CLI reference

Commands available over SSH (log in as an admin user) and on the console. Output is in English. Any unambiguous prefix works (show int → show interfaces); Tab completes and ? lists the choices.

Permissions are the same as in the web interface: areas your role can only view cannot be changed.

Operational mode

The mode right after login. The prompt is user@hostname>.

Command	Description
`show interfaces`	Interfaces, addresses and traffic
`show configuration`	Running configuration [path]
`show routes`	Routing table
`show dhcp leases`	DHCP leases
`show vpn sites`	Site-to-site VPN status
`show vpn wireguard`	WireGuard peers
`show vpn openvpn`	Connected OpenVPN clients
`show vpn ikev2`	Connected IKEv2 clients
`show vpn l2tp`	Connected L2TP clients
`show history`	Configuration history [count, default 20]
`show system`	Version, uptime and time
`show log`	Recent log messages [lines]
`show hardware`	Network interface cards (for request interfaces assign)
`request interfaces assign`	request interfaces assign <WAN NIC\|none> <LAN NIC>
`request lan-address`	request lan-address <address/prefix> — LAN address and DHCP range
`request factory-default`	Replace the configuration with the default
`ping`	ping <host> — send 4 pings
`traceroute`	traceroute <host>
`configure`	Enter configuration mode
`confirm`	Keep the change applied by commit
`rollback`	rollback <revision> — apply an earlier configuration
`reboot`	Reboot the router
`poweroff`	Power off the router
`exit`	Leave configuration mode, or log out
`help`	This list

Configuration mode

Enter with configure. The prompt is user@hostname#. Changes go into the candidate and do not affect the router until you commit.

Command	Description
`confirm`	Keep the change applied by commit
`set`	set <path…> <value> — change the candidate
`delete`	delete <path…> — remove from the candidate
`show`	show [path…] — candidate configuration
`compare`	Differences between the candidate and the running configuration
`commit`	commit [comment <text>] — apply; reverts in 5 minutes unless confirmed
`discard`	Discard all uncommitted changes
`run`	run <command> — an operational command from configuration mode
`exit`	Leave configuration mode, or log out
`help`	This list

Example

admin@felixxrt> configure
admin@felixxrt# set dhcp lan lease 24h
admin@felixxrt# set dns upstream [1.1.1.1, 9.9.9.9]
admin@felixxrt# set firewall port_forwards web proto tcp
admin@felixxrt# set firewall port_forwards web wan_port 8080
admin@felixxrt# set firewall port_forwards web to 192.168.1.20:80
admin@felixxrt# compare
admin@felixxrt# commit comment "DHCP and DNS"
Applied. Type confirm within 5 minutes to keep it; otherwise it is reverted automatically.
admin@felixxrt# confirm
admin@felixxrt# exit

Values are read as YAML: numbers, true/false, [lists] and {key: value} maps.
List items are addressed by their name; a new name adds an item. A number starting at 0 also works.
Until all required fields are set, “Saved, but cannot be committed yet” lists what is missing. Once complete, you can commit.
Unless you confirm within 5 minutes after commit, the change reverts automatically — the same as “Confirm” in the web interface.

Configuration paths (for set)

<name> is a name (interface, zone, …) and <item> is a list item. The meaning of each field is in the “?” next to the field of the same name in the web interface.

system

`system hostname`	text
`system timezone`	text
`system web_names`	list of text
`system update_channel`	text

interfaces

`interfaces <name> device`	text
`interfaces <name> mac`	text
`interfaces <name> vlan`	number
`interfaces <name> zone`	text
`interfaces <name> mtu`	number
`interfaces <name> ipv4 mode`	text
`interfaces <name> ipv4 address`	text
`interfaces <name> ipv4 gateway`	text
`interfaces <name> ipv4 dns`	list of text
`interfaces <name> ipv6 mode`	text
`interfaces <name> ipv6 pd_hint`	number
`interfaces <name> ipv6 from`	text
`interfaces <name> ipv6 subnet_id`	number
`interfaces <name> ipv6 ra`	boolean
`interfaces <name> ipv6 address`	text
`interfaces <name> ipv6 gateway`	text
`interfaces <name> pppoe user`	text
`interfaces <name> pppoe password`	text
`interfaces <name> pppoe mtu`	number
`interfaces <name> pppoe service`	text
`interfaces <name> ds_lite aftr`	text
`interfaces <name> map_e br`	text
`interfaces <name> map_e ipv6_prefix`	text
`interfaces <name> map_e ipv4_prefix`	text
`interfaces <name> map_e ea_len`	number
`interfaces <name> map_e psid_offset`	number
`interfaces <name> map_e format`	text

