Thanks, I really like the include idea and have implemented it in the attached PR. Also added a check in firewall.py to reload policy-route script to keep any group changes updated.

Jan 11 2022, 2:51 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4159: Empty firewall group (address, network & port) generates invalid nftables config, commit fails, a subtask of T2199: Rewrite firewall in new XML/Python style, from Open to Needs testing.

Jan 11 2022, 2:48 PM · VyOS 1.4 Sagitta (1.4.0-epa2)

sarthurdev changed the status of T4159: Empty firewall group (address, network & port) generates invalid nftables config, commit fails from Open to Needs testing.

PR removes the empty line when there are no group members, also adds a warning message when empty groups are used in rules.

Jan 11 2022, 2:48 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4131: Show firewall group incorrect format members from Open to Needs testing.

@Viacheslav Not using exact ipset format, however addresses are sorted and output one per line.

Jan 11 2022, 2:46 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4144: Firewall address-group - Improve error messages from In progress to Needs testing.

Should resolve the rest of the error messages.

Jan 11 2022, 2:45 PM · VyOS 1.4 Sagitta

Jan 10 2022

sarthurdev committed rVYOSONEXa5ad98b2307a: firewall: validators: T2199: Improve port validation.

Jan 10 2022, 9:32 PM

sarthurdev committed rVYOSONEXda370b63b266: validators: T4148: Add text output when validators fail.

Jan 10 2022, 9:32 PM

sarthurdev committed rVYOSONEX0a0e7d789e7e: validators: Stricter checking on port-range validator.

Jan 10 2022, 9:32 PM

sarthurdev changed the status of T4144: Firewall address-group - Improve error messages from Open to In progress.

IPv4 address range error messages are included in PR: https://github.com/vyos/vyos-1x/pull/1152

Jan 10 2022, 9:09 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4148: Firewall - Error messages not that clear as it were in old firewall from Open to Needs testing.

Error for rule being in use when deleting base node was fixed in https://github.com/vyos/vyos-1x/pull/1151

Jan 10 2022, 9:04 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4137: Firewall group configuration allows to set incorrect port range and invalid port from Open to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/1152

Jan 10 2022, 9:02 PM · VyOS 1.4 Sagitta

sarthurdev committed rVYOSONEXdeb9bfa02863: policy: T4155: Fix using incorrect table variable.

Jan 10 2022, 6:42 PM

sarthurdev committed rVYOSONEX67ab81546856: firewall: 4149: Fix verify steps being bypassed when base node is removed.

Jan 10 2022, 6:42 PM

sarthurdev changed the status of T4149: [Firewall-IPV6] Error delete Fw rules on VIF/INT from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/1151

Jan 10 2022, 6:40 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases , a subtask of T2199: Rewrite firewall in new XML/Python style, from Open to Needs testing.

Jan 10 2022, 6:40 PM · VyOS 1.4 Sagitta (1.4.0-epa2)

sarthurdev changed the status of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases from Open to Needs testing.

Thanks for catching that!

Jan 10 2022, 6:40 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4149: [Firewall-IPV6] Error delete Fw rules on VIF/INT from Open to In progress.

Jan 10 2022, 5:53 PM · VyOS 1.4 Sagitta

Jan 6 2022

sarthurdev moved T4133: Firewall network group error with zone-based firewall rules from Open to In Progress on the VyOS 1.4 Sagitta board.

Jan 6 2022, 5:27 PM · VyOS 1.4 Sagitta, VyConf

sarthurdev moved T4145: Conntrack table not showing after firewall rewriting from Open to In Progress on the VyOS 1.4 Sagitta board.

Jan 6 2022, 5:26 PM · VyOS 1.4 Sagitta

sarthurdev added a comment to T4145: Conntrack table not showing after firewall rewriting.

Updates the vyatta-conntrack package to work without legacy firewall and fixes the op-mode commands. Should also fix some conntrack functionality (untested).

Jan 6 2022, 3:23 PM · VyOS 1.4 Sagitta

sarthurdev committed rVYOSONEX79f6f7061c0c: firewall: zone-policy: T4133: Prevent firewall from trying to clean-up zone….

