Tip

This is the documentation for the 24.06 version. Looking for the documentation of the latest version? Have a look here.

TNSR Documentation

This documentation has all the details needed to fully configure TNSR, from the basics all the way to the complexities of implementing different applications. For quotes, updates, and more information about TNSR, please visit tnsr.com or contact TNSR sales.

PDF Version

• Introduction
  • TNSR Secure Networking
  • TNSR Architecture
  • Technology Stack
  • Basic Assumptions
• Supported Platforms
• Installation
  • Installation Process
  • Post-Installation Tasks
• Default Behavior
  • Default Accounts and Passwords
  • Default TNSR Permissions
  • Default Allowed Traffic
  • Default Namespaces
  • Default Services
  • Default Routing and VRF Behavior
• Zero-to-Ping: Getting Started
  • First Login
  • Interface Configuration
  • TNSR Interfaces
  • NAT
  • DHCP Server
  • DNS Server
  • Ping
  • Save the TNSR Configuration
  • Next Steps
• Command Line Basics
  • Working in the TNSR CLI
  • Finding Help
  • Starting TNSR
  • Entering the TNSR CLI
  • Configuration Database
  • Configuration Mode
  • Configuration Backups
  • Configuration History
  • Configuration Rollback
  • Viewing Status Information
  • Output Modifiers
  • Networking Namespaces
  • Service Control
  • Diagnostic Utilities
  • Basic System Information
  • Rebooting and Shutting Down the Device
• Basic Configuration
  • Setup Interfaces
  • Disable Host OS NICs for TNSR
  • Setup NICs in Dataplane
  • Setup QAT Compatible Hardware
  • Remove TNSR NIC for Host Use
  • Secure Shell (SSH) Server
• Updates and Packages
  • Generate a Key Pair
  • Generate a Certificate Signing Request
  • Submit the Certificate Signing Request
  • Install the certificate
  • Package Management
  • Updating TNSR
• Interfaces
  • Locate Interfaces
  • Configure Interfaces
  • Types of Interfaces
• Access Lists
  • Standard ACLs
  • MACIP ACLs
  • Viewing ACL and MACIP Information
  • ACL and NAT Interaction
  • Host ACLs
• Static Routing
  • Virtual Routing and Forwarding
  • Neighbors
  • Viewing Routes
  • Managing Routes
  • Default Route
  • Host Interface Static Routes
• Dynamic Routing
  • Dynamic Routing Manager
  • Border Gateway Protocol
  • Open Shortest Path First v2 (OSPF)
  • Open Shortest Path First v3 (OSPF6)
  • Routing Information Protocol (RIP)
  • Dynamic Routing Protocol Lists
• ACL-Based Forwarding
  • ACL-Based Forwarding Configuration
  • ACL-Based Forwarding Status
  • ACL-Based Forwarding Example
• Virtual Router Redundancy Protocol
  • VRRP Compatibility
  • VRRP Example
  • VRRP Configuration
  • VRRP Status
• IPsec
  • IPsec Tunnel Types
  • Required Information
  • IPsec Example
  • IPsec Configuration
  • IPsec Status Information
  • IPsec Cryptographic Acceleration
• WireGuard
  • Design Considerations
  • Required Information
  • WireGuard Configuration Settings
  • WireGuard Site-to-Site Example
  • WireGuard Status
  • WireGuard Overview
• Tunnel Next Hops
  • Tunnel Next Hop Configuration
  • Example
  • Tunnel Next Hop Status
• Network Address Translation
  • NAT Modes
  • NAT Global Options
  • NAT Pool Addresses
  • Outbound NAT
  • Static NAT
  • NAT Status
  • NAT Examples
• MAP (Mapping of Address and Port)
  • MAP Configuration
  • MAP Parameters
  • MAP Example
  • MAP Types
