The next step is to configure both VyOS routers. Before we do, we should ensure that we have a good high-level understanding of what should be happening.

The ultimate goal of this three-router setup is to have our own VyOS router as the gateway to the Internet, while also allowing the Verizon router to continue providing network access for the value-added services like:

• Video-on-Demand to set-top boxes
• On-screen caller ID
• Remote DVR access
• Etc.

The Verizon router does this by setting up its own NAT’d network on the 192.168.1.0/24 range, which the STBs in the house sit on and use to communicate with Verizon’s servers. The VZ router expects and requires the IP it is assigned on its WAN port to be publicly routable on the FiOS ISP network. If it is not, things may or may not work, or they might become unpredictable in their functionality.

The entire point of the secondary router is to provide 1:1 NAT between the home network and the VZ router, so that the VZ router gets assigned the same IP as the primary router that is actually talking to the FiOS ISP network.

This network configuration, combined with some port forwarding rules on the primary and secondary router (discussed later), allows traffic between the Verizon router and the Verizon servers to flow normally without the VZ router being aware that it is not actually directly connected to the FiOS ISP network.

Let’s start by configuring the primary router. This router will actually receive the public-facing IP from the FiOS ISP network, and thus will ultimately be responsible for all Internet traffic. Log into your primary router and run the show interfaces command.

vyos@primary-router:~$ show interfacesCodes: S - State, L - Link, u - Up, D - Down, A - Admin DownInterface        IP Address                        S/L  Description---------        ----------                        ---  -----------eth0             108.0.0.123/24                    u/u  FiOS Public Internet eth1             10.0.0.1/24                       u/u  Home Network lo               127.0.0.1/8                       u/u                   ::1/128

We see two Ethernet interfaces, eth0 and eth1. These represent the two vNICs provisioned to this VM, and which correspond to the FiOS Public Network and Home Network port groups, respectively.

Let’s configure the eth0 interface first.

vyos@primary-router:~$ configurevyos@primary-router:~# set interfaces ethernet eth0 address dhcpvyos@primary-router:~# set interfaces ethernet eth0 description FiOS_ISP_Netvyos@primary-router:~# set interfaces ethernet eth0 duplex autovyos@primary-router:~# set interfaces ethernet eth0 speed auto

This will set this interface up to use a dynamically assigned address (from Verizon), set a description to make it easy to remember what it connects to, and auto negotiate speed and duplex settings.

There is one more step required. We must configure this interface to impersonate our Verizon hardware router’s WAN interface by setting it to use the same MAC address (Verizon filters MACs that are not on its whitelist). You can find the WAN MAC you need to enter printed on the bottom of your Verizon router. Replace 0a:1b:2c:3d:4e:5f below as appropriate:

vyos@primary-router:~# set interfaces ethernet eth0 mac 0a:1b:2c:3d:4e:5f

Let’s take a look at the changes we are making.

vyos@primary-router:~# compare

When you are satisfied, commit the changes to the running configuration and save the running config to disk. If you commit but do not save, the changes will not persist after a reboot of the router.

vyos@primary-router:~# commitvyos@primary-router:~# save

Let’s take another look at the interface configuration now. We’re still in configuration mode (note the # symbol at the end of the command prompt), so we need to prepend run to the command we used before.

vyos@primary-router:~# run show interfaces

Hopefully, your eth0 interface has a public address assigned from the Verizon DHCP server. If not, check your connections and configurations.

Assuming all is well, you should now be able to ping addresses to confirm that you have connectivity out to the Internet.

vyos@primary-router:~# run ping 8.8.8.8PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.64 bytes from 8.8.8.8: icmp_req=1 ttl=251 time=21.1 ms64 bytes from 8.8.8.8: icmp_req=2 ttl=251 time=22.0 ms64 bytes from 8.8.8.8: icmp_req=3 ttl=251 time=20.9 ms64 bytes from 8.8.8.8: icmp_req=4 ttl=251 time=22.3 ms^C--- 8.8.8.8 ping statistics ---4 packets transmitted, 4 received, 0% packet loss, time 3004msrtt min/avg/max/mdev = 20.948/21.610/22.307/0.605 ms

If this works, then congratulations! The good news is that your first router is working. The bad news is that nothing else can use your Internet connection yet.

VyOS and OpenStack Configuration Drives

#!/usr/bin/pythonimport jsonimport shutilmeta_data_file = open('/config-drive/openstack/latest/meta_data.json')json_input = meta_data_file.read()try:  decoded = json.loads(json_input)  for file in decoded['files']:    print file['content_path'], file['path']    shutil.copy2('/config-drive/openstack' + file['content_path'], file['path'])except (ValueError, KeyError, TypeError):  print "JSON format or content error"

#!/bin/bash -xeapt-get install debian-archive-keyringcat >> /etc/apt/sources.list <
     
      > \  livecd/config.vyatta/chroot_local-packageslists/vyatta-extra.listexport PATH=/sbin:/usr/sbin:$PATHautoreconf -i./configuremake isols -l livecd/binary.isoecho Done!
     

glance image-create --name "VyOS Router" --is-public True \  --disk-format iso --container bare < ./build-iso/livecd/binary.iso

cat > config.boot <<"EOF"interfaces {    ethernet eth0 {        address dhcp    }    loopback lo {    }}service {    ssh {        port 22    }}system {    login {        user vyos {            authentication {                plaintext-password "demo"            }            level admin        }    }}EOF

nova boot --config-drive true --image "VyOS Router" \  --flavor 
     
       --file /root/configuration=config.boot \  --meta essential=false --nic net-id=
      
        vyos