Jan 6 2022, 8:28 AM

Jan 5 2022

sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/1139

Jan 5 2022, 5:10 PM · VyOS 1.4 Sagitta, VyConf

sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from Open to In progress.

Jan 5 2022, 2:07 PM · VyOS 1.4 Sagitta, VyConf

sarthurdev changed the status of T3635: Add ability to use mDNS repeater with VRRP from In progress to Needs testing.

Jan 5 2022, 1:55 PM · VyOS 1.4 Sagitta

sarthurdev committed rVYOSONEX8cbfda931dba: keepalived: T4109: Update configd-include.json to reflect filename change.

Jan 5 2022, 1:01 PM

sarthurdev committed rVYOSONEX96f577ef8272: zone-policy: T4135: Raise error when using an invalid "from" zone..

Jan 5 2022, 7:23 AM

sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/1136

Jan 5 2022, 12:40 AM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from Open to In progress.

Jan 5 2022, 12:33 AM · VyOS 1.4 Sagitta

sarthurdev committed rVYOSONEXe536b6a037e6: smoketest: shim: Optimise speed of `lsof` command.

Jan 5 2022, 12:23 AM

sarthurdev committed rVYOSONEX459c7079bebe: firewall: zone-policy: T2199: T4130: Fixes for firewall, state-policy and zone….

Jan 5 2022, 12:23 AM

Jan 4 2022

sarthurdev committed rVYOSONEX84a83ecc4c78: firewall: T4130: Fix firewall state-policy errors.

Jan 4 2022, 4:11 AM

sarthurdev committed rVYOSONEX9213d9cc7bcd: firewall: T4130: Add state-policy test to firewall smoketest.

Jan 4 2022, 4:11 AM

sarthurdev added a comment to T4136: Firewall State Policy entries fail to load..

Duplicate of T4130

Jan 4 2022, 12:45 AM · VyOS 1.4 Sagitta

sarthurdev changed the status of T4130: Firewall state policy errors chain from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/1130

Jan 4 2022, 12:14 AM · VyOS 1.4 Sagitta

Jan 3 2022

sarthurdev changed the status of T4130: Firewall state policy errors chain from Open to In progress.

Jan 3 2022, 9:58 PM · VyOS 1.4 Sagitta

Dec 31 2021

sarthurdev committed rVYOSONEX85710cee8fe9: firewall: T2199: Migrate firewall op-mode to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEXfdeba8da3e99: firewall: T2199: Migrate firewall to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEX3ebb08893b4b: zone-policy: T2199: Migrate zone-policy op-mode to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEXc7cf7b941445: zone-policy: T2199: Migrate zone-policy to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEXdcd202aeeb89: policy: T2199: Migrate policy route op-mode to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEXf86041de88c3: policy: T2199: Migrate policy route to XML/Python.

Dec 31 2021, 6:35 PM

sarthurdev committed rVYOSONEX28b285b4791a: zone_policy: T3873: Implement intra-zone-filtering.

Dec 31 2021, 6:35 PM

Nov 11 2021

sarthurdev committed rVYOSONEX23691df934ff: pki: T3970: Allow op-mode PKI commands in a config session to install directly.

Nov 11 2021, 6:56 PM

Nov 4 2021

sarthurdev changed the status of T3970: Add support for op-mode PKI direct install into an active config session, a subtask of T3642: PKI configuration, from Open to In progress.

Nov 4 2021, 7:27 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

sarthurdev changed the status of T3970: Add support for op-mode PKI direct install into an active config session from Open to In progress.

PR: https://github.com/vyos/vyos-1x/pull/1066

Nov 4 2021, 7:27 PM · VyOS 1.4 Sagitta

sarthurdev created T3970: Add support for op-mode PKI direct install into an active config session.

Nov 4 2021, 7:21 PM · VyOS 1.4 Sagitta

Nov 3 2021

sarthurdev committed rVYOSONEXa63aa6129324: sstp: T3931: Fixes PKI integration with SSTP.

Nov 3 2021, 5:32 PM

sarthurdev added a comment to T3931: SSTP doesn't work after rewriting to PKI.

