Adding an interface#

+ Add interface on Interfaces opens a side panel that builds one of six kinds of virtual interface. It is a starting point, not a full editor: it stages the handful of commands that bring the interface into existence with an address and a description, and everything else about it is set afterwards from the interface panel, the config tree, or the CLI.

Physical Ethernet ports are not created here. They exist because the box has them; give one an address from the interface panel instead.

The Commands block at the foot of the panel always shows exactly what Stage will send. Read it before you click — it is shorter than this page, and it is the truth.

The six types#

Type	Config node it creates	Required fields
VLAN (802.1Q)	`interfaces ethernet <parent> vif <id>`	parent interface, VLAN ID
Bridge	`interfaces bridge <name>`	name, first member
Bond (LACP)	`interfaces bonding <name>`	name, first member
Tunnel (GRE / IP-in-IP / SIT)	`interfaces tunnel <name>`	name, encapsulation, source address, remote
VXLAN	`interfaces vxlan <name>`	name, VNI, remote or multicast group
Dummy	`interfaces dummy <name>`	name

Choosing a type fills the name field with a default: br0, bond0, tun0, dum0, vxlan0. The VLAN type hides the name field, because a VLAN's name is derived from its parent and ID.

Two fields are common to every type and both are optional:

Address — appended to whichever node the type created, as set … address <value>. See Addressing.
Description — appended the same way.

Stage is disabled until the required fields for the chosen type are filled. A type with a missing requirement produces no commands at all rather than a partial set.

VLAN#

Stages the vif node under the parent, then the optional address and description against that same node.

set interfaces ethernet eth0 vif 20
set interfaces ethernet eth0 vif 20 address 10.0.20.1/24
set interfaces ethernet eth0 vif 20 description 'IoT'

The parent field is free text and defaults to eth0. The kernel names the resulting interface eth0.20.

A VLAN made here does not get a row of its own on the Interfaces table; it is part of its parent's node. See what the table does not show.

Bridge#

Stages the bridge with one member. Add the rest from the config tree or the CLI.

set interfaces bridge br0 member interface eth2
set interfaces bridge br0 address 10.0.30.1/24
set interfaces bridge br0 description 'lab bridge'

An interface that is a bridge member must not carry an address of its own; give the address to the bridge. Removing an address from a member is done from the interface panel.

Bond (LACP)#

Stages the bond in 802.3ad mode with one member.

set interfaces bonding bond0 mode 802.3ad
set interfaces bonding bond0 member interface eth2
set interfaces bonding bond0 address 10.0.40.1/24

The mode is fixed at 802.3ad by the panel. The other VyOS bonding modes — active-backup, balance-rr and the rest — and the hash policy, the LACP rate and the second member are set from the CLI or the config tree afterwards. LACP needs the switch side configured for it: a bond in 802.3ad against a switch port that is not in a port-channel will not pass traffic reliably.

Tunnel#

Requires both a source address and a remote. The source must be an address the router already holds.

set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.2
set interfaces tunnel tun0 remote 198.51.100.7
set interfaces tunnel tun0 address 10.255.0.1/30

The encapsulation menu offers five values, written verbatim into the command:

Value	What it is
`gre`	GRE, layer 3
`gretap`	GRE carrying Ethernet frames, layer 2
`ipip`	IP in IP
`sit`	6in4 — IPv6 carried over IPv4
`ip6gre`	GRE over IPv6

A tunnel has no MAC address, so the MAC column on the table stays empty for it: the kernel prints the local address where an Ethernet interface prints link/ether, and the parser only reads a MAC from that line — agent/parse.go (parseInterfaceDetail).

The panel does not set a tunnel key, a TTL, or parameters ip …. Those are CLI.

VXLAN#

Requires a VNI and a remote. The Remote or multicast group field is read twice: if the value falls in 224.0.0.0–239.255.255.255 the panel writes group, otherwise it writes remote.

set interfaces vxlan vxlan0 vni 100
set interfaces vxlan vxlan0 remote 198.51.100.7
set interfaces vxlan vxlan0 source-address 203.0.113.2

With a multicast group instead:

set interfaces vxlan vxlan0 vni 100
set interfaces vxlan vxlan0 group 239.1.1.1

The VNI hint is 0–16777214. The source address is optional and is written as source-address.

Dummy#

A local interface that is always up and belongs to no wire. It is what a router ID, a BGP source address or an anycast address lives on.

set interfaces dummy dum0
set interfaces dummy dum0 address 10.255.255.1/32

What the panel will not do#

It stages one member for a bridge or a bond. The second member is a CLI command or a config-tree edit.
It writes no bridge options — no STP, no VLAN filtering, no ageing time.
It writes no bonding options other than mode 802.3ad.
It writes no tunnel key, TTL or encapsulation parameters.
It cannot create a PPPoE interface. That is on the Uplinks tab, where a PPPoE session is treated as a way to get a default route — see Uplinks.
It cannot create a WireGuard interface; those are made on the WireGuard page.

Everything it does not write is reachable from the config tree or the CLI, and the interface it created is a normal node once it exists.

Worked example: an IoT VLAN with its own address#

The goal is eth0.30, addressed 10.0.30.1/24, described, ready for a DHCP pool.

Network → Interfaces → + Add interface.
Type VLAN (802.1Q).
Parent interface eth0, VLAN ID 30.
Address 10.0.30.1/24, description IoT.

The Commands block reads:

set interfaces ethernet eth0 vif 30
set interfaces ethernet eth0 vif 30 address 10.0.30.1/24
set interfaces ethernet eth0 vif 30 description IoT

Stage, then commit. The set contains address, so commit-confirm is offered; take it.

The VLAN now exists. It will not appear as a row on the Interfaces table — check it in the CLI view, or on the router with show interfaces ethernet eth0 vif 30. Two things still have to happen elsewhere before a host on that VLAN works: a DHCP subnet for 10.0.30.0/24 on DHCP, and rules deciding what the new segment may reach, which is the Firewall page's job. The switch port carrying the trunk has to tag VLAN 30 too.