Managing your router: the VyManager panel or the API

VyManager – the graphical panel

The easiest way to manage your router is the graphical VyManager panel. Open it with the Open VyManager button on your router’s page – you are logged in automatically, no separate password needed.

Everything is configured with your mouse:

• Firewall – rules, groups and traffic-filtering policies.
• VPN (WireGuard) – bring up a tunnel and connect your devices.
• NAT and port forwarding – publish services to the outside.
• DHCP – the address ranges handed out on your networks.
• Routing – static routes, plus BGP and OSPF for complex topologies.
• The router’s network interfaces.

The panel covers everyday tasks without the command line. For anything beyond that, and for automation, there’s the API – it gives you access to any VyOS setting without limits.

Managing via the API

Your router is configured over an HTTPS API – handy for automation and one-off tasks. Below are ready-to-use examples (curl) for common scenarios.

What you’ll need

• The router’s address – its public IP (router page, the Public IP field).
• Your API key – router page, the Router Information block, the API Key field (Copy button).

In the examples below: <ROUTER-IP> is your public IP, <API-KEY> is your key.

How a request works

Any change takes two steps:

1. Apply – a POST to /configure with a set of commands (applied atomically).
2. Save – a POST to /config-file, otherwise your changes are lost when the router reboots (see “Save your changes” below).

You can read the configuration at any time – a POST to /retrieve. The -k flag in curl accepts the router’s self-signed certificate.

1. Read the configuration

curl -k -X POST "https://<ROUTER-IP>/retrieve" \
  --form 'data={"op":"showConfig","path":[]}' \
  --form 'key=<API-KEY>'

To view only a part, specify a path, for example NAT: "path":["nat"], interfaces: "path":["interfaces"].

2. Port forward to an internal server (DNAT)

Send a port of the router’s public IP to a server on your private network. Example: external port 8080 → server 10.0.0.50:80, only from your IP 203.0.113.5.

curl -k -X POST "https://<ROUTER-IP>/configure" --form 'key=<API-KEY>' --form 'data=[
  {"op":"set","path":["nat","destination","rule","1000","description"],"value":"web-to-10.0.0.50"},
  {"op":"set","path":["nat","destination","rule","1000","inbound-interface","name"],"value":"eth0"},
  {"op":"set","path":["nat","destination","rule","1000","protocol"],"value":"tcp"},
  {"op":"set","path":["nat","destination","rule","1000","destination","port"],"value":"8080"},
  {"op":"set","path":["nat","destination","rule","1000","source","address"],"value":"203.0.113.5"},
  {"op":"set","path":["nat","destination","rule","1000","translation","address"],"value":"10.0.0.50"},
  {"op":"set","path":["nat","destination","rule","1000","translation","port"],"value":"80"}
]'

Then save (see “Save your changes” below). Use rule numbers 1000 and up so they don’t clash with automatic ones. The source.address field restricts access to your IP; remove it if the port should be open to everyone.

3. Firewall rule

Example: block TCP port 23 to your servers, leaving the rest of the traffic open.

curl -k -X POST "https://<ROUTER-IP>/configure" --form 'key=<API-KEY>' --form 'data=[
  {"op":"set","path":["firewall","ipv4","forward","filter","default-action"],"value":"accept"},
  {"op":"set","path":["firewall","ipv4","forward","filter","rule","100","action"],"value":"drop"},
  {"op":"set","path":["firewall","ipv4","forward","filter","rule","100","protocol"],"value":"tcp"},
  {"op":"set","path":["firewall","ipv4","forward","filter","rule","100","destination","port"],"value":"23"}
]'

The default-action: accept line is important – it keeps all other traffic working and blocks only the rule you set. The firewall can also be configured with your mouse in the VyManager panel.

4. WireGuard VPN

The easiest way is the VyManager panel – it has built-in WireGuard setup and generates the keys for you. Over the API the setup is multi-step: generate the keys on the router, then define the interface and the peer. The command structure:

set interfaces wireguard wg0 address '10.10.0.1/24'
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 peer my-laptop public-key '<your device's public key>'
set interfaces wireguard wg0 peer my-laptop allowed-ips '10.10.0.2/32'

Router key generation and the full guide are in the VyOS documentation (the WireGuard section).

5. DHCP range on a network

Your network’s name is visible in the configuration (see “Read the configuration” above), in the form LAN-eth1, LAN-eth2. Example – hand out addresses from the range 10.0.0.100-10.0.0.200:

curl -k -X POST "https://<ROUTER-IP>/configure" --form 'key=<API-KEY>' --form 'data=[
  {"op":"set","path":["service","dhcp-server","shared-network-name","LAN-eth1","subnet","10.0.0.0/24","range","0","start"],"value":"10.0.0.100"},
  {"op":"set","path":["service","dhcp-server","shared-network-name","LAN-eth1","subnet","10.0.0.0/24","range","0","stop"],"value":"10.0.0.200"}
]'

6. Save your changes

After any /configure:

curl -k -X POST "https://<ROUTER-IP>/config-file" \
  --form 'data={"op":"save"}' \
  --form 'key=<API-KEY>'

7. Undo a rule

Delete it entirely (for example, the port forward from section 2), then save again:

curl -k -X POST "https://<ROUTER-IP>/configure" \
  --form 'data={"op":"delete","path":["nat","destination","rule","1000"]}' \
  --form 'key=<API-KEY>'

Full reference

All VyOS commands, with examples for every feature, are in the official documentation: docs.vyos.io.