TTR Networks

Learn networking by exploring it.

Step-through diagrams, annotated configs and output from real labs. Follow a learning path, or browse by topic.

Learning paths

  • Start here: how networks workNew to networking, or filling in the basics

    From switches and IP addresses to a real router, then the two routing protocols everything else builds on.

  • Run an office or branch networkYou look after a small office, branch or home lab

    A VyOS router that hands out addresses, survives a failure, keeps the right traffic out, speaks IPv6, links sites together and can be run properly.

  • Build an internet edgeYou run (or want to run) your own AS: an ISP, hosting provider or multihomed business

    From BGP basics to a VyOS edge with transit and an IX, safe routing policy, communities and RTBH, registry and RPKI hygiene, then an edge-and-core network that scales.

  • Data-centre fabricsYou build or operate leaf-spine networks

    Layer 2 and VLANs, routing fundamentals and loopback design, IPv6-only cores, then EVPN and VXLAN to stretch layer 2 across a routed fabric.

  • Troubleshoot like an operatorSomething is broken and you want a method, not guesses

    Find where packets die with Linux tools and tcpdump, read a VyOS router's state, and set up the logs, counters and flows you'll want next time.

Foundations

  • Switching basics: layer 2, VLANs and IP addressingBeginner · 40 min

    How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.

  • Linux Network ConnectivityBeginner · 80 min

    Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.

Office & branch networks

  • Setting up VyOS with NATBeginner · 45 min

    A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.

  • Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min

    Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.

  • Zone-based firewall on VyOSIntermediate · 35 min

    Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.

  • IPv6 on VyOS: setup and routingBeginner · 55 min

    Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.

  • Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min

    Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.

Routing protocols

  • OSPF FundamentalsBeginner · 70 min

    The link-state IGP that runs inside most networks: neighbour adjacencies, LSA flooding, SPF, costs, DR/BDR, areas and LSA types, a hands-on FRR lab, and how OSPF underpins BGP.

  • BGP FundamentalsIntermediate · 75 min

    How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.

  • BGP on loopbacks vs interface addressesIntermediate · 45 min

    Why BGP sessions between loopbacks survive link failures and use parallel links, and what they need to work: an IGP or static routes, update-source, the eBGP connected check, and BFD. Every failure is reproduced on two real VyOS routers.

  • OSPF on VyOS: costs and OSPFv3Intermediate · 30 min

    OSPF the VyOS way: interface-based configuration, reading the interface and database output, steering traffic with costs (and the asymmetric routing that follows), and OSPFv3 for IPv6 over link-local addresses. Captured on the three-router edge/core lab.

  • Route reflectors on VyOSIntermediate · 30 min

    Replace an iBGP full mesh with route reflectors: see iBGP refuse to pass routes on, turn on reflection, read ORIGINATOR_ID and CLUSTER_LIST, confirm the reflector stays out of the forwarding path, and survive taking one reflector down.

  • IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min

    Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.

Internet edge

  • Setting up VyOS with basic BGPIntermediate · 50 min

    Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.

  • BGP communities, prepending and RTBHIntermediate · 45 min

    Tag routes with large communities, steer inbound traffic with AS-path prepending (and see why providers' local preference limits it), and stop a DDoS at your provider's edge with remotely triggered blackholing. Built on VyOS with two transit providers, including the two RTBH mistakes the lab made first.

  • Edge and core: building out a VyOS networkIntermediate · 60 min

    Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.

Routing security

  • IRR, RPSL and AS-SETsIntermediate · 60 min

    How networks publish what they announce and how their neighbours turn it into filters: Internet Routing Registries, whois queries, RPSL objects and attributes, AS-SET expansion, bgpq4, and the pitfalls of unsigned routing data.

  • RPKI and Route Origin ValidationIntermediate · 70 min

    Cryptographically signed routing origins: the RPKI trust chain, creating safe ROAs, Valid/Invalid/NotFound, validators and RTR, a real FRR + StayRTR lab, and what ROV can't stop (forged origins, leaks), plus where ASPA comes in.

Data centre

  • EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min

    Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.

Operations & troubleshooting

  • Packets That Never Come BackIntermediate · 75 min

    Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.

  • Operating VyOS: monitoring, backups and automationIntermediate · 50 min

    Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.