^^^^^^^^^^^
|
^^^^^^^^^^^^^^
|
||||||
|
|
||||||
The ``commit-confirm`` command commits the proposed changes to the configuration file and starts a timer.
|
The ``commit-confirm`` command commits the proposed changes to the
|
||||||
If the ``confirm`` command is not entered before the timer expiration, the configuration will be rolled back and VyOS will reboot.
|
configuration file and starts a timer.
|
||||||
|
If the ``confirm`` command is not entered before the timer expiration, the
|
||||||
|
configuration will be rolled back and VyOS will reboot.
|
||||||
The default timer value is 10 minutes, but a custom value can be entered.
|
The default timer value is 10 minutes, but a custom value can be entered.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
@ -147,7 +160,8 @@ The default timer value is 10 minutes, but a custom value can be entered.
|
|||||||
Compare
|
Compare
|
||||||
^^^^^^^
|
^^^^^^^
|
||||||
|
|
||||||
VyOS maintains backups of previous configurations. To compare configuration revisions in configuration mode, use the compare command:
|
VyOS maintains backups of previous configurations. To compare configuration
|
||||||
|
revisions in configuration mode, use the compare command:
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -176,7 +190,7 @@ Copy
|
|||||||
|
|
||||||
The ``copy`` command allows you to copy a configuration object.
|
The ``copy`` command allows you to copy a configuration object.
|
||||||
|
|
||||||
Copy the configuration entrys from a firewall name WAN rule 1 to rule 2.
|
Copy the configuration entries from a firewall name WAN rule 1 to rule 2.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -208,9 +222,9 @@ Copy the configuration entrys from a firewall name WAN rule 1 to rule 2.
|
|||||||
Delete
|
Delete
|
||||||
^^^^^^
|
^^^^^^
|
||||||
|
|
||||||
The ``delte`` command is to delete a configuration entry.
|
The ``delete`` command is to delete a configuration entry.
|
||||||
|
|
||||||
This Example delete the hole ``service tftp-server`` section.
|
This example deletes the whole ``service tftp-server`` section.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -232,8 +246,10 @@ Edit
|
|||||||
^^^^
|
^^^^
|
||||||
|
|
||||||
The ``edit`` command allows you to navigate down into the configuration tree.
|
The ``edit`` command allows you to navigate down into the configuration tree.
|
||||||
To get back to an upper level, use the ``up`` command or use the ``top`` command to get back to the upper most level.
|
To get back to an upper level, use the ``up`` command or use the ``top``
|
||||||
The ``[edit]`` text displays where the user is located in the configuration tree.
|
command to get back to the upper most level.
|
||||||
|
The ``[edit]`` text displays where the user is located in the configuration
|
||||||
|
tree.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -246,10 +262,17 @@ The ``[edit]`` text displays where the user is located in the configuration tree
|
|||||||
Exit
|
Exit
|
||||||
^^^^
|
^^^^
|
||||||
|
|
||||||
The ``exit`` command exits the current configuration mode. If the current configuration level isn't the top-most, then the configuration level is put back to the top-most level.
|
The ``exit`` command exits the current configuration mode. If the current
|
||||||
If the configuration level is at the top-most level, then it exits the configuration mode and returns to operational mode.
|
configuration level isn't the top-most, then the configuration level is put
|
||||||
The ``exit`` command cannot be used if uncommitted changes exists in the configuration file. To exit with uncommitted changes, you either need to use the ``exit discard`` command or you need to commit the changes before exiting.
|
back to the top-most level.
|
||||||
The ``exit`` command doesn't save the configuration, only the ``save`` command does. A warning will be given when exiting with unsaved changes. Using the ``exit`` command in operational mode will logout the session.
|
If the configuration level is at the top-most level, then it exits the
|
||||||
|
configuration mode and returns to operational mode.
|
||||||
|
The ``exit`` command cannot be used if uncommitted changes exists in the
|
||||||
|
configuration file. To exit with uncommitted changes, you either need to use
|
||||||
|
the ``exit discard`` command or you need to commit the changes before exiting.
|
||||||
|
The ``exit`` command doesn't save the configuration, only the ``save`` command
|
||||||
|
does. A warning will be given when exiting with unsaved changes. Using the
|
||||||
|
``exit`` command in operational mode will logout the session.
|
||||||
|
|
||||||
|
|
||||||
Exiting from a configuration level:
|
Exiting from a configuration level:
|
||||||
@ -302,7 +325,8 @@ Warning message when exiting with unsaved changes:
|
|||||||
Load
|
Load
|
||||||
^^^^
|
^^^^
|
||||||
|
|
||||||
The ``load`` command load a configuration from a local or remote file. You have to be use ``commit`` to make the change active
|
The ``load`` command loads a configuration from a local or remote file. You have
|
||||||
|
to use ``commit`` to make the changes active
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -344,9 +368,11 @@ Copies the content of a public key to the ~/.ssh/authorized_keys file.
|
|||||||
Merge
|
Merge
|
||||||
^^^^^
|
^^^^^
|
||||||
|
|
||||||
The ``merge`` command merge the config from a local or remote file with the running config.
