Page MenuHomeVyOS Platform
Feed Search

Sep 14 2023

n.fort changed the status of T5579: Log firewall - Wrong command after firewall refactor, a subtask of T5160: Firewall refactor, from Confirmed to In progress.
Sep 14 2023, 6:45 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5579: Log firewall - Wrong command after firewall refactor from Confirmed to In progress.

PR: https://github.com/vyos/vyos-1x/pull/2268

Sep 14 2023, 6:45 PM · VyOS 1.5 Circinus
n.fort committed rVYOSONEX063de842144a: T4072: Firewall op-mode command: add bridge capabilities.
Sep 14 2023, 5:14 PM
n.fort committed rVYOSONEXec5437913e48: T5561: nat: defining inbound|outbound interface should not be mandatory while….
Sep 14 2023, 5:13 PM

Sep 13 2023

n.fort added a subtask for T5160: Firewall refactor: T5579: Log firewall - Wrong command after firewall refactor.
Sep 13 2023, 3:07 PM · VyOS 1.4 Sagitta
n.fort added a parent task for T5579: Log firewall - Wrong command after firewall refactor: T5160: Firewall refactor.
Sep 13 2023, 3:07 PM · VyOS 1.5 Circinus
n.fort changed the status of T5579: Log firewall - Wrong command after firewall refactor from Open to Confirmed.
Sep 13 2023, 3:07 PM · VyOS 1.5 Circinus
n.fort created T5579: Log firewall - Wrong command after firewall refactor.
Sep 13 2023, 3:07 PM · VyOS 1.5 Circinus
n.fort changed the status of T5561: NAT - Inbound or outbound interface should not be mandatory from Confirmed to In progress.

PR: https://github.com/vyos/vyos-1x/pull/2253

Sep 13 2023, 10:47 AM · VyOS 1.5 Circinus, VyOS 1.4 Sagitta

Sep 12 2023

n.fort removed a project from T4072: Feature Request: Firewall on bridge interfaces: VyOS 1.3 Equuleus (1.3.5).
Sep 12 2023, 12:16 PM · VyOS 1.4 Sagitta
n.fort changed the status of T4072: Feature Request: Firewall on bridge interfaces from In progress to Needs testing.

op-mode: https://github.com/vyos/vyos-1x/pull/2242

Sep 12 2023, 10:17 AM · VyOS 1.4 Sagitta

Sep 11 2023

n.fort added a comment to T5564: Both show firewall group and show firewall summary fails.

N/D == not defined

Sep 11 2023, 9:54 AM · VyOS 1.4 Sagitta, VyOS 1.5 Circinus

Sep 8 2023

n.fort committed rVYOSONEX1772c0a72327: T4072: add firewall bridge filtering. First implementation only applies for….
Sep 8 2023, 3:36 PM
n.fort changed the status of T5561: NAT - Inbound or outbound interface should not be mandatory from Open to Confirmed.
Sep 8 2023, 10:48 AM · VyOS 1.5 Circinus, VyOS 1.4 Sagitta
n.fort created T5561: NAT - Inbound or outbound interface should not be mandatory.
Sep 8 2023, 10:47 AM · VyOS 1.5 Circinus, VyOS 1.4 Sagitta
n.fort closed T4356: DHCP v6 client only supports single interface configuration as Resolved.

I'm closing this one. No news in the last year, and the tests I've done last month were ok.

Sep 8 2023, 10:12 AM · VyOS 1.4 Sagitta
n.fort closed T5450: Firewall interface group - Allow inverted matcher as Resolved.
Sep 8 2023, 10:04 AM · VyOS 1.4 Sagitta
n.fort closed T5460: Firewall - remove config-trap as Resolved.
Sep 8 2023, 10:04 AM · VyOS 1.4 Sagitta
n.fort closed T5502: Firewall - wrong parser for inbound and/or outbound interface as Resolved.
Sep 8 2023, 10:03 AM · VyOS 1.4 Sagitta
n.fort changed the status of T4072: Feature Request: Firewall on bridge interfaces from Open to In progress.
Sep 8 2023, 10:02 AM · VyOS 1.4 Sagitta
n.fort changed the status of T5553: Firewall - Add action continue from Confirmed to In progress.
Sep 8 2023, 10:01 AM · VyOS 1.4 Sagitta
n.fort added a comment to T5553: Firewall - Add action continue.

