Services, web UI, HTTP API — what is reachable and how

A VyOS router runs several services that are reachable from the network: SSH for configuration, the HTTP API for automation, the web GUI for browsing, syslog for forwarding, and SNMP for monitoring. Each service is a potential attack surface and a potential operator convenience. The operator who understands each service — what port, what authentication, what endpoints — can configure the router for operational convenience and security.

This lesson is the operator’s foundation in the services VyOS exposes: the default ports, the authentication model, the hardening guidance, and the failure modes that arise from misconfigured services.

Services by default

flowchart TB
  subgraph "Default services"
    SSH["SSH\ntcp/22"]
    WEB["Web GUI\ntcp/80, 443"]
    API["HTTP API\ntcp/8443"]
    SYS["Syslog receiver\nudp/514, tcp/514"]
    SNMP["SNMP\nudp/161"]
  end

  subgraph "Optional services"
    DHCP["DHCP server\nudp/67, 68"]
    DNS["DNS forwarder\nudp/53, tcp/53"]
    LDP["LDP\nudp/646"]
    VRRP["VRRP\nip/112"]
  end

  C["Client"] --> SSH
  C --> WEB
  C --> API
  M["Monitor"] --> SYS
  M --> SNMP
  LAN["LAN"] --> DHCP
  LAN --> DNS

Each service is reachable on a configured interface, optionally restricted by source ACL, optionally authenticated.

The default state on a fresh VyOS install: SSH on TCP 22, the HTTP API on TCP 8443, and the configured routing protocols. The web GUI, syslog receiver, and SNMP are disabled by default.

SSH

The operator’s primary access to the router. SSH runs on TCP 22 by default, listening on the configured management interfaces.

configure
set service ssh listen-address 10.0.0.1
set service ssh port 22
set service ssh disable-password-authentication
set service ssh ciphers aes256-gcm@openssh.com
set service ssh macs hmac-sha2-512
commit
save

The hardening configuration:

• disable-password-authentication — disable password auth; require keys.
• ciphers — modern AEAD ciphers only.
• macs — modern MAC algorithms only.
• listen-address — bind only to the management interface.

The operator who leaves SSH on the default configuration allows password authentication from any source interface. This is the most common production security gap.

Web GUI

VyOS ships with a web GUI accessible at TCP 80 (HTTP) and TCP 443 (HTTPS). The web GUI exposes the same configuration tree the CLI does, in a form-based interface.

configure
set service https listen-address 10.0.0.1
set service https listen-address 192.0.2.50
set service https certificates cert-file /config/certs/server.crt
set service https certificates key-file /config/certs/server.key
commit
save

The hardening configuration:

• listen-address — bind only to the management interfaces.
• certificates — use a real certificate, not the self-signed default.
• disable HTTP — redirect all traffic to HTTPS.

The web GUI is convenient but adds attack surface. Most production operators disable the web GUI and use the CLI.

HTTP API

The HTTP API is the automation surface. It runs on TCP 8443 by default and exposes RESTful endpoints for every configuration parameter.

# Show the configuration via the API
curl -k -u 'vyos:vyos' https://router.example.com:8443/configure

# Set a configuration value
curl -k -u 'vyos:vyos' -X POST https://router.example.com:8443/configure \
  -H 'Content-Type: application/json' \
  -d '{"interfaces": {"ethernet": {"eth0": {"address": "192.0.2.50/24"}}}}'

The API uses HTTP basic authentication with the same credentials as SSH. The hardening configuration:

configure
set service https api listen-address 10.0.0.1
set service https api keys id vyos-key plaintext secretstring
set service https api keys id vyos-key plaintext plaintext-key ''
commit
save

The API supports both password authentication (HTTP basic) and API key authentication. API key authentication is preferred for automation: the key can be scoped, rotated, and revoked without changing the user’s password.

Syslog

The router can act as a syslog receiver. The service listens on UDP 514 and TCP 514 by default when enabled.

configure
set system syslog host 10.0.0.100 facility all level info
commit
save

The router forwards all log messages with facility all and severity info or higher to 10.0.0.100. The remote syslog server receives the messages and stores them.

The hardening configuration:

• Restrict by source: the remote syslog protocol does not support strong authentication; restrict the receiver to known source IPs.
• Use TLS: when available, use syslog-over-TLS for confidentiality and integrity.