PR: https://github.com/vyos/vyos-1x/pull/1062

Nov 3 2021, 1:31 PM · VyOS 1.4 Sagitta

Oct 31 2021

sarthurdev added a comment to T3873: Zone based Firewall - Filter traffic in same zone.

Included this feature in the firewall/zone-policy rewrite: https://github.com/vyos/vyos-1x/pull/1033

Oct 31 2021, 10:05 PM · VyOS 1.4 Sagitta

Oct 20 2021

sarthurdev added a comment to T2199: Rewrite firewall in new XML/Python style.

Draft PR: https://github.com/vyos/vyos-1x/pull/1033

Oct 20 2021, 3:21 PM · VyOS 1.4 Sagitta (1.4.0-epa2)

sarthurdev committed rVYOSONEX16ae2933ff97: mdns: T3917: Change to avahi-daemon for IPv4 + IPv6 mDNS repeater.

Oct 20 2021, 5:39 AM

Oct 19 2021

sarthurdev added a comment to T3917: Use Avahi as mDNS repeater for IPv6 support.

PR: https://github.com/vyos/vyos-1x/pull/1030

Oct 19 2021, 8:54 PM · VyOS 1.4 Sagitta

sarthurdev changed the status of T3917: Use Avahi as mDNS repeater for IPv6 support from Open to In progress.

Oct 19 2021, 8:40 PM · VyOS 1.4 Sagitta

Sep 24 2021

sarthurdev created T3854: Missing op-mode commands for conntrack-sync.

Sep 24 2021, 10:31 AM · VyOS 1.3 Equuleus ( 1.3.1), VyOS 1.4 Sagitta

Sep 14 2021

sarthurdev added a comment to T3828: ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta.

Good shout, fixed in following PR: https://github.com/vyos/vyos-1x/pull/1005

Sep 14 2021, 9:05 AM · VyOS 1.4 Sagitta

Sep 13 2021

sarthurdev added a comment to T3828: ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta.

PR: https://github.com/vyos/vyos-1x/pull/1004

Sep 13 2021, 12:52 PM · VyOS 1.4 Sagitta

Aug 13 2021

sarthurdev changed the status of T3752: generate pki certificate file xxx doesn't touch file from Open to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/969

Aug 13 2021, 4:42 PM · VyOS 1.4 Sagitta

Aug 10 2021

sarthurdev added a comment to T3727: VPN IPsec ESP proposal and ESP presented in config missmatch.

PR: https://github.com/vyos/vyos-1x/pull/961

Aug 10 2021, 11:57 AM · VyOS 1.4 Sagitta

Jul 22 2021

sarthurdev changed the status of T3642: PKI configuration, a subtask of T2799: VyOS Certificates Manager, from In progress to Needs testing.

Jul 22 2021, 3:49 PM · VyOS 1.3 Equuleus (1.3.6)

sarthurdev changed the status of T3642: PKI configuration from In progress to Needs testing.

Jul 22 2021, 3:49 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

sarthurdev updated the task description for T3642: PKI configuration.

Jul 22 2021, 3:49 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

Jul 21 2021

sarthurdev updated the task description for T3642: PKI configuration.

Jul 21 2021, 10:01 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

sarthurdev updated the task description for T3642: PKI configuration.

Jul 21 2021, 10:00 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

Jul 20 2021

sarthurdev updated the task description for T3642: PKI configuration.

Jul 20 2021, 1:46 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

Jul 19 2021

sarthurdev updated the task description for T3642: PKI configuration.

Jul 19 2021, 5:17 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

sarthurdev added a comment to T3642: PKI configuration.

PKI Wireguard PR: https://github.com/vyos/vyos-1x/pull/929

Jul 19 2021, 5:17 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

Jul 16 2021

sarthurdev updated the task description for T3642: PKI configuration.

Jul 16 2021, 5:39 PM · VyOS 1.4 Sagitta (1.4.0-epa1)

Jul 13 2021

sarthurdev added a comment to T3678: VyOS 1.4: Invalid error message while deleting ipsec vpn configuration.

This error occurs because the ipsec module blindly updates the l2tp module after a commit change to ensure any l2tp via ipsec config is then refreshed also.

Jul 13 2021, 4:01 PM · VyOS 1.4 Sagitta