The first hour#

The router routes. Now make it yours. This is a checklist rather than an essay, in rough order of what it costs you to have skipped it. The first item is a backup, because the cheapest moment to learn how a restore works is before you need one, and because from here on you will be changing things.

The first five minutes#

1. Change the admin password if you have not already. The router will not let you past the password gate until you do.
2. Check the router's name and time zone. They are on the System page. The time zone is what the logs, the audit trail and certificate validity all read from.
3. Look at the WAN. The Dashboard shows per-interface throughput and the Interfaces page shows the address the provider handed out. If the WAN shows no address, that is where to start rather than anywhere else.
4. Make one change and watch the Commit Bar. Anything harmless — a description on an interface. The editor shows you the set line before it does anything; the line goes into the working set rather than being applied; the Commit Bar at the foot of the screen is the only thing that commits it. Once you have seen that once, the rest of the product makes sense.

Take a backup before you change anything else#

A backup is more than the router's configuration file. The agent's accounts, TOTP secrets, the router's own API key, the audit log, the certificate and the licence all live under /config/wheelhouse, and a config.boot on its own restores none of them.

From the console, or over SSH once you have turned SSH on:

sudo tar -czf /tmp/wheelhouse-$(hostname)-$(date +%F).tgz -C / config

Then copy it off the box and delete the local copy. Check it before you trust it:

tar -tzf wheelhouse-2026-09-02.tgz | grep -E 'config/(config.boot|wheelhouse/state.json|wheelhouse/api-key)$'

Three lines means you have a backup. Fewer means you have a file.

Taking a backup never needs a licence: Download config in the System page header and GET /api/config/raw are reads, and reads always work.

Confirm the firewall#

show configuration commands | match firewall

An empty answer on a box with a WAN is an emergency, not a preference. Check that both families are there. If the installer told you at the end that this image had no firewall ipv6 node, only the IPv4 ruleset was written, and you should write the v6 filter before you turn IPv6 on.

Then know what the ruleset does and does not cover:

• ICMP is accepted from anywhere, WAN included, on both families. On IPv4 you can narrow rule 30; on IPv6 you should not, because neighbour discovery and path-MTU discovery are ICMPv6.
• Nothing in the installer's ruleset opens 8443 from the WAN — but the agent itself listens on 0.0.0.0:8443, so the firewall is the only thing keeping the management UI off the internet.

Every installer question has the exact ruleset.

What is listening#

On a box that has just finished the interactive install:

SSH is off. Neither the image's default configuration nor the installer writes service ssh, so a freshly installed router has no SSH at all and the console is the only shell. Every remote procedure in this documentation that uses ssh needs you to turn it on first, and to decide deliberately:

set service ssh listen-address 192.168.1.1
set system login user vyos authentication public-keys laptop key <base64>
set system login user vyos authentication public-keys laptop type ssh-ed25519

VyOS' own API is pinned to loopback. First boot mints a random 40-character API key for the agent, enables the REST endpoints, and sets service https listen-address 127.0.0.1. The router's own API is not a network service on a Wheelhouse box; the agent is the management surface. Do not undo that.

Accounts, roles and tokens#

• Give every person their own account, with the lowest role that works. Nobody should be sharing admin. Administration → Users. A new account is created with the must-change-password flag set, so the person who receives it sets their own.
• Issue API tokens for anything automated, one per consumer, with an expiry, and revoke them when the consumer goes away. Administration → API tokens. Scripting against a session cookie is the wrong shape.
• Turn on two-factor on your own account — but read the next box first.

Three roles exist and are enforced per route on the server. Per-object permissions do not exist, and neither does a hardware-key second factor.

Replace the certificate#

The self-signed certificate is good for 398 days and is a leaf for this one host. Replacing it with one your browsers already trust is what makes a certificate warning start meaning something again. Until then, add a security exception for the host rather than importing the certificate into a root store.

Two more, before you forget#

• Take the management UI off the WAN. A firewall rule is the clean way. Changing --addr in /lib/systemd/system/wheelhouse-agent.service to the LAN address is belt and braces — but be aware that an image upgrade replaces that unit file.
• Shorten the session lifetime from 12 hours if the machine is somewhere people walk past.

Then#

Change the LAN addressing, add VLANs, add rules. Every editor shows the commands it will run and every change lands in one working diff that one Commit Bar commits. Watch the audit log on the System page as you go: it records who, from where, and the exact set commands.

See also#

• Take a backup — the full procedure, including the manual step.
• Restore — because a backup you have not restored is a guess.
• Turn SSH on — deliberately, bound to the LAN, with keys.
• The Commit Bar and commit-confirm — the two things to understand before you change anything that could lock you out.
• Revisions and rollback — undoing a commit.
• Firewall rules — narrowing what the installer wrote.
• Locked out — read it before you need it.
• Enter a licence — before any of the changes above will commit.
• Every installer question — what the box was built with.

Checked against docs/install.md, docs/security.md, docs/backup-restore.md, packaging/firstboot.sh, packaging/wheelhouse-agent.service, agent/tls.go, agent/admin.go, README.md, SUPPORT.md.