|
The ``merge`` command merges the config from a local or remote file with the
|
||||||
|
running config.
|
||||||
|
|
||||||
In the example below exist a ``default-firewall.config`` file with some common firewall rules you saved earlier.
|
In the below example exists a ``default-firewall.config`` file with some common
|
||||||
|
firewall rules you saved earlier.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -390,7 +416,7 @@ Rename
|
|||||||
|
|
||||||
The ``rename`` command allows you to rename or move a configuration object.
|
The ``rename`` command allows you to rename or move a configuration object.
|
||||||
|
|
||||||
See here how to move the configuration entrys from vlanid 3 to 2
|
See here how to move the configuration entries from vlanid 3 to 2
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -424,7 +450,8 @@ See here how to move the configuration entrys from vlanid 3 to 2
|
|||||||
Rollback
|
Rollback
|
||||||
^^^^^^^^
|
^^^^^^^^
|
||||||
|
|
||||||
You can ``rollback`` configuration using the rollback command, however this command will currently trigger a system reboot.
|
You can ``rollback`` configuration using the rollback command, however this
|
||||||
|
command will currently trigger a system reboot.
|
||||||
Use the compare command to verify the configuration you want to rollback to.
|
Use the compare command to verify the configuration you want to rollback to.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
@ -445,7 +472,8 @@ Use the compare command to verify the configuration you want to rollback to.
|
|||||||
Run
|
Run
|
||||||
^^^
|
^^^
|
||||||
|
|
||||||
The ``run`` command allows you to execute any operational mode commands without exiting the configuration session.
|
The ``run`` command allows you to execute any operational mode commands without
|
||||||
|
exiting the configuration session.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -460,7 +488,9 @@ The ``run`` command allows you to execute any operational mode commands without
|
|||||||
Save
|
Save
|
||||||
^^^^
|
^^^^
|
||||||
|
|
||||||
The ``save`` command saves the current configuration to non-volatile storage. VyOS also supports saving and loading configuration remotely using SCP, FTP, or TFTP.
|
The ``save`` command saves the current configuration to non-volatile storage.
|
||||||
|
VyOS also supports saving and loading configuration remotely using SCP, FTP, or
|
||||||
|
TFTP.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -474,7 +504,7 @@ The ``save`` command saves the current configuration to non-volatile storage. Vy
|
|||||||
Set
|
Set
|
||||||
^^^
|
^^^
|
||||||
|
|
||||||
The ``set`` command create all configuration entrys
|
The ``set`` command creates all configuration entries
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -484,9 +514,11 @@ The ``set`` command create all configuration entrys
|
|||||||
Show
|
Show
|
||||||
^^^^
|
^^^^
|
||||||
|
|
||||||
The ``show`` command in the configuration mode displays the configuration and show uncommitted changes.
|
The ``show`` command in the configuration mode displays the configuration and
|
||||||
|
show uncommitted changes.
|
||||||
|
|
||||||
Show the hole config, the address and description of eth1 is moving to vlan 2 if you commit the changes.
|
Shows the whole config, the address and description of eth1 is moving to vlan 2
|
||||||
|
if you commit the changes.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -521,4 +553,4 @@ Show the hole config, the address and description of eth1 is moving to vlan 2 if
|
|||||||
service {
|
service {
|
||||||
ssh {
|
ssh {
|
||||||
port 22
|
port 22
|
||||||
......
|
......
|
||||||
|
|||||||
@ -1,3 +1,5 @@
|
|||||||
|
:lastproofread: 2021-07-30
|
||||||
|
|
||||||
.. _openvpn:
|
.. _openvpn:
|
||||||
|
|
||||||
#######
|
#######
|
||||||
@ -43,7 +45,7 @@ Site-to-site mode supports x.509 but doesn't require it and can also work with
|
|||||||
static keys, which is simpler in many cases. In this example, we'll configure
|
static keys, which is simpler in many cases. In this example, we'll configure
|
||||||
a simple site-to-site OpenVPN tunnel using a 2048-bit pre-shared key.
|
a simple site-to-site OpenVPN tunnel using a 2048-bit pre-shared key.
|
||||||
|
|
||||||
First, one one of the systems generate the key using the operational command
|
First, one of the system generates the key using the operational command
|
||||||
``generate openvpn key <filename>``. This will generate a key with the name
|
``generate openvpn key <filename>``. This will generate a key with the name
|
||||||
provided in the `/config/auth/` directory. Once generated, you will need to
|
provided in the `/config/auth/` directory. Once generated, you will need to
|
||||||
copy this key to the remote router.
|
copy this key to the remote router.
|
||||||
@ -94,7 +96,7 @@ Remote Configuration:
|
|||||||
set interfaces openvpn vtun1 local-address '10.255.1.2'
|
set interfaces openvpn vtun1 local-address '10.255.1.2'
|
||||||
set interfaces openvpn vtun1 remote-address '10.255.1.1'
|
set interfaces openvpn vtun1 remote-address '10.255.1.1'
|
||||||
|
|
||||||
The configurations above will default to using 128-bit Blowfish in CBC mode
|
The above configurations will by default use 128-bit Blowfish in CBC mode
|
||||||
for encryption and SHA-1 for HMAC authentication. These are both considered
|
for encryption and SHA-1 for HMAC authentication. These are both considered
|
||||||
weak, but a number of other encryption and hashing algorithms are available:
|
weak, but a number of other encryption and hashing algorithms are available:
|
||||||
|
|
||||||
@ -177,7 +179,11 @@ First we need to specify the basic settings. 1194/UDP is the default. The
|
|||||||
closing on connection resets or daemon reloads.