• Dynamic Host Configuration Protocol
  • DHCP Configuration
  • DHCP Logging
  • DHCP Service Control and Status
  • DHCP Service Example
• DNS Resolver
  • DNS Resolver Configuration
  • DNS Resolver Service Control and Status
  • DNS Resolver Examples
• Network Time Protocol
  • NTP Configuration
  • NTP Service Control and Status
  • NTP Configuration Examples
  • NTP Best Practices
• Link Layer Discovery Protocol
  • Configuring the LLDP Service
  • LLDP Status
• Public Key Infrastructure
  • Key Management
  • Certificate Signing Request Management
  • Certificate Management
  • Certificate Authority Management
  • RESTCONF Certificate Shortcut
  • PKCS#12 Archives
  • SSH Key Management
• Bidirectional Forwarding Detection
  • BFD Sessions
  • BFD Session Authentication
  • BFD Example
• Authentication and User Management
  • Local User Authentication
  • RADIUS User Authentication
  • LDAP User Authentication
  • Authentication Server Groups
  • System User Authentication Method
• NETCONF Access Control Model (NACM)
  • NACM Example
  • NACM Basics
  • NACM Authorization
  • Managing NACM Rules
  • View NACM Configuration
  • Regaining Access if Locked Out by NACM
  • NACM Defaults
• RESTCONF Server
  • RESTCONF Server Configuration
  • TLS Encryption
  • Authentication
• Monitoring
  • Monitoring Interfaces
  • System Logs
  • Simple Network Management Protocol
  • Prometheus Exporter
  • IPFIX Exporter
• TNSR Configuration Example Recipes
  • RESTCONF Service Setup with Certificate-Based Authentication and NACM
  • Edge Router Speaking eBGP with Static Distribution for IPv4 And IPv6
  • Service Provider Route Reflectors and Client for iBGP IPv4
  • Zero-to-Ping: Getting Started
  • Static LAN + WAN with NAT (Basic SOHO Router Including DHCP and DNS Resolver)
  • Using Access Control Lists (ACLs)
  • Inter-VLAN Routing
  • GRE ERSPAN Example Use Case
  • OSPF Router with Multiple Areas and Summarization
  • TNSR IPsec Hub for pfSense software nodes
  • TNSR Remote Office With Existing IPsec Hub
  • IPsec Remote Access VPNs
  • WireGuard VPN for Remote Access
  • WireGuard VPN with OSPF Dynamic Routing
  • VRRP with Outside NAT
  • Enabling the Serial Console
  • Changing Credentials and Keys
  • TNSR GUI Service with Client Certificate Authentication
  • Router for Proxmox® VE Virtual Machines
• Advanced Configuration
  • Dataplane Configuration
  • Kernel Command Line Arguments
  • Host Memory Management Configuration
  • IP Reassembly
  • Polling Mode vs. Interrupt Mode
• Troubleshooting
  • Memory Usage and Tuning
  • Services do not receive traffic on an interface with NAT enabled
  • NAT session limits / “Create NAT session failed” error
  • ACL rules do not match NAT traffic as expected
  • ACL entries do not have any effect on bridge loopback (BVI) interfaces
  • Some Traffic to the host OS management interface is dropped
  • Unrecognized routes in a routing table
  • OSPF Neighbors Stuck in ExStart State
  • Large packets fail to pass over IPsec
  • Associating TNSR Interfaces with Shell Interfaces
  • Troubleshooting DHCP Client
  • Locked out by NACM Rules
  • How to gain access to the root account
  • IPsec packets are dropped or fail to pass with QAT enabled
  • Console DMA / PTE Read access Error Messages
  • Console Messages Obscure Prompts
  • Console Terminal Size
  • Dataplane Packet Tracing
