Good point, I'll try and look into this and see if it can be handled everywhere the new PKI nodes are used.

PR: https://github.com/vyos/vyos-1x/pull/1628

Best suggestion seems to be introducing a script to call podman stop -t N on shutdown/reboot to reduce the timeout before SIGKILL is sent.

1.4 PR: https://github.com/vyos/vyos-1x/pull/1621

PR: https://github.com/vyos/vyos-1x/pull/1618

PR: https://github.com/vyos/vyos-1x/pull/1577

PR: https://github.com/vyos/vyos-1x/pull/1577

PR: https://github.com/vyos/vyos-1x/pull/1564

Can we see example destination NAT config with the issue?

Included a fix for this in NAT refactor: https://github.com/vyos/vyos-1x/pull/1552

PR for NAT included with refactor: https://github.com/vyos/vyos-1x/pull/1552

Refactor PR: https://github.com/vyos/vyos-1x/pull/1534

PR for filter tables: https://github.com/vyos/vyos-1x/pull/1534

In T1185#133941, @roedie wrote:

Just a suggestion, would it be a weird idea to move the firewall config from the interface section to the firewall section? A bit like the zone config. So something like:

set firewall local interface eth0 name <firewall-filter>
set firewall in interface eth0 name <firewall-filter>
set firewall out interface eth0 name <firewall-filter>
set firewall local interface bond0.10v22v6 ipv6-name <firewall-filter>

The problem is that using zone-policy firewall is a bit overkill for a pure router or even a router with async routing. In which scenario I guess only the local variant would be useful.

Not supported at the moment, but we can look into adding it for both ipv4/v6 in 1.4

While I'm for changing to prefixed tables, I think the issue of tailscale and custom apps should fall under the accepted risk of running custom scripts outside of the config.

Any config available to test against?

I think there's still a problem possible with /var/log/messages handling:

PR: https://github.com/vyos/vyos-1x/pull/1398

Confirmed issue, seems to be a problem in rsyslog/logrotate. Possibly related to T4250

PR: https://github.com/vyos/vyos-1x/pull/1394

Inverse match PR: https://github.com/vyos/vyos-1x/pull/1386

If the counters are visible and incrementing when checking with nft list table ip filter then I don't think this is an implementation issue. Wondering if its a problem with the syslog daemon.

PR: https://github.com/vyos/vyos-1x/pull/1380

PR: https://github.com/vyos/vyos-1x/pull/1368

PR: https://github.com/vyos/vyos-1x/pull/1362

PR: https://github.com/vyos/vyos-1x/pull/1361

Working on moving groups to named set as part of a refactor in some firewall code.

PR: https://github.com/vyos/vyos-1x/pull/1357

PR: https://github.com/vyos/vyos-1x/pull/1356

PR for op-mode importing existing PKI files into config: https://github.com/vyos/vyos-1x/pull/1343

In T1230#123939, @panachoi wrote:

1.4 rolling does not help me, so there must be something "wrong" with my configuration. I've attached the private config, it would be awesome if someone might find what's broken.

private.cfg127 KBDownload

@panachoi If you can share the anonymized config that works in 1.2.8 that would be useful. I'd expect migrating to 1.4 to see a decent improvement in firewall load times.

30 largest packages in 1.4 dev build:

telegraf 144 MB
linux-image-5.10.109-amd64-vyos 107 MB
libwireshark14 100 MB
vyos-linux-firmware 68.8 MB
containernetworking-plugins 51.2 MB
vyos-http-api-tools 40.4 MB
podman 37.3 MB
python3-pycryptodome 36.0 MB
libicu67 33.9 MB
vim-runtime 32.9 MB
vyos-1x 29.2 MB
libperl5.32 28.5 MB
salt-common 27.9 MB
nmap-common 21.2 MB
frr 20.2 MB
libruby2.7 17.9 MB
coreutils 17.9 MB
perl-modules-5.32 17.9 MB
grub-common 17.8 MB
systemd 16.4 MB
locales 16.4 MB
libc6 13.1 MB
pmacct 13.0 MB
ieee-data 12.3 MB
vyos-intel-qat 11.7 MB
aptitude-common 10.3 MB
gdb 10.0 MB
udev 9,184 kB
grub-efi-amd64-bin 8,831 kB
squid 8,582 kB