08 · Technical Appendix

Technical Appendix

Every command, address and internal detail for the lab lives on this page.

A.Architecture

Element	Value
VPC CIDR	10.0.0.0/16
WAN subnet	10.0.0.0/24 — router WAN private 10.0.0.254
Mgmt subnet	10.0.100.0/24 — router mgmt private 10.0.100.254
Demo subnet	10.0.10.0/24 — demo server 10.0.10.50
Tunnel /30	169.254.100.0/30 (local .2, Imperva .1)
Local ASN	65454
Imperva ASN	19551
GRE source	10.0.0.254 (WAN private) — NOT the EIP

GRE is sourced from the private WAN address because AWS performs 1:1 NAT at the IGW; using the EIP as source-address produces a tunnel that never comes up.

terraform.tfvars

region              = "us-east-1"
key_name            = "ddos-lab-greenfield-router"
admin_cidrs         = ["203.0.113.10/32"]

byoip_cidr          = "45.223.189.0/24"
demo_vip            = "45.223.189.100"
enable_demo_server  = true

imperva_gre_pop     = "107.154.7.48"
local_asn           = 65454
imperva_asn         = 19551
tunnel_local_ip     = "169.254.100.2/30"
tunnel_remote_ip    = "169.254.100.1"
router_wan_private  = "10.0.0.254"
router_mgmt_private = "10.0.100.254"

B.VyOS Commands

Tunnel and BGP state:

vyos

show interfaces tunnel tun0
show bgp ipv4 unicast summary
show bgp ipv4 unicast neighbors 169.254.100.1 advertised-routes
show bgp ipv4 unicast neighbors 169.254.100.1 received-routes

Reachability of the neighbor inside the tunnel:

vyos

ping 169.254.100.1 interface tun0 count 4

Routing table checks:

vyos

show ip route
show ip route 45.223.189.0/24
show ip route bgp
show ip route table 100

GRE packet capture on the WAN interface:

vyos

sudo tcpdump -ni eth0 proto gre -c 50
sudo tcpdump -ni tun0 tcp port 179 -c 50

Reference tunnel configuration:

vyos configure

set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 10.0.0.254
set interfaces tunnel tun0 remote 107.154.7.48
set interfaces tunnel tun0 address 169.254.100.2/30
set interfaces tunnel tun0 mtu 1476

set protocols bgp system-as 65454
set protocols bgp neighbor 169.254.100.1 remote-as 19551
set protocols bgp neighbor 169.254.100.1 address-family ipv4-unicast
set protocols bgp address-family ipv4-unicast network 45.223.189.0/24
commit ; save

C.AWS CLI

BYOIP advertise / withdraw:

shell

aws ec2 advertise-byoip-cidr --cidr 45.223.189.0/24
aws ec2 withdraw-byoip-cidr  --cidr 45.223.189.0/24
aws ec2 describe-byoip-cidrs --max-results 10

Manual BGP toggle via the subnet route table:

shell

# point the demo subnet at the VyOS router (Imperva path)
aws ec2 replace-route --route-table-id rtb-xxxx \
  --destination-cidr-block 0.0.0.0/0 --network-interface-id eni-vyos-wan

# point it back at the internet gateway (direct AWS path)
aws ec2 replace-route --route-table-id rtb-xxxx \
  --destination-cidr-block 0.0.0.0/0 --gateway-id igw-xxxx

Victim-path helper scripts:

shell

./scripts/victim-path-divert.sh   # advertise via imperva, repoint subnet route
./scripts/victim-path-revert.sh   # restore AWS-native path
./scripts/victim-path-status.sh   # print all three layers

D.Traffic Path Internals

divert and revert each change three layers together — a mismatch between them is what produces "mixed status".

Layer	divert	revert
1 · BGP	Announce 45.223.189.0/24 to AS19551 over tun0	Withdraw the announcement
2 · Subnet route	Default route → VyOS WAN ENI	Default route → IGW
3 · BYOIP	withdraw-byoip-cidr in AWS	advertise-byoip-cidr in AWS

Convergence typically takes 1–3 minutes; re-check with ./.lab-control.sh status rather than editing a single layer by hand.

E.NAT & Policy Routing

When the demo server is enabled, VyOS DNATs the VIP to the private host and SNATs the return path so replies leave through the tunnel.

vyos configure

set nat destination rule 100 description "demo VIP -> demo server"
set nat destination rule 100 inbound-interface name tun0
set nat destination rule 100 destination address 45.223.189.100
set nat destination rule 100 translation address 10.0.10.50

set nat source rule 100 outbound-interface name eth1
set nat source rule 100 source address 10.0.10.0/24
set nat source rule 100 translation address 10.0.0.254

set policy route DEMO-IN rule 10 destination address 10.0.10.50
set policy route DEMO-IN rule 10 set table 100
set protocols static table 100 route 0.0.0.0/0 interface tun0
set interfaces ethernet eth1 policy route DEMO-IN
commit ; save

vyos

show nat destination statistics
show nat source statistics
show policy route

F.NetFlow

Optional — export flow records for traffic analysis.

vyos configure

set system flow-accounting interface eth0
set system flow-accounting interface tun0
set system flow-accounting netflow version 9
set system flow-accounting netflow server 10.0.100.60 port 2055
set system flow-accounting netflow sampling-rate 100
commit ; save

vyos

show flow-accounting interface tun0

G.Full Troubleshooting

Symptom	Likely cause	Fix
Tunnel tun0 down	GRE source set to EIP instead of WAN private IP	Set source-address 10.0.0.254
BGP idle / active	Tunnel down or neighbor IP wrong	Verify tun0, then ping 169.254.100.1 via tun0
BGP up, no traffic	Prefix not advertised or filtered	Check network statement and outbound policy
SSH timeout	Source IP missing from admin_cidrs	Add /32 to admin_cidrs, terraform apply
Mixed status output	Partial divert/revert run	Re-run ./.lab-control.sh divert or revert
VIP unreachable on direct path	BYOIP prefix withdrawn in AWS	advertise-byoip-cidr for 45.223.189.0/24
VIP unreachable on protected path	DNAT/SNAT rules missing on VyOS	See section E
Asymmetric routing	Subnet route table still points at old next hop	Re-check layer 2 of section D