Configuration
vyos@HQ-A:~$ show configuration commands
set high-availability vrrp group HQ address 10.10.10.254 interface 'eth0'
set high-availability vrrp group HQ health-check interval '10'
set high-availability vrrp group HQ health-check ping '110.100.100.1'
set high-availability vrrp group HQ interface 'eth0'
set high-availability vrrp group HQ priority '150'
set high-availability vrrp group HQ vrid '10'
set interfaces ethernet eth0 address '10.10.10.251/24'
set interfaces ethernet eth0 hw-id '00:0c:29:d9:ab:45'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso
set interfaces ethernet eth1 address '110.100.100.2/30'
set interfaces ethernet eth1 hw-id '00:0c:29:d9:ab:4f'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 offload gso
set interfaces ethernet eth1 offload sg
set interfaces ethernet eth1 offload tso
set interfaces loopback lo
set interfaces wireguard wg0 address '192.168.1.1/30'
set interfaces wireguard wg0 peer to-site-BH address '210.100.100.2'
set interfaces wireguard wg0 peer to-site-BH allowed-ips '192.168.1.2/32'
set interfaces wireguard wg0 peer to-site-BH allowed-ips '10.10.20.0/24'
set interfaces wireguard wg0 peer to-site-BH allowed-ips '224.0.0.0/24'
set interfaces wireguard wg0 peer to-site-BH persistent-keepalive '25'
set interfaces wireguard wg0 peer to-site-BH port '51820'
set interfaces wireguard wg0 peer to-site-BH public-key 'PeCl/njaHJVYQgRYchnA1p5AELuIkTa371EL5D7BRCY='
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 private-key 'sMHarj4TejseKSpMUlRo8l5HSwzY6Cp6pq+Wcbmg10s='
set interfaces wireguard wg1 address '192.168.1.5/30'
set interfaces wireguard wg1 peer to-site-BH-B address '220.100.100.2'
set interfaces wireguard wg1 peer to-site-BH-B allowed-ips '192.168.1.6/32'
set interfaces wireguard wg1 peer to-site-BH-B allowed-ips '10.10.20.0/24'
set interfaces wireguard wg1 peer to-site-BH-B allowed-ips '224.0.0.0/24'
set interfaces wireguard wg1 peer to-site-BH-B persistent-keepalive '25'
set interfaces wireguard wg1 peer to-site-BH-B port '51821'
set interfaces wireguard wg1 peer to-site-BH-B public-key 'cmjUzFA2Ezk9tiEZKk/xIfvxhmOxpHrii2uPxACtvTE='
set interfaces wireguard wg1 port '51821'
set interfaces wireguard wg1 private-key 'sMHarj4TejseKSpMUlRo8l5HSwzY6Cp6pq+Wcbmg10s='
set protocols ospf area 0 network '10.10.10.0/24'
set protocols ospf area 0 network '192.168.1.0/30'
set protocols ospf area 0 network '192.168.1.4/30'
set protocols ospf interface wg0 network 'point-to-point'
set protocols ospf interface wg1 network 'point-to-point'
set protocols ospf parameters router-id '10.10.10.251'
set protocols static route 0.0.0.0/0 next-hop 110.100.100.1 interface 'eth1'
set protocols static route 10.10.20.0/24
set service ntp allow-client address '127.0.0.0/8'
set service ntp allow-client address '169.254.0.0/16'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '172.16.0.0/12'
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '::1/128'
set service ntp allow-client address 'fe80::/10'
set service ntp allow-client address 'fc00::/7'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service ntp server time3.vyos.net
set service ssh listen-address '10.10.10.251'
set system config-management commit-revisions '100'
set system console device ttyS0 kernel
set system console device ttyS0 speed '115200'
set system host-name 'HQ-A'
set system login operator-group default command-policy allow '*'
set system login user vyos authentication encrypted-password '$6$rounds=656000$iKZAcGvg4qF1Omu/$iTnopisgBkj0H6sQgxGqtc9WDPVLLMYdDihHn4P3C..3PLFlPwNXlApw70zjwpz7amyv9r.YOKekZRr8pgA3N/'
set system login user vyos authentication plaintext-password ''
set system option reboot-on-upgrade-failure '5'
set system syslog local facility all level 'info'
