VyOS is the routing-first network OS of this group, with BGP, VRF, MPLS and a VPP dataplane, but its LTS images and early security fixes are reserved for subscribers.
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
’16
’17
’18
’19
’20
’21
’22
’23
’24
’25
’26
Routing and WAN
2
1
3
Firewall and NAT core
1
VPN and remote access
1
2
Threat protection
Network services
3
Platform and hypervisor freedom
1
1
High availability and performance
3
Management, API and automation
2
Observability
2
Platform security and lifecycle
3
1
2
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Routing and WAN (+1.5), VPN and remote access (+1.5), Platform security and lifecycle (+1.5). Already strong in 2015: Routing and WAN, Platform and hypervisor freedom, High availability and performance.
Top focus each year: 2019 VPN and remote access; 2021 Routing and WAN; 2023 Platform security and lifecycle; 2024 Firewall and NAT core; 2025 Platform and hypervisor freedom; 2026 Platform and hypervisor freedom. 5 of 11 years show no gain in any area.
Owner: VyOS Networks Corporation (private; country of incorporation not published); acquired Sentrium SL (Spain) on 2024-10-09, now VyOS Networks Iberia
Engine: Debian GNU/Linux with FRR, nftables, strongSwan, WireGuard, Kea and an optional VPP dataplane since 1.5
Licence: Open source (GPL components; licence file not read), forked from Vyatta Core in 2013. Rolling images and VyOS Stream are free; LTS images only for subscribers, contributors, non-profits, emergency services and academic institutions, or built from source. On-premises subscriptions on dev.vyos.io in 2026: Corporate 10,000 USD per year (9,000 on a 3-year term, 8,000 on 5 years), Global 16,000 USD, Alliance from 25,000 USD; a Standard tier at 2,000 USD per year and a Professional tier at 600 EUR appear in other VyOS pages (unresolved); cloud instances from about 0.2 USD per core per hour (2023)
Support lifecycle: LTS line about every two years; the three latest minors of each LTS line are supported (policy of 2023-11-15); 1.2 ended 2023, 1.3 ended 2025, 1.4 in maintenance mode since 2026-09-07; image-based upgrades with rollback; subscribers received the 1.5.1 and 1.4.5 fixes on 2026-08-01, five weeks before the public LTS release
Next milestone: 1.6 Scutum, previewed through Stream images; no date published; aarch64 cloud images announced for 1.5 on 2025-11-17 and not confirmed in 1.5.0
Security record: 0 entries on the CISA KEV catalogue for 2023 to 2026 (feed of 2026-10-15); no deduction. Own fixes: 1.3.5 security release (2023-12), 1.5.1 and 1.4.5 fixed 13 vulnerabilities (12 in accel-ppp including a RADIUS authentication bypass, one remote code execution in the update-check script that is off by default); advisories are blog posts, no central advisory page
Hypervisors: Install guides for KVM and libvirt, Proxmox VE, VMware ESXi, GNS3, EVE-NG and Docker; cloud guides for AWS (with Gateway Load Balancer), Azure, Google Cloud and Oracle, plus Equinix Network Edge; no Hyper-V or XCP-ng guide; x86-64 only, aarch64 pending; VPP dataplane needs 4 cores and 8 GB RAM
Tier: Router operating system
Archetype: Dependable builder
Evidence grade: B. The project history page, the 1.3.0, 1.4.0, 1.5.0 and 1.5.1 release posts, the 2023 subscription post, the 2018 LTS access post, the installation, virtual and cloud documentation and the Sentrium press release were read from VyOS sources; the CISA KEV feed was queried on 2026-10-15. The 1.2.0 feature list comes from a search result, the subscription pages conflict on prices, the licence file was not read, and the 2015 baseline rests on the Vyatta lineage.