Feature included in: https://github.com/vyos/vyos-1x/pull/2222

Sep 8 2023, 10:01 AM · VyOS 1.4 Sagitta

Sep 7 2023

n.fort added a comment to T4072: Feature Request: Firewall on bridge interfaces.

PR: https://github.com/vyos/vyos-1x/pull/2222

Sep 7 2023, 8:47 PM · VyOS 1.4 Sagitta

Sep 6 2023

n.fort changed the status of T5553: Firewall - Add action continue from Open to Confirmed.
Sep 6 2023, 5:39 PM · VyOS 1.4 Sagitta
n.fort created T5553: Firewall - Add action continue.
Sep 6 2023, 5:39 PM · VyOS 1.4 Sagitta

Sep 5 2023

n.fort added a comment to T5482: Chrony NTP Server Fails To Sync Time.

Are you using vrf? Maybe it's an issue and router can't resolve dns for ntp servers

Sep 5 2023, 2:11 PM · VyOS 1.4 Sagitta
n.fort claimed T4072: Feature Request: Firewall on bridge interfaces.
Sep 5 2023, 9:40 AM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEX3b51c8af61d8: T5496: add fqdn and geo-ip matchers in op-mode command <show firewall statics>.
Sep 5 2023, 5:22 AM
n.fort committed rVYOSONEXac65673bd7b5: T5496: Change src and|or destination wildcard for any, which still makes it….
Sep 5 2023, 5:22 AM

Aug 30 2023

n.fort added a comment to T5496: `show firewall` error.

Adding geo-ip and fqnd too:
https://github.com/vyos/vyos-1x/pull/2188

Aug 30 2023, 10:27 PM · Restricted Project, VyOS 1.4 Sagitta
n.fort changed the status of T5496: `show firewall` error from Open to Needs testing.
Aug 30 2023, 1:54 PM · Restricted Project, VyOS 1.4 Sagitta
n.fort changed the status of T5513: Anomalies in show firewall command after refactoring from Open to Needs testing.
Aug 30 2023, 1:54 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5250: Firewall - show firewall group from In progress to Needs testing.
Aug 30 2023, 1:53 PM · VyOS 1.4 Sagitta
n.fort added a comment to T5513: Anomalies in show firewall command after refactoring.

Fixed on this op-mode commands were introduced on PR https://github.com/vyos/vyos-1x/pull/2186

Aug 30 2023, 1:53 PM · VyOS 1.4 Sagitta
n.fort added a comment to T5496: `show firewall` error.

Corrections and improvements were applied. Please check on next rolling release

Aug 30 2023, 1:52 PM · Restricted Project, VyOS 1.4 Sagitta
n.fort committed rVYOSONEXcbedb76b3fd9: T5496: firewall op-mode: fix show command for group member and references.
Aug 30 2023, 5:02 AM
n.fort committed rVYOSONEX61d3cbd51591: T5496: firewall op-mode: add fix for firewall statics. Include groups correct….
Aug 30 2023, 5:02 AM
n.fort committed rVYOSONEX3c8dbc7485e3: T5496: firewall op-mode: add fix for source and destination when not specified….
Aug 30 2023, 5:02 AM

Aug 25 2023

n.fort committed rVYOSONEX1a2237ba91d5: T5502: firewall: add validator for interface matcher, and allow only interface….
Aug 25 2023, 6:03 PM
n.fort changed the status of T5472: NAT redirect should not require port from In progress to Needs testing.
Aug 25 2023, 5:03 PM · VyOS 1.4 Sagitta
n.fort closed T5501: Firewall - Allow multiple inbound outbound interface as Invalid.

Closing this task because better way to match multiple interfaces in firewall rules would be using interface groups.

Aug 25 2023, 4:56 PM · VyOS 1.4 Sagitta
n.fort added a comment to T5508: Configuration Migration Fails to New Netfilter Firewall Syntax.