set system syslog local facility local7 level 'debug'
vyos@HQ-A:~$
vyos@HQ-B:~$ show configuration commands
set high-availability vrrp group HQ address 10.10.10.254 interface 'eth0'
set high-availability vrrp group HQ health-check interval '10'
set high-availability vrrp group HQ health-check ping '210.100.100.1'
set high-availability vrrp group HQ interface 'eth0'
set high-availability vrrp group HQ priority '100'
set high-availability vrrp group HQ vrid '10'
set interfaces ethernet eth0 address '10.10.10.252/24'
set interfaces ethernet eth0 hw-id '00:0c:29:e2:9d:a2'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso
set interfaces ethernet eth1 address '120.100.100.2/30'
set interfaces ethernet eth1 hw-id '00:0c:29:e2:9d:ac'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 offload gso
set interfaces ethernet eth1 offload sg
set interfaces ethernet eth1 offload tso
set interfaces loopback lo
set interfaces wireguard wg2 address '192.168.2.1/30'
set interfaces wireguard wg2 peer to-site-BH-A address '210.100.100.2'
set interfaces wireguard wg2 peer to-site-BH-A allowed-ips '192.168.2.2/32'
set interfaces wireguard wg2 peer to-site-BH-A allowed-ips '10.10.20.0/24'
set interfaces wireguard wg2 peer to-site-BH-A allowed-ips '224.0.0.0/24'
set interfaces wireguard wg2 peer to-site-BH-A persistent-keepalive '25'
set interfaces wireguard wg2 peer to-site-BH-A port '51822'
set interfaces wireguard wg2 peer to-site-BH-A public-key 'PeCl/njaHJVYQgRYchnA1p5AELuIkTa371EL5D7BRCY='
set interfaces wireguard wg2 port '51822'
set interfaces wireguard wg2 private-key 'AMzIHHjMtM3lYFPKc0tQTgr1+fMivkWEzFXarl8O1G8='
set interfaces wireguard wg3 address '192.168.2.5/30'
set interfaces wireguard wg3 peer to-site-BH-B address '220.100.100.2'
set interfaces wireguard wg3 peer to-site-BH-B allowed-ips '192.168.2.6/32'
set interfaces wireguard wg3 peer to-site-BH-B allowed-ips '10.10.20.0/24'
set interfaces wireguard wg3 peer to-site-BH-B allowed-ips '224.0.0.0/24'
set interfaces wireguard wg3 peer to-site-BH-B persistent-keepalive '25'
set interfaces wireguard wg3 peer to-site-BH-B port '51823'
set interfaces wireguard wg3 peer to-site-BH-B public-key 'cmjUzFA2Ezk9tiEZKk/xIfvxhmOxpHrii2uPxACtvTE='
set interfaces wireguard wg3 port '51823'
set interfaces wireguard wg3 private-key 'AMzIHHjMtM3lYFPKc0tQTgr1+fMivkWEzFXarl8O1G8='
set protocols ospf area 0 network '192.168.2.0/30'
set protocols ospf area 0 network '192.168.2.4/30'
set protocols ospf area 0 network '10.10.10.0/24'
set protocols ospf interface wg2 network 'point-to-point'
set protocols ospf interface wg3 network 'point-to-point'
set protocols ospf parameters router-id '10.10.10.252'
set protocols static route 0.0.0.0/0 next-hop 120.100.100.1 interface 'eth1'
set service ntp allow-client address '127.0.0.0/8'
set service ntp allow-client address '169.254.0.0/16'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '172.16.0.0/12'
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '::1/128'
set service ntp allow-client address 'fe80::/10'
set service ntp allow-client address 'fc00::/7'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service ntp server time3.vyos.net
set service ssh listen-address '10.10.10.252'
set system config-management commit-revisions '100'
set system console device ttyS0 kernel
set system console device ttyS0 speed '115200'
set system host-name 'HQ-B'
set system login operator-group default command-policy allow '*'
set system login user vyos authentication encrypted-password '$6$rounds=656000$O33kXpNNgbTgT5vS$3Oo9uRXbJZ0Wzf.3xmgpmxpxS3O19BUbHSoz3KZezMmLiWCN4FFeaCwRV.A6WXUOLHxRZTvVwfG47mAnfSghu0'
set system login user vyos authentication plaintext-password ''
set system option reboot-on-upgrade-failure '5'