1.2.0: first LTS line on a two-year cycle, images gated to subscribers from 2018-12-26
2019
Routing and WAN
3 → 3.5
+1.2
1.2.0 Crux: RPKI for BGP, PPPoE server, FRR routing stack
2019
VPN and remote access
2.5 → 3.5
+2.4
1.2.0: WireGuard
2021
Network services
2.5 → 3
+0.8
1.3.0: IPoE server and serial console server; 1.4.0 HAProxy load balancer; 1.5.0 Kea DHCP server; still no captive portal or DNS blocklists
2021
Routing and WAN
3.5 → 4
+1.2
1.3.0 Equuleus: VRF, IS-IS, initial MPLS and LDP, GENEVE, MACsec
2021
VPN and remote access
3.5 → 4
+1.2
1.3.0: SSTP and OpenConnect VPN servers; 1.4.0 IKEv2 remote access server and SSTP client; route-based VTI; no MFA integration or vendor client found
2023
Platform security and lifecycle
2.5 → 3
+1.0
LTS support policy published 2023-11-15: three latest minors supported; 1.3.5 security release
2024
Firewall and NAT core
2.5 → 3.5
+2.4
1.4.0: firewall rebuilt on nftables with zone-based firewall, interface groups and NAT64; no layer 7 identification, no user-based rules
2024
Management, API and automation
2.5 → 3.5
+2.0
1.4.0: HTTP API with configuration sync and soft rollback; official vyos.vyos Ansible collection; XML CLI definitions since 1.2.0; no central manager, no web UI
1.4.4: AWS Gateway Load Balancer support; install guides for Proxmox VE, KVM, VMware, GNS3, EVE-NG and Docker; Oracle Cloud reference
2026
High availability and performance
3 → 3.5
+0.8
1.5.0: optional VPP dataplane (vendor claim of up to 15 times the kernel dataplane, no independent throughput figure); 1.5.1 VRRP health check timeouts; no active-active clustering
2026
Observability
2.5 → 3
+0.6
1.5.0: ipt-netflow and hsflowd sFlow; 1.5.1 SNMP traps; no built-in analytics or UI
2026
Platform and hypervisor freedom
3.5 → 4
+1.0
1.5.0: optional VPP dataplane; aarch64 still pending; no Hyper-V or XCP-ng guide
2026
Platform security and lifecycle
3 → 3.5
+1.0
1.5.1: automated upgrades, minisign-signed images; 0 CISA KEV entries 2023 to 2026, so no deduction; public LTS security fixes five weeks after subscribers; no Secure Boot
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
Date
Item
Theme
Driver
2023-03
Subscription restructure: Corporate 8,000 and Global 15,000 per year on 3 or 5 year terms, SLA tiers, CloudPack
Licensing
P
2023-03
1.4 LTS planned for 2023 (shipped 2024-06-04)
Packaging
V
2023-11
LTS support policy: the three latest minors of each line
Security and lifecycle
C
2023-11
VPP dataplane add-on announced as in development
High availability
V
2023-12
1.3.5 security release
Security and lifecycle
C
2024-06
1.4.0 Sagitta: firewall rebuilt on nftables, zone-based firewall returns, interface groups
About three LTS patch releases a year and monthly Stream images; LTS majors are irregular (1.3 in 2021, 1.4 in 2024, 1.5 in 2026) and dates are not published ahead
Roadmap transparency
3.5
Public Phabricator tracker, blog posts and Stream previews of the next LTS; no dated roadmap
Say-do
3
1.4 LTS promised for 2023 shipped in June 2024; VPP announced in 2023 reached GA in 2026; the Stream channel arrived as announced; aarch64 pending
Velocity
4
nftables rebuild, Kea, HTTP API sync, segment routing and the VPP dataplane within three years
Lifecycle stability
3
Two-year LTS lines with a published minor policy and image rollback; 1.4 went to maintenance mode after 27 months; LTS access rules changed in 2018 and 2021
Commercial risk: 14.5 / 25 (lower is better)
Criterion
Score
Basis
Price and licence volatility
2.5
Tiers restructured on 2023-03-05 (Corporate 8,000, 3 or 5 year terms only); the 2026 page lists Corporate at 10,000 USD annual; prices on different VyOS pages conflict
Purchase constraints
3.5
LTS images need a subscription from about 600 EUR (Professional, unconfirmed) to 10,000 USD per year, or a build from source; rolling and Stream are free but unsupported
Channel and access
3.5
