TL;DR: Cloning a VyOS VM clones the brain too.v VirtualBox name != VyOS host-name. And one-way ping is NOT R1 to R3 - it's PowerShell to VM vs VM to PowerShell.

1. The Golden Image Trap

I made a perfect R1, then cloned it to R2 and R3. The clone remembers too much.

On a fresh clone, SSH is not running. You have to re-enable it every time.

Fix for R3 (and any new clone) - on the VirtualBox console:

configure
set service ssh port 22
commit
save
exit

Then from PowerShell:

ssh vyos@192.168.56.103

If you don't do this, you'll get ping but no SSH and think the network is broken.

2. My VM is called R2 but it thinks it's R1 - The #1 Head Melter

VirtualBox name = sticker on the outside of the box.
host-name inside VyOS = who the router thinks it is.

You can rename the box in VirtualBox all day, R1 still thinks it's R1 until you tell it in vbash.

I deleted the VM to try to fix it when what I should have done is be in vbash.

Correct fix:

configure
delete interfaces ethernet eth0 address
set system host-name R2
set interfaces ethernet eth0 address 192.168.56.102/24
commit
save

Deleting the VM doesn't fix it because the clone brings the brain with it. You have to re-educate the brain.

3. Ping Only Working One Way - It's Firewall Inbound vs Outbound

I thought this was R1 not pinging R3. It's not.

VyOS to VyOS (R1 192.168.56.101 -> R3 192.168.56.103) works both ways once IPs are fixed.

The one-way problem is: PowerShell <-> VM

  • PowerShell (Windows host) -> VM = WORKS. This is outbound from Windows, allowed.
  • VM -> PowerShell / Host-Only IP 192.168.56.1 = FAILS. This is inbound to Windows, Windows Firewall blocks ICMP Echo on the Host-Only adapter by default.

Wireshark proves it: You see the ICMP Request from .101 to .1, but no Reply. Windows dropped it. Not a VyOS routing bug.

Why SSH works even when ping doesn't? SSH is TCP. Once you allow the TCP handshake, it's stateful and allowed back. Ping is stateless ICMP and filtered separately.

Optional fix if you want VM to be able to ping host:
Windows Defender Firewall > Inbound Rules > Enable "File and Printer Sharing (Echo Request - ICMPv4-In)" for Private profile. Or just know it's firewall, not your lab.