set system syslog local facility all level 'info'
set system syslog local facility local7 level 'debug'
vyos@HQ-B:~$
vyos@BH-A:~$ show configuration commands
set high-availability vrrp group BH address 10.10.20.254 interface 'eth0'
set high-availability vrrp group BH health-check interval '10'
set high-availability vrrp group BH health-check ping '210.100.100.1'
set high-availability vrrp group BH interface 'eth0'
set high-availability vrrp group BH priority '150'
set high-availability vrrp group BH vrid '20'
set interfaces ethernet eth0 address '10.10.20.251/24'
set interfaces ethernet eth0 hw-id '00:0c:29:e9:a9:e3'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso
set interfaces ethernet eth1 address '210.100.100.2/30'
set interfaces ethernet eth1 hw-id '00:0c:29:e9:a9:ed'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 offload gso
set interfaces ethernet eth1 offload sg
set interfaces ethernet eth1 offload tso
set interfaces loopback lo
set interfaces wireguard wg0 address '192.168.1.2/30'
set interfaces wireguard wg0 peer to-site-HQ address '110.100.100.2'
set interfaces wireguard wg0 peer to-site-HQ allowed-ips '192.168.1.1/32'
set interfaces wireguard wg0 peer to-site-HQ allowed-ips '10.10.10.0/24'
set interfaces wireguard wg0 peer to-site-HQ allowed-ips '224.0.0.0/24'
set interfaces wireguard wg0 peer to-site-HQ persistent-keepalive '25'
set interfaces wireguard wg0 peer to-site-HQ port '51820'
set interfaces wireguard wg0 peer to-site-HQ public-key 'xBxTC4jfhgI/4Z9GQToQfeR+Tq4Fm5gArmGxSCqck3M='
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 private-key 'wLz4iHUaunxeR2ugb6bw6CszYOZxrzARKoQDD8OSqmo='
set interfaces wireguard wg2 address '192.168.2.2/30'
set interfaces wireguard wg2 peer to-site-HQ-B address '120.100.100.2'
set interfaces wireguard wg2 peer to-site-HQ-B allowed-ips '192.168.2.1/32'
set interfaces wireguard wg2 peer to-site-HQ-B allowed-ips '10.10.10.0/24'
set interfaces wireguard wg2 peer to-site-HQ-B allowed-ips '224.0.0.0/24'
set interfaces wireguard wg2 peer to-site-HQ-B persistent-keepalive '25'
set interfaces wireguard wg2 peer to-site-HQ-B port '51822'
set interfaces wireguard wg2 peer to-site-HQ-B public-key 'G7QYUFMyPOGQePSE3o+81jl4VelfZsCWjsOnRcibtGA='
set interfaces wireguard wg2 port '51822'
set interfaces wireguard wg2 private-key 'wLz4iHUaunxeR2ugb6bw6CszYOZxrzARKoQDD8OSqmo='
set protocols ospf area 0 network '192.168.1.0/30'
set protocols ospf area 0 network '10.10.20.0/24'
set protocols ospf area 0 network '192.168.2.0/30'
set protocols ospf interface wg0 network 'point-to-point'
set protocols ospf interface wg2 network 'point-to-point'
set protocols ospf parameters router-id '10.10.20.251'
set protocols static route 0.0.0.0/0 next-hop 210.100.100.1 interface 'eth1'
set protocols static route 10.10.10.0/24
set service ntp allow-client address '127.0.0.0/8'
set service ntp allow-client address '169.254.0.0/16'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '172.16.0.0/12'
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '::1/128'
set service ntp allow-client address 'fe80::/10'
set service ntp allow-client address 'fc00::/7'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service ntp server time3.vyos.net
set service ssh listen-address '10.10.20.251'
set system config-management commit-revisions '100'
set system console device ttyS0 kernel
set system console device ttyS0 speed '115200'
set system host-name 'BH-A'
set system login operator-group default command-policy allow '*'
set system login user vyos authentication encrypted-password '$6$rounds=656000$x5e.eCrtV.Vwhw8Y$9lVLCvc37tnXWZZX3Pr9T7seEVe1S8d4QGXPOoMb8Py4rGHzwS0is1wFxqWCxIUoTfTJ8ha3UEfy7JJedopU71'
set system login user vyos authentication plaintext-password ''