Missing vrrp cli version in last line in config.boot file:

Aug 25 2023, 2:16 PM · VyOS 1.4 Sagitta

Aug 23 2023

n.fort changed the status of T5502: Firewall - wrong parser for inbound and/or outbound interface from Open to Confirmed.
Aug 23 2023, 6:51 PM · VyOS 1.4 Sagitta
n.fort created T5502: Firewall - wrong parser for inbound and/or outbound interface.
Aug 23 2023, 6:51 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5501: Firewall - Allow multiple inbound outbound interface from Open to Confirmed.
Aug 23 2023, 6:48 PM · VyOS 1.4 Sagitta
n.fort created T5501: Firewall - Allow multiple inbound outbound interface.
Aug 23 2023, 6:48 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEXf0ae034faa74: T5472: nat redirect: allow redirection without defining redirected port.
Aug 23 2023, 6:20 PM
n.fort changed the status of T5450: Firewall interface group - Allow inverted matcher from In progress to Needs testing.
Aug 23 2023, 4:30 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEX524b517c53d1: T5450: update smoketest and interface definition in order to work with new….
Aug 23 2023, 4:19 PM
n.fort added a comment to T5472: NAT redirect should not require port.

PR: https://github.com/vyos/vyos-1x/pull/2162

Aug 23 2023, 1:03 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5472: NAT redirect should not require port from Confirmed to In progress.
Aug 23 2023, 11:49 AM · VyOS 1.4 Sagitta
n.fort added a comment to T4610: Firewall with 20K entries cannot load after reboot.

This delay is not only present in latest version. Huge firewall (and not only firewall) config leads to more processing while committing changes.
Bare in mind that for every firewall config command, python scripts are invoked for sanity checks and for config generation.
If direct nft commands are used, then all this scripts are not called.

Aug 23 2023, 11:19 AM · VyOS 1.4 Sagitta
n.fort closed T4889: Add nftables NAT REDIRECT [to localhost] to CLI as Resolved.
Aug 23 2023, 11:17 AM · vyatta-nat, VyOS 1.4 Sagitta
n.fort changed the status of T5160: Firewall refactor from In progress to Needs testing.
Aug 23 2023, 11:16 AM · VyOS 1.4 Sagitta
n.fort closed T5446: bgp: validity check for bestpath med option as Resolved.
Aug 23 2023, 11:16 AM · VyOS 1.4 Sagitta
n.fort closed T5453: Fix nat66 - broken after load-balance was introduced in nat as Resolved.
Aug 23 2023, 11:14 AM · VyOS 1.4 Sagitta
n.fort changed the status of T5478: Cannot configure resolver-cache options for firewall from In progress to Needs testing.
Aug 23 2023, 11:12 AM · VyOS 1.4 Sagitta

Aug 22 2023

n.fort added a comment to T3509: No BCP38 for IPv6 on VyOS.

There's request for fib matcher: https://vyos.dev/T5119
It would be useful if you could propose cli design for this feature in that task, so we can discuss about it and then work on adding it

Aug 22 2023, 6:30 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEX961d6b43d30f: T5478: remove config-trap configuration parser in firewall.
Aug 22 2023, 2:19 PM

Aug 15 2023

n.fort changed the status of T5478: Cannot configure resolver-cache options for firewall from Confirmed to In progress.

PR: https://github.com/vyos/vyos-1x/pull/2149

Aug 15 2023, 12:01 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5478: Cannot configure resolver-cache options for firewall from Open to Confirmed.
Aug 15 2023, 10:18 AM · VyOS 1.4 Sagitta
n.fort added a comment to T5160: Firewall refactor.

2.1:
Suggestion that established/related merges to a single rule such as:

Aug 15 2023, 10:09 AM · VyOS 1.4 Sagitta

Aug 14 2023

n.fort changed the status of T5472: NAT redirect should not require port from Open to Confirmed.
Aug 14 2023, 10:09 AM · VyOS 1.4 Sagitta

Aug 11 2023

n.fort changed the status of T5460: Firewall - remove config-trap from Confirmed to Needs testing.
Aug 11 2023, 10:21 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEXa8244928af84: T5160: firewall refactor: new cli structure. Update jinja templates, python….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX1c2209c1dc84: T5160: firewall refactor: new cli structure. Update only all xml.
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXac5b9a4630f8: T5160: firewall refactor: new cli structure. Add migration script and update….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXdbf7501d0c75: T5160: firewall refactor: re-add missing code in template.py which was….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX68d14fe80145: T5160: firewall refactor: change firewall ip to firewall ipv4.
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX342db936a02a: T5160: firewall refactor. Update op-mode commands to new syntax..
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXd898739b78f4: T5160: T5250: while refactoring, fix reference column for op-mode command….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX68694d022d8f: T5160: firewal refactor: fix tabulