Virtual Firewalls

VyOS Firewalls as Managed Cloud Resources

When you create a virtual firewall via the GUI or VMease REST API, VMease sets up or assigns a VyOS instance, connects the required network interfaces, configures addressing, applies a basic firewall policy, and saves the interface mappings in the platform database.

To speed up deployment, small firewall instances are taken from a ready-made pool. VMease prepares this pool by cloning and starting VyOS appliances in advance. Larger firewalls are created when needed and placed on available Proxmox hosts, depending on resources.

The firewall provisioner selects a suitable Proxmox host, clones the VyOS template, sets the required CPU and memory, connects the right VLAN or VXLAN networks, and starts the instance. For small firewalls, VMease uses a pre-made VyOS instance if available, and creates a new one only if necessary.

Supported firewall sizes include

Interface Configuration and Network Attachment

VMease allows VyOS interfaces to connect to both traditional VLAN-backed networks and VMease virtual networks (Vnets). This lets the firewall act as a tenant edge device, internal router, service firewall, VPN endpoint, or a boundary between customer networks.

You can assign each interface a simple name, such as INSIDE, OUTSIDE, DMZ, BACKUP, or TRANSIT. VMease maps these names to the actual Proxmox and VyOS interface identifiers, providing users a friendly, easy interface. This means you do not have to worry about how the hypervisor presents interfaces to VyOS. VMease handles the mapping and displays the interfaces in a way that makes sense to you.

Baseline Firewall Policy

When you create a firewall, VMease sets up, if needed, a default forward-filter so only allowed traffic passes through. This gives users a secure starting point for building routed environments and prevents the firewall from being left unmanaged.

VMease can also prepare the firewall for VPN use by creating the required WireGuard peer address group and allowing WireGuard traffic on the external interface.

Source NAT and Destination NAT

VMease supports customer-managed NAT policy on VyOS.

Source NAT can be used for outbound internet access, tenant egress, routed private networks, or controlled address translation between internal and external zones.

Destination NAT can be used for inbound publishing of services, port forwarding, or mapping external addresses and ports to internal workloads.

VMease applies NAT rules step by step. It checks the rules, applies them to VyOS, commits and saves the changes, and then verifies the result. If the VyOS setup is not as expected, VMease rolls back the changes to avoid leaving the firewall partly configured. VyOS configuration is tracked and managed in the VMease database.

The NAT model is stateful, and applying NAT changes does not disrupt existing traffic flows.

Forward Firewall Rules and Address Groups

VMease manages the VyOS forward-filter policy, which controls routed traffic between firewall interfaces. It standardizes the rules and saves them in the platform database, so you see firewall policies in a clear, structured format instead of raw CLI commands.

When rules are applied, VMease resets and rebuilds the forward-filter policy, checks that the correct configuration is in place, and saves the updated policy. This keeps the platform records accurate while VyOS enforces the rules.

• IPv4 and IPv6 rules
• Protocols: ANY, ICMP, TCP, UDP and combined TCP/UDP handling

Live Routing Table Visibility

VMease displays the live VyOS routing table in the user GUI. This helps with troubleshooting because it displays what the firewall is actually using, not just what was set up. The routing table is simplified with easy-to-read, friendly interface names.

This is particularly useful when diagnosing:

• Incorrect next hops
• Missing static routes
• OSPF-learned route visibility
• VPN route propagation
• Wrong egress interface selection
• Tenant network reachability issues

Static Routing

You can add or remove static routes on your VyOS firewall using VMease. This is useful for private networks, transit networks, backup networks, VPN routes, migration networks, or upstream hand-off routes. Changes are applied using a commit-verify-rollback approach. VMease checks the route data before applying it, then confirms that the expected route exists or has been removed after the change.

OSPF Routing

VMease lets you set up OSPF on VyOS interfaces. This allows your VMease firewall to join dynamic routing with upstream routers, customer routers, multisite networks, or internal routed domains.

VMease applies changes specified through the GUI and API, implements them in VyOS, and rolls back if the change is not fully applied.

On a per-interface basis, VMease enables users to configure:

• OSPF passive interface mode
• OSPF network type, hello and dead timer tuning
• Automatic firewall rule adjustments to allow OSPF traffic on enabled interfaces

DHCP Server and Relay

VMease can set up VyOS DHCP services for your networks, including both DHCP server configuration and optional DHCP relay settings.

It checks subnets, address ranges, MAC address entries, overlapping configurations, server and relay conflicts, and interface compatibility. Then it generates the needed VyOS configuration, compares it with the current state, applies only the required changes, commits the transaction, and verifies the result.

VMease also manages the required DHCP input firewall rules using a reserved range. This way, DHCP services work without you needing to set up detailed firewall exceptions yourself.

This supports use cases such as:

• Tenant LAN DHCP
• Routed customer networks
• DHCP relay to centralised services
• Controlled service networks
• Lab and test environments

WireGuard VPN

VMease manages the full lifecycle of WireGuard VPNs for VyOS firewalls.

The platform can create and securely store a WireGuard identity for your firewall. Private keys are encrypted in the VMease credential store, and public keys are saved for later use. Identity creation is separate from VyOS setup, so keys can be made and stored before building a tunnel.

When you set up a VPN site, VMease configures the WireGuard interface on VyOS, assigns the correct wgX interface, sets up addressing, configures the peer, and adds static routes for allowed networks. IPv4 and IPv6 are handled separately when needed to ensure routes and next hops are set correctly.

This lets you build site-to-site VPN connections without needing to log in to VyOS yourself.

• Firewall-local WireGuard keypair generation
• Encrypted private key storage
• Public key registration
• Site-to-site tunnel creation
• IPv4 and IPv6 tunnel addressing
• Allowed IP route handling
• VyOS interface creation
• VPN interface removal and database soft-delete on decommissioning

Transactional Configuration and Rollback

Configuration changes are verified after every change. The configuration is not just sent to the device and assumed to work. VMease automation runs the necessary VyOS commands, commits and saves the setup, then pulls the active config from VyOS to check the result, and rolls back the whole change if something is wrong.

This is important for enterprises and multi-tenant cloud platforms because unclear or incomplete network setups can cause outages that are difficult to troubleshoot.

This leads to a safer way to operate:

• Input is validated before execution
• VyOS configuration is applied in controlled transactions
• Changes are verified after commit
• Rollback is attempted on mismatch
• Platform records are updated only after successful completion
• Failed tasks return diagnostic detail for support and troubleshooting

Operational Visibility and Logging

Because firewall changes go through VMease tasks, all configuration work can be tracked. Task runs, warnings, errors, and diagnostic details are logged in one place, so operators can see what happened during setup, changes, deletion, or recovery.

This approach is easier to support than unmanaged appliance access, where changes might be made manually and the platform would not know what was changed or why.

What This Means for Customers

For customers, the virtual firewall feature provides a practical VyOS-based network edge that you can manage through the VMease platform.

You can create firewalls, connect them to networks, set up routed interfaces, manage NAT, apply firewall rules, add static routes, enable OSPF, provide DHCP services, create WireGuard VPNs, and check the live routing table. All of this can be done without needing direct access to Proxmox or VyOS.

For service providers and platform operators, VMease connects the firewall lifecycle to inventory, task status, credentials, logging, and cleanup. Customers get a familiar cloud-style network service, while the platform maintains control over setup, configuration consistency, and recovery.