Network#
Everything in the web UI that decides where a packet goes and what address a host has. That is the five entries in the left nav's Network group — Interfaces, Static routes, BGP / OSPF, High availability and QoS — plus DHCP and DNS, which sit under Services in the nav because they are services the router runs, and are documented here because they are how a segment gets an address and a name.
Three facts hold on every page in this section, and are repeated on each page rather than assumed.
Nothing on these pages applies itself. Every editor calls stage(...) and renders
the exact set and delete commands it will run before it stages them. The Commit Bar
is the only thing in the product that commits —
ui/src/lib/staging.tsx,
ui/src/lib/format.ts (renderOp).
Nearly every change in this section is flagged dangerous. isDangerousPath in
ui/src/lib/format.ts matches any path containing
address, dhcp-options or default-route-distance, and any path starting
protocols static route 0.0.0.0/0, protocols failover, protocols static table,
load-balancing, policy route, high-availability, firewall, nat or
interfaces … eth1. A staged set that matches offers commit-confirm and styles the
plain Commit as destructive, because these are the changes that can end your own
session.
Configured and observed are two different columns. Interfaces, routes, uplinks and DHCP reservations are each shown as what the configuration declares joined with what the kernel or the daemon reports, and where the two disagree the page says so rather than picking one.
The pages#
| Page | The screen it documents |
|---|---|
| Interfaces | Configured interfaces joined with link state, MTU, qdisc and counters. |
| The interface panel | Every control in the side panel: addresses, description, MTU, admin disable, delete. |
| Adding an interface | VLAN, bridge, bond, tunnel, VXLAN and dummy, with the exact commands each writes. |
| Addressing | What goes in an address field, what dhcp means there, and what MTU value is safe. |
| Neighbours | The ARP table as the Interfaces page shows it. |
| Static routes | The kernel forwarding table beside the routes the configuration declares. |
| BGP / OSPF | Whether FRR is configured, what it is configured with, and what this page cannot show. |
| High availability | One page, four tabs: more than one way out, and more than one router. |
| Uplinks (multi-WAN) | Every uplink through all five VyOS mechanisms, ranked, health-checked and NATed. |
| VRRP | Virtual addresses that move between two routers, with keepalived's live verdict. |
| Conntrack sync | Keeping established flows alive when a virtual address moves. |
| DHCP | Subnets, pools, static reservations and the live lease table. |
| DHCP relay | Forwarding requests to a server on another segment. |
| DHCP and IPv6 | Router advertisements and the DHCPv6 server. |
| DNS | The forwarding resolver, its cache, and authoritative records for local names. |
| Dynamic DNS | Keeping a name pointed at a changing uplink address. |
| mDNS repeater | Re-announcing multicast discovery between segments. |
QoS is in the Network nav group but is documented with the rest of the monitoring and shaping screens, on QoS.
Which page owns which subtree#
Every page in the web UI names the configuration subtree it writes, beside its title. These are the ones in this section.
| Screen | Subtree | Read from |
|---|---|---|
| Interfaces | interfaces | GET /api/interfaces, GET /api/interfaces/detail |
| Static routes | protocols static | GET /api/routes |
| BGP / OSPF | protocols | GET /api/routing |
| High availability → Uplinks | protocols failover, load-balancing wan, protocols static table, policy route, nat source | GET /api/wan |
| High availability → VRRP | high-availability vrrp | GET /api/vrrp |
| High availability → Conntrack sync | service conntrack-sync | GET /api/vrrp |
| DHCP | service dhcp-server, service dhcp-relay, service router-advert, service dhcpv6-server | GET /api/dhcp/reservations, GET /api/dhcp/leases, GET /api/config |
| DNS | service dns | GET /api/dns, GET /api/ddns |
IPv6 in this section#
IPv6 is configurable through these screens and largely not observable through them.
There are editors for router advertisements and a reader for the DHCPv6 server; an
interface takes IPv6 addresses like any other value. But the routing table view reads
show ip route, which is IPv4 only, the uplink model has no IPv6 concept at all, and
the neighbour tab reads show arp. A dual-stack router can be configured here and then
has to be inspected from the CLI. This is stated again on each page it affects —
agent/opmode.go, agent/wan.go,
README.md (Status), docs/security.md
("No IPv6 in the operational views").
See also#
- Security and access — the firewall, NAT, the IDS, VPNs and who may change any of this.
- Services, monitoring and system — the Dashboard, the shaper, diagnostics and the journal.
- About Wheelhouse — what comes from VyOS and what Wheelhouse adds on top of it.
Checked against ui/src/components/nav.ts,
ui/src/lib/format.ts,
ui/src/lib/staging.tsx,
agent/main.go, agent/wan.go,
agent/opmode.go, docs/ui.md.