  • Capturing Packets on Dataplane Interfaces
  • Troubleshooting RESTCONF
  • Diagnosing Service Issues
  • Diagnostic Information for Support
• Commands
  • Mode List
  • Basic Mode Commands
  • Packet Trace Match Mode
  • Packet Trace Match Ethernet Mode
  • Packet Trace Match IPv4 Mode
  • Packet Trace Match IPv6 Mode
  • Packet Trace Match TCP Mode
  • Packet Trace Match UDP Mode
  • Config Mode Commands
  • Show Commands in Both Basic and Config Modes
  • Access Control List Modes
  • MACIP ACL Mode
  • GRE Mode
  • Interface Mode
  • Interface IPv6 RA Mode
  • Interface IPv6 RA Prefix Mode
  • Loopback Mode
  • Bridge Mode
  • NAT Commands in Configure Mode
  • Tap Mode
  • BFD Key Mode
  • BFD Mode
  • Host Interface Mode
  • Host Route Table Mode
  • Host Route Mode
  • Host Route IPv4/IPv6 Mode
  • IPsec Tunnel Mode
  • IKE mode
  • IKE Peer Authentication Mode
  • IKE Peer Authentication Round Mode
  • IKE Child SA Mode
  • IKE Child SA Proposal Mode
  • IKE Peer Identity Mode
  • IKE Proposal Mode
  • Map Mode
  • Map Parameters Mode
  • memif Mode
  • Dynamic Routing Access List Mode
  • Dynamic Routing Prefix List Mode
  • Dynamic Routing Route Map Mode
  • Dynamic Routing BGP Mode
  • Dynamic Routing BGP Server Mode
  • Dynamic Routing BGP Neighbor Mode
  • Dynamic Routing BGP Address Family Mode
  • Dynamic Routing BGP Address Family Neighbor Mode
  • Dynamic Routing BGP Community List Mode
  • Dynamic Routing BGP AS Path Mode
  • Dynamic Routing BGP RPKI Mode
  • Dynamic Routing BGP RPKI SSH Mode
  • Dynamic Routing BGP RPKI TCP Mode
  • Dynamic Routing OSPF Mode
  • Dynamic Routing OSPF Server Mode
  • Dynamic Routing OSPF Interface Mode
  • Dynamic Routing OSPF Area Mode
  • Dynamic Routing OSPF6 Mode
  • Dynamic Routing OSPF6 Server Mode
  • Dynamic Routing OSPF6 Interface Mode
  • Dynamic Routing OSPF6 Area Mode
  • Dynamic Routing RIP Mode
  • Dynamic Routing RIP Server Mode
  • Dynamic Routing RIP Interface Mode
  • Dynamic Routing RIP Key Chain Mode
  • Dynamic Routing Manager Mode
  • Route Table Mode
  • Route Table Next Hop Mode
  • SPAN Mode
  • VXLAN Mode
  • Local User Authentication Configuration Mode
  • RADIUS Authentication Configuration Mode
  • LDAP Authentication Configuration Mode
  • Authentication Server Group Configuration Mode
  • NTP Configuration Mode
  • NTP Restrict Mode
  • NTP Upstream Server Mode
  • NACM Group Mode
  • NACM Rule-list Mode
  • NACM Rule Mode
  • DHCP IPv4 Server Config Mode
  • DHCP4 Subnet4 Mode
  • DHCP4 Subnet4 Pool Mode
  • DHCP4 Subnet4 Reservation Mode
  • Kea DHCP4, Subnet4, Pool, or Reservation Option Mode
  • Kea DHCP4 Option Definition Mode
  • DHCP4 Log Mode
  • DHCP4 Log Output Mode
  • Unbound Server Mode
  • Unbound Forward-Zone Mode
  • Subif Mode
  • Bond Mode
  • Host ACL Mode
  • Host ACL Rule Mode
  • VRRP Mode
  • DNS Resolver Mode
  • IPFIX Exporter Mode
  • IPFIX Observation Point Mode
  • IPFIX Selection Process Mode
  • IPFIX Cache Mode
  • RESTCONF mode
  • WireGuard Mode
  • WireGuard Peer Mode
  • Tunnel Next Hop Mode
  • IPIP Tunnel Mode
  • ACL-Based Forwarding Interface Attachment Mode
  • ACL-Based Forwarding Policy Mode
  • ACL-Based Forwarding Policy Next Hop Mode
  • vHost User Interface Mode
  • Remote Logging Mode
• API Endpoints
  • YANG Data Models
  • RESTCONF API
• Release Notes
• Licensing
• Glossary of Terms