SNMP

The router exposes SNMP v2c or v3 on UDP 161 when enabled.

configure
set service snmp listen-address 10.0.0.1
set service snmp community public authorization ro
set service snmp location "DC1 Router"
set service snmp contact "noc@example.com"
commit
save

For production monitoring, SNMPv3 with authentication and encryption is the standard:

configure
set service snmp v3 engine-id "..."
set service snmp v3 group monitoring mode auth-privacy
set service snmp v3 user monitor-user auth plaintext-key ... auth-type sha privacy plaintext-key ...
commit
save

The hardening configuration:

• v3 only: disable v2c.
• auth-privacy: authentication (SHA) and encryption (AES).
• Restrict by source: restrict the SNMP listener to known monitoring networks.

DHCP server

The router can run a DHCP server on configured interfaces. The server listens on UDP 67; clients connect on UDP 68.

configure
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 default-router 10.0.0.1
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 dns-server 10.0.0.1
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 start 10.0.0.100
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 stop 10.0.0.0.200
set service dhcp-server shared-network-name LAN interface eth1
commit
save

The hardening configuration:

• Restrict by interface: bind to specific interfaces only.
• Static mappings: for known devices, use static mappings to prevent rogue clients from getting leases.

Source restrictions and management VRF

The most important service hardening: bind services only to the management interfaces.

configure
# SSH only on the management interface
set service ssh listen-address 10.0.0.1

# Web GUI only on the management interface
set service https listen-address 10.0.0.1

# HTTP API only on the management interface
set service https api listen-address 10.0.0.1

# SNMP only on the monitoring network
set service snmp listen-address 10.0.0.100
commit
save

For production-grade isolation, run management services on a separate VRF:

configure
set vrf name MGMT
set interfaces ethernet eth0 vrf MGMT
set service ssh listen-address 10.0.0.1 vrf MGMT
set service https listen-address 10.0.0.1 vrf MGMT
commit
save

The management VRF isolates the management plane from the forwarding plane. The operator can SSH to the management interface without exposing the SSH service to the data plane.

Failure modes

SSH brute-force attacks

The router’s SSH listener is on the public Internet. Attackers scan and brute-force SSH credentials.

Fix:

• Disable password authentication.
• Restrict by source IP.
• Use a non-standard port (security through obscurity, but reduces scan noise).
• Use fail2ban or equivalent to block repeat offenders.

Web GUI exposed to the data plane

The web GUI is configured on a data plane interface by mistake. Attackers can reach the GUI from the public Internet.

Fix:

• Restrict listen-address to the management interface.
• Use a management VRF.

SNMP v2c on a public interface

The router exposes SNMP v2c with the default community string on a public interface. Attackers can read the routing table, the interface state, and a wealth of operational information.

Fix:

• Disable v2c, use v3 only.
• Restrict listen-address to the monitoring network.

HTTP API with default credentials

The HTTP API is configured with the default credentials and exposed to the management network. Attackers can change the configuration.

Fix:

• Change the default credentials.
• Use API keys, not passwords.
• Restrict by source IP.

Operational commands

The operator inspects the service state with:

# Show what services are listening
ss -tlnp

# Show what services are listening on UDP
ss -ulnp

# Show what is listening on a specific port
ss -tlnp sport = :22

# Test connectivity to a service
ssh vyos@10.0.0.1
curl -k https://10.0.0.1:8443/configure
snmpwalk -v3 -u monitor-user -l authPriv -a SHA -A ... -x AES -X ... 10.0.0.1

# Show the firewall rules for services
show firewall
nft list ruleset

ss is the canonical Linux tool for inspecting listening sockets. The operator who wants to know what is reachable on the router runs ss -tlnp and reads the output.

Validation

The validation sequence for “the service is wrong”:

1. The service is listening: ss -tlnp shows the port.
2. The service is reachable: from a host on the allowed network, test the service.
3. The service is restricted: from a host on the disallowed network, the service is unreachable.
4. The authentication works: the operator can log in with the configured credentials.
5. The firewall allows it: nft list ruleset shows the relevant accept rule.

If a service is reachable from a network it should not be reachable from, the configuration is wrong.

Cross-course references

• The lesson on management plane hardening in Part XLVII covers the SSH, API, and management VRF configuration in depth.
• The lesson on security hardening in Part LIII covers the audit checklist.
• The OPNsense course covers the equivalent FreeBSD service model.

Quiz

Production discipline

Every service is an attack surface. The operator who understands each service — what port, what authentication, what endpoints — configures the router for operational convenience and security.

Plan the service set once. Bind to management interfaces. Disable password auth. Use a management VRF. Then the router is reachable from the management network only, and the services are hardened against the most common attacks.