HOWTO: Commission a VyOS Edge Router via HyOps¶

Purpose: Commission a VyOS edge router at Hetzner using the HybridOps blueprint, with BGP, IPsec, and NAT validated through structured run records.

Difficulty: Advanced

Track: Networking Foundations

Overview¶

Use this guide to commission the VyOS implementation of the WAN-edge contract. The result is a reviewable edge state with the interfaces, routing, and tunnel posture required by the Hetzner-to-GCP reference path and its site-extension, recovery, and burst scenarios.

1. Blueprint Overview¶

Blueprint ID: blueprints/hetzner/vyos-edge.
Architecture position: Hetzner-hosted WAN edge.
Dependencies: Hetzner server provisioned, public IP allocated.

2. Module Inputs¶

Public interface IP and gateway.
Internal interface and VLAN configuration.
BGP ASN and peer definitions.
IPsec tunnel peer IPs and PSK references.
NAT masquerade configuration.

3. Interface Bring-Up¶

Public and internal interface configuration.
Verifying reachability on both paths.
Run record: interface state record.

4. BGP Peering¶

eBGP session to GCP hub or on-prem peers.
Prefix advertisement validation.
BGP summary run-record capture.

5. IPsec Tunnel Bootstrap¶

Tunnel configuration and IKE/ESP parameters.
Tunnel establishment verification.
Liveness probe output of the run record.

6. NAT and Routing Validation¶

NAT masquerade for on-prem outbound traffic.
Routing table verification: all expected prefixes present.
End-to-end path probe from on-prem to internet.

References¶

License: MIT-0 for code, CC-BY-4.0 for documentation unless otherwise stated.