firewall {
    all-ping enable
    broadcast-ping disable
    config-trap disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name OUTSIDE-IN {
        default-action drop
        rule 10 {
            action accept
            state {
                established enable
                related enable
            }
        }
    }
    name protect-vyatta {
        default-action drop
        rule 100 {
            action accept
            destination {
                port 500
            }
            protocol udp
        }
        rule 200 {
            action accept
            protocol esp
        }
        rule 210 {
            action accept
            destination {
                port 1701
            }
            ipsec {
                match-ipsec
            }
            protocol udp
        }
        rule 250 {
            action accept
            destination {
                port 4500
            }
            protocol udp
        }
    }
    name untrusted {
        default-action drop
        description "deny traffic from internet"
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
    twa-hazards-protection disable
}
interfaces {
    ethernet eth0 {
        address ＜VyOSのローカルのIPアドレス＞/24
        duplex auto
        firewall {
            in {
            }
            local {
            }
        }
        hw-id ＜Hyper-V使ってたので一応固定化＞
        policy {
            route PPPOE-IN
        }
        pppoe 0 {
            default-route auto
            mtu 1454
            name-server auto
            password ****************
            user-id ＜PPPoE用のID＞
        }
        smp_affinity auto
        speed auto
    }
    loopback lo {
    }
}
nat {
    source {
        rule 10 {
            destination {
                address !＜VPN先のネットワークのIPアドレススペース＞/16
            }
            outbound-interface pppoe0
            source {
                address ＜ローカルのネットワークのIPアドレススペース＞/24
            }
            translation {
                address masquerade
            }
        }
    }
}
policy {
    route PPPOE-IN {
        rule 10 {
            protocol tcp
            set {
                tcp-mss 1414
            }
            tcp {
                flags SYN
            }
        }
    }
}
service {
    ssh {
        listen-address ＜VyOSのローカルのIPアドレス＞
        port 22
    }
}
system {
    config-management {
        commit-revisions 20
    }
    console {
        device ttyS0 {
            speed 9600
        }
    }
    host-name ＜お好みで＞
    login {
        user ＜VyOSのユーザー＞ {
            authentication {
                encrypted-password ****************
            }
            level admin
        }
    }
    package {
        auto-sync 1
        repository community {
            components main
            distribution helium
            password ****************
            url http://packages.vyos.net/vyos
            username ""
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Asia/Tokyo
}
vpn {
    ipsec {
        esp-group esp-azure {
            compression disable
            lifetime 3600
            mode tunnel
            pfs disable
            proposal 1 {
                encryption aes128
                hash sha1
            }
            proposal 2 {
                encryption aes256
                hash sha1
            }
            proposal 3 {
                encryption 3des
                hash sha1
            }
        }
        ike-group ike-azure {
            key-exchange ikev2
            lifetime 28800
            proposal 1 {
                dh-group 2
                encryption aes128
                hash sha1
            }
            proposal 2 {
                dh-group 2
                encryption aes256
                hash sha1
            }
            proposal 3 {
                dh-group 2
                encryption 3des
                hash sha1
            }
        }
        ipsec-interfaces {
            interface pppoe0
            interface eth0
        }
        nat-networks {
            allowed-network 0.0.0.0/0 {
            }
        }
        nat-traversal enable
        site-to-site {
            peer ＜Azure側のGatewayのパブリックIPアドレス＞ {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ＜Azure側で設定した事前共有キー＞
                }
                connection-type initiate
                default-esp-group esp-azure
                ike-group ike-azure
                local-address ＜VyOSに振られるグローバルIPアドレス＞
                tunnel 1 {
                    allow-nat-networks disable
                    allow-public-networks disable
                    esp-group esp-azure
                    local {
                        prefix ＜ローカルのIPアドレススペース＞/24
                    }
                    remote {
                        prefix ＜Azure側VNETのIPアドレススペース＞/16
                    }
                }
            }
        }
    }
}