Boxes with one port#

A single-NIC machine installs. The LAN menu excludes whatever you chose as the WAN, so on a one-port box it contains only skip — and the installer handles that deliberately rather than leaving you to discover the consequences afterwards. It warns that the box will have a WAN and no LAN, keeps the firewall on, and asks for a management source: an address or prefix allowed through the input filter to reach the router itself.

What the installer does differently#

After you skip the LAN, two things happen that do not happen on a two-port box.

A screen states the consequence. The firewall still blocks everything arriving from the WAN, so after the install the web UI is reachable only from the console until you add an interface or a rule. The next screen offers one way in.

It asks for a management source. An address or prefix allowed to reach this router — the web UI on 8443 and, if you turn it on, SSH. Leave it empty to allow nothing.

set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 description "management source"
set firewall ipv4 input filter rule 50 source address 203.0.113.0/24

An address containing a colon is written into the IPv6 ruleset instead. It goes into one family, not both, so if you need both you will add the second rule yourself afterwards.

What you end up with#


WAN	configured, with a description of `WAN`
LAN	none
Firewall	written, both families, default deny inbound
NAT	not written — the masquerade rule needs both a WAN and a LAN
DHCP server and DNS forwarder	not written — both belong to the LAN screen
Web UI	reachable from the console, and from the management source if you gave one

The installer's closing summary says so in as many words: with no LAN and no management source, the web UI is reachable from this console only, until you add an interface or a rule.

Getting in afterwards#

Three ways, in order of how likely they are to be what you want.

From the management source you named. Browse to https://<the router's WAN address>:8443 from a machine inside that prefix.

From the console. The banner above the login prompt carries the address and, if the agent started fresh, the first-boot password. Sign in as vyos with the console password you chose. From there:

bash

curl -k https://127.0.0.1:8443/health

By adding a rule from the console. Open a configuration session and admit the source you need:

set firewall ipv4 input filter rule 60 action accept
set firewall ipv4 input filter rule 60 description "office"
set firewall ipv4 input filter rule 60 source address 198.51.100.0/24

Adding the second network later#

There is no bridge, VLAN or LAG option in the installer. On a four- or six-port appliance the installer configures the one port you name as LAN and leaves the rest unconfigured; on a one-port box there is nothing to configure yet. Both are the same problem afterwards, and the answer is Network → Interfaces, where you can add addresses, VLANs and bridges — or the console with configure.

When you do add a LAN interface, three things the installer would have written are not there and are worth writing deliberately:

An input rule admitting the LAN, or the default-drop rule will keep the LAN out of the router itself as well.
A forward rule admitting the LAN, or nothing behind the router will reach the internet.
A source NAT rule, unless your upstream routes the LAN prefix to you.

Every installer question shows exactly what those rules look like on a two-port install, which is the shape to copy.

Buying advice, such as it is#

Two ports is the shape this product expects, and a one-port install is a supported compromise rather than a design. If you are choosing hardware, choose two. What you need has the rest of the shape-of-the-box notes, including the fact that there is no hardware compatibility list.