|
closing on connection resets or daemon reloads.
|
||||||
|
|
||||||
|
|
||||||
.. note:: Using **openvpn-option -reneg-sec** can be tricky. This option is used to renegotiate data channel after n seconds. When used at both server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur.
|
.. note:: Using **openvpn-option -reneg-sec** can be tricky. This option is
|
||||||
|
used to renegotiate data channel after n seconds. When used at both server
|
||||||
|
and client, the lower value will trigger the renegotiation. If you set it
|
||||||
|
to 0 on one side of the connection (to disable it), the chosen value on the
|
||||||
|
other side will determine when the renegotiation will occur.
|
||||||
|
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
@ -200,7 +206,7 @@ you keep the files in `/config/auth/openvpn`
|
|||||||
|
|
||||||
Now we need to specify the server network settings. In all cases we need to
|
Now we need to specify the server network settings. In all cases we need to
|
||||||
specify the subnet for client tunnel endpoints. Since we want clients to access
|
specify the subnet for client tunnel endpoints. Since we want clients to access
|
||||||
a specific network behind out router, we will use a push-route option for
|
a specific network behind our router, we will use a push-route option for
|
||||||
installing that route on clients.
|
installing that route on clients.
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
@ -236,12 +242,13 @@ OpenLDAP
|
|||||||
--------
|
--------
|
||||||
|
|
||||||
Enterprise installations usually ship a kind of directory service which is used
|
Enterprise installations usually ship a kind of directory service which is used
|
||||||
to have a single password store for all employees. VyOS and OpenVPN support using
|
to have a single password store for all employees. VyOS and OpenVPN support
|
||||||
LDAP/AD as single user backend.
|
using LDAP/AD as single user backend.
|
||||||
|
|
||||||
Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is
|
Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is
|
||||||
shipped with every VyOS installation. A dedicated configuration file is required.
|
shipped with every VyOS installation. A dedicated configuration file is
|
||||||
It is best practise to store it in ``/config`` to survive image updates
|
required. It is best practise to store it in ``/config`` to survive image
|
||||||
|
updates
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -327,7 +334,10 @@ If you only want to check if the user account is enabled and can authenticate
|
|||||||
RequireGroup false
|
RequireGroup false
|
||||||
</Authorization>
|
</Authorization>
|
||||||
|
|
||||||
A complete LDAP auth OpenVPN configuration could look like the following example:
|
A complete LDAP auth OpenVPN configuration could look like the following
|
||||||
|
example:
|
||||||
|
|
||||||
|
.. stop_vyoslinter
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -357,10 +367,13 @@ A complete LDAP auth OpenVPN configuration could look like the following example
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
.. start_vyoslinter
|
||||||
|
|
||||||
OpenVPN Client
|
OpenVPN Client
|
||||||
##############
|
##############
|
||||||
|
|
||||||
VyOS can not only act as an OpenVPN site-to-site or Server for multiple clients.
|
VyOS can not only act as an OpenVPN site-to-site but also as a Server for
|
||||||
|
multiple clients.
|
||||||
You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client
|
You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client
|
||||||
connecting to a VyOS OpenVPN server or any other OpenVPN server.
|
connecting to a VyOS OpenVPN server or any other OpenVPN server.
|
||||||
|
|
||||||
@ -463,6 +476,6 @@ The following commands let you reset OpenVPN.
|
|||||||
|
|
||||||
.. opcmd:: reset openvpn interface <interface>
|
.. opcmd:: reset openvpn interface <interface>
|
||||||
|
|
||||||
Uset this command to reset the OpenVPN process on a specific interface.
|
Use this command to reset the OpenVPN process on a specific interface.
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -156,9 +156,9 @@ release.
|
|||||||
Upon reboot, you should have a working installation of VyOS.
|
Upon reboot, you should have a working installation of VyOS.
|
||||||
|
|
||||||
You can go back to your Vyatta install using the ``set system image
|
You can go back to your Vyatta install using the ``set system image
|
||||||
default-boot`` command and selecting the your previous Vyatta Core image.
|
default-boot`` command and selecting your previous Vyatta Core image.
|
||||||
|
|
||||||
.. note:: Future releases of VyOS will break the direct upgrade path from
|
.. note:: Future releases of VyOS will break the direct upgrade path from
|
||||||
Vyatta core. Please upgrade through an intermediate VyOS version e.g. VyOS
|
Vyatta core. Please upgrade through an intermediate VyOS version e.g. VyOS
|
||||||
1.2. After this you can continue upgrading to newer releases once you bootet
|
1.2. After this you can continue upgrading to newer releases once you booted
|
||||||
into VyOS 1.2 once.
|
into VyOS 1.2 once.
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user