Turn SSH on, and restrict it#

You will end up with SSH answering on the LAN address only, accepting a key rather than a password. Some tasks still need a shell — putting a script on the router for a scheduled task, getting back in after a lockout, verifying a migration — and a freshly installed Wheelhouse router has no SSH at all.

Neither the image's configuration nor the installer turns SSH on, so the console is the only shell until you do.

Before you start#

• The Operator role, and a licence: SSH is part of the router's configuration.

• An SSH key pair on the machine you will connect from. If you do not have one:

  bash

  ssh-keygen -t ed25519 -C "you@laptop"

• The router's LAN address. Not its WAN address.

Check what you have first: on a fresh install, System → Settings tab → SSH shows SSH server Off. When SSH is on, the panel also shows its Ports, what it Listens on and whether Password sign-in is Allowed or Keys only.

Step 1 — Put your key on the router account first#

Do this before turning SSH on, so the first connection can use it.

System → Settings tab → Router accounts, then the wheelhouse account. Under SSH keys, paste the whole line from your .pub file into Public key; the panel names the key from its comment. Choose Add key, then Save changes.

A router installed by the current installer has two router accounts: wheelhouse, which is the one to use, and vyos, kept for recovery. Put your key on both, which is what the unattended installer does.

Step 2 — Turn SSH on, bound to the LAN#

System → Settings tab → SSH → Edit. Turn on SSH server, and three more fields appear:

For a port or an address, type it and choose Add; the × beside one removes it. Save changes adds "Turn on SSH" to the pending changes, with "Listening on 192.0.2.1" beneath it.

With no listen address, SSH answers on every address the router has, WAN included. The LAN address as the only listen address keeps SSH off the internet.

Step 3 — Apply it with auto-revert#

Changes to SSH are marked in the bar at the bottom of the page: "These changes could cut off your connection to the router. Apply with auto-revert undoes them if you lose access."

Use Apply with auto-revert. The bar then shows "Waiting for confirmation" and the time left. Connect over SSH from a second terminal (see Check it worked), and when it works, choose Keep changes. If the change has cut you off and you cannot keep it, the router restarts with its saved configuration when the time runs out.

The time allowed is the Auto-revert window on Admin → Agent settings: 2 minutes unless an administrator has changed it, and at most 60.

Step 4 — Turn off password sign-in#

Once you have confirmed the key works: SSH → Edit, turn off Password sign-in, and Save changes — "Allow SSH sign-in with keys only". Apply it with auto-revert again.

Step 5 — Move the port, if you want to#

SSH → Edit → Ports: add the port you want, remove any other, Save changes and apply. The router answers on 22 when no port is set. Moving it cuts log noise; it is not a security control, and the firewall rule in the next step is.

Step 6 — Make the firewall agree#

The firewall the installer writes accepts everything that arrives on the LAN interface, so a LAN-bound SSH is already reachable and nothing else needs doing. If that rule has been narrowed, or SSH must be reachable from a management network that is not on the LAN, add a rule on the Firewall page: ruleset input, action accept, protocol tcp, the management network as the source address (such as 192.0.2.0/28), the SSH port as the destination port, and a description. The page proposes the next free rule number; the Firewall page shows what is taken.

Check it worked#

From the machine whose key you installed:

ssh -o PreferredAuthentications=publickey wheelhouse@192.0.2.1 'uptime'

Then check it is not answering where you did not want it:

# from outside, against the WAN address — this should time out or be refused
nc -vz 203.0.113.2 22

On the router, the SSH panel shows SSH server On, the ports, your LAN address under Listens on, and — once step 4 is done — Password sign-in Keys only.

Undoing it#

SSH → Edit, turn off SSH server, Save changes ("Turn off SSH"), and apply.

The console still works. Nothing else on the router depends on SSH: the agent talks to the router's own API on the router itself, not over SSH.

In Advanced mode#

With Advanced mode on (Account → Preferences), Review changes lists these changes as the router's commands, under service ssh.

See also#

• The console account and its SSH keys
• Working from the console
• Harden a router that faces the internet
• Take a backup that is actually complete
• System — settings