set system option reboot-on-upgrade-failure '5'
set system syslog local facility all level 'info'
set system syslog local facility local7 level 'debug'
vyos@BH-A:~$
vyos@BH-B:~$ show configuration commands
set high-availability vrrp group BH address 10.10.20.254 interface 'eth0'
set high-availability vrrp group BH health-check interval '10'
set high-availability vrrp group BH health-check ping '220.100.100.1'
set high-availability vrrp group BH interface 'eth0'
set high-availability vrrp group BH priority '100'
set high-availability vrrp group BH vrid '20'
set interfaces ethernet eth0 address '10.10.20.252/24'
set interfaces ethernet eth0 hw-id '00:0c:29:e6:c3:18'
set interfaces ethernet eth1 address '220.100.100.2/30'
set interfaces ethernet eth1 hw-id '00:0c:29:e6:c3:22'
set interfaces loopback lo
set interfaces wireguard wg1 address '192.168.1.6/30'
set interfaces wireguard wg1 peer to-site-HQ-A address '110.100.100.2'
set interfaces wireguard wg1 peer to-site-HQ-A allowed-ips '192.168.1.5/32'
set interfaces wireguard wg1 peer to-site-HQ-A allowed-ips '10.10.10.0/24'
set interfaces wireguard wg1 peer to-site-HQ-A allowed-ips '224.0.0.0/24'
set interfaces wireguard wg1 peer to-site-HQ-A persistent-keepalive '25'
set interfaces wireguard wg1 peer to-site-HQ-A port '51821'
set interfaces wireguard wg1 peer to-site-HQ-A public-key 'xBxTC4jfhgI/4Z9GQToQfeR+Tq4Fm5gArmGxSCqck3M='
set interfaces wireguard wg1 port '51821'
set interfaces wireguard wg1 private-key 'oEt1dDxZ6pnAR9MAEW3+RouLlSByfIRsR1fnPyOBuUI='
set interfaces wireguard wg3 address '192.168.2.6/30'
set interfaces wireguard wg3 peer to-site-HQ-B address '120.100.100.2'
set interfaces wireguard wg3 peer to-site-HQ-B allowed-ips '192.168.2.5/32'
set interfaces wireguard wg3 peer to-site-HQ-B allowed-ips '10.10.10.0/24'
set interfaces wireguard wg3 peer to-site-HQ-B allowed-ips '224.0.0.0/24'
set interfaces wireguard wg3 peer to-site-HQ-B persistent-keepalive '25'
set interfaces wireguard wg3 peer to-site-HQ-B port '51823'
set interfaces wireguard wg3 peer to-site-HQ-B public-key 'G7QYUFMyPOGQePSE3o+81jl4VelfZsCWjsOnRcibtGA='
set interfaces wireguard wg3 port '51823'
set interfaces wireguard wg3 private-key 'oEt1dDxZ6pnAR9MAEW3+RouLlSByfIRsR1fnPyOBuUI='
set protocols ospf area 0 network '192.168.1.4/30'
set protocols ospf area 0 network '10.10.20.0/24'
set protocols ospf area 0 network '192.168.2.4/30'
set protocols ospf interface wg1 network 'point-to-point'
set protocols ospf interface wg3 network 'point-to-point'
set protocols ospf parameters router-id '10.10.20.252'
set protocols static route 0.0.0.0/0 next-hop 220.100.100.1 interface 'eth1'
set service ntp allow-client address '127.0.0.0/8'
set service ntp allow-client address '169.254.0.0/16'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '172.16.0.0/12'
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '::1/128'
set service ntp allow-client address 'fe80::/10'
set service ntp allow-client address 'fc00::/7'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service ntp server time3.vyos.net
set service ssh listen-address '10.10.20.252'
set system config-management commit-revisions '100'
set system console device ttyS0 kernel
set system console device ttyS0 speed '115200'
set system host-name 'BH-B'
set system login operator-group default command-policy allow '*'
set system login user vyos authentication encrypted-password '$6$QxPS.uk6mfo$9QBSo8u1FkH16gMyAVhus6fU3LOzvLR9Z9.82m3tiHFAxTtIkhaZSWssSgzt4v4dGAL8rhVQxTg0oAG9/q11h/'
set system login user vyos authentication plaintext-password ''
set system option reboot-on-upgrade-failure '5'
set system syslog local facility all level 'info'
set system syslog local facility local7 level 'debug'
vyos@BH-B:~$