LTS downloads behind a support login; subscribers received the 1.5.1 and 1.4.5 security fixes five weeks before the public release
Owner stability
2
Small private company; acquired its own support subsidiary in 2024; ownership and incorporation not published
Cost of staying supported
3
Supported LTS requires an annual subscription; each LTS line lasts about two years with minors unsupported once three newer ones exist
Technical lock-in: 4.0 / 25 (lower is better)
Criterion
Score
Basis
Formats
1
One plain-text configuration tree with set and delete commands, import and export; migration scripts carry the syntax between versions
Export path
1
Configuration is readable text; converting to another vendor's syntax is manual; Vyatta and EdgeOS syntax is close
Stack coupling
0
Any storage, any switch; standard Linux networking
Hardware / cloud coupling
0.5
Any x86-64 machine or the listed clouds; fully offline; aarch64 not yet shipped
Skills and tooling coupling
1.5
Debian skills transfer; the Vyatta-style CLI is its own dialect; official Ansible collection and HTTP API
Integrator fit: 12.0 / 20
Criterion
Score
Basis
Partner programme openness
3.5
Alliance tier for service providers from 25,000 USD per year with deployment rights, APT repository and certification vouchers; direct sales and marketplaces; terms beyond Alliance not found
Multi-tenancy and self-service
2
VRFs and VRRP for tenant separation; no controller, portal or multi-site manager
API and infrastructure-as-code
3.5
HTTP API, official vyos.vyos Ansible collection tested on 1.3.8, 1.4.1 and 1.5; Terraform documented for the clouds, no VyOS provider
Skills and certification
3
VCNE (VyOS Certified Network Engineer) exists; a network engineer with Vyatta or Linux routing experience adapts quickly
AI leverage: 2.0 / 20
How the product uses AI, scored per year like capability. Only GA counts.
Criterion
2019
2022
Today
Latest step
AI in threat detection
0
0
0
2015: None
AI platform stack
0
0
0
2015: None
AI-assisted operations
0
0
0
2015: None
Agent openness
1
1
2
2024: 1.4.0: HTTP API with key authentication that agents and Ansible drive; community MCP servers (alch3mistdev, danielbodnar) exist; no official MCP server
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was announced by VyOS Networks between 2023 and 2026.
VyOS has no IDS or IPS, so there is nothing for AI to detect, and no assistant in the console. Its HTTP API and official Ansible collection are the agent surface; community MCP servers wrap that API without vendor involvement.
Reading
VyOS scores highest in this group on routing because VRFs, MPLS, segment routing, IS-IS and RPKI shipped years ago and the 1.5 line added a VPP dataplane; it scores lowest on threat protection because it has no IDS, IPS or filtering engine at all. The commercial score carries the cost of that focus: LTS images are reserved for subscribers, the cheapest published on-premises tier is 10,000 USD per year, and in 2026 subscribers received security fixes five weeks before everyone else. A buyer running the free rolling or Stream images should treat them as what the vendor calls them, previews without support, and a buyer paying for LTS should check which tier and term the current price page actually offers, since the pages read in this pass disagree.
Open questions and items to re-score
Subscription prices conflict between dev.vyos.io (Corporate 10,000 USD) and other VyOS pages (Standard 2,000 USD, Professional 600 EUR); the licence file was not read.
aarch64 images for 1.5, announced 2025-11-17, were not confirmed in the 1.5.0 or 1.5.1 posts.
The FastNetMon-based DDoS detection service was not checked; if confirmed as GA it lifts threat protection to 1.
Hyper-V and XCP-ng: no install guide found.
Whether a community build of LTS from source is documented end to end.
The 1.2.0 feature list comes from a search result, not the release post.
Ownership structure and country of incorporation of VyOS Networks Corporation.