dhcp

`dhcp <name> range`	list of text
`dhcp <name> lease`	text
`dhcp <name> dns`	list of text
`dhcp <name> static <item> name`	text
`dhcp <name> static <item> mac`	text
`dhcp <name> static <item> ip`	text

dns

`dns upstream`	list of text
`dns cache_size`	number
`dns dnssec`	boolean
`dns local_domain`	text
`dns forward_zones <item> zone`	text
`dns forward_zones <item> servers`	list of text
`dns hosts <item> name`	text
`dns hosts <item> ip`	text

firewall

`firewall zones <name> input`	text
`firewall zones <name> forward`	text
`firewall zones <name> allow_services`	list of text
`firewall policies <item> from`	text
`firewall policies <item> to`	text
`firewall policies <item> action`	text
`firewall nat masquerade`	list of text
`firewall port_forwards <item> name`	text
`firewall port_forwards <item> proto`	text
`firewall port_forwards <item> from`	text
`firewall port_forwards <item> wan_port`	text
`firewall port_forwards <item> to`	text
`firewall rules <item> name`	text
`firewall rules <item> from`	text
`firewall rules <item> to`	text
`firewall rules <item> src`	list of text
`firewall rules <item> dst`	list of text
`firewall rules <item> proto`	text
`firewall rules <item> ports`	text
`firewall rules <item> action`	text
`firewall rules <item> disabled`	boolean
`firewall flowtable`	boolean

routes

`routes static <item> to`	text
`routes static <item> via`	text

vpn

`vpn endpoint`	text
`vpn wireguard enabled`	boolean
`vpn wireguard port`	number
`vpn wireguard network`	text
`vpn wireguard mtu`	number
`vpn openvpn enabled`	boolean
`vpn openvpn proto`	text
`vpn openvpn port`	number
`vpn openvpn network`	text
`vpn ikev2 enabled`	boolean
`vpn ikev2 network`	text
`vpn l2tp enabled`	boolean
`vpn l2tp network`	text
`vpn l2tp psk`	text
`vpn groups <item> name`	text
`vpn groups <item> label`	text
`vpn groups <item> methods`	list of text
`vpn groups <item> allow`	list of text
`vpn groups <item> expires`	text
`vpn sites <item> name`	text
`vpn sites <item> label`	text
`vpn sites <item> enabled`	boolean
`vpn sites <item> type`	text
`vpn sites <item> zone`	text
`vpn sites <item> remote_networks`	list of text
`vpn sites <item> local_networks`	list of text
`vpn sites <item> tunnel_address`	text
`vpn sites <item> mtu`	number
`vpn sites <item> ipsec version`	number
`vpn sites <item> ipsec peer`	text
`vpn sites <item> ipsec connect`	text
`vpn sites <item> ipsec local_id`	text
`vpn sites <item> ipsec remote_id`	text
`vpn sites <item> ipsec auth`	text
`vpn sites <item> ipsec psk`	text
`vpn sites <item> ipsec remote_ca`	text
`vpn sites <item> ipsec proposals`	text
`vpn sites <item> ipsec ike encryption`	list of text
`vpn sites <item> ipsec ike integrity`	list of text
`vpn sites <item> ipsec ike dh`	list of text
`vpn sites <item> ipsec ike lifetime`	text
`vpn sites <item> ipsec esp encryption`	list of text
`vpn sites <item> ipsec esp integrity`	list of text
`vpn sites <item> ipsec esp dh`	list of text
`vpn sites <item> ipsec esp lifetime`	text
`vpn sites <item> ipsec nat_traversal`	text
`vpn sites <item> ipsec dpd`	number
`vpn sites <item> ipsec aggressive`	boolean
`vpn sites <item> wireguard peer`	text
`vpn sites <item> wireguard public_key`	text
`vpn sites <item> wireguard listen_port`	number
`vpn sites <item> wireguard preshared_key`	text
`vpn sites <item> wireguard keepalive`	number

monitoring

`monitoring zabbix enabled`	boolean
`monitoring zabbix servers`	list of text
`monitoring zabbix active`	boolean
`monitoring zabbix hostname`	text
`monitoring zabbix psk_identity`	text
`monitoring zabbix psk`	text
`monitoring snmp enabled`	boolean
`monitoring snmp allow`	list of text
`monitoring snmp version`	text
`monitoring snmp community`	text
`monitoring snmp user`	text
`monitoring snmp auth_password`	text
`monitoring snmp priv_password`	text
`monitoring snmp location`	text
`monitoring snmp contact`	text
`monitoring node_exporter enabled`	boolean
`monitoring node_exporter allow`	list of text
`monitoring node_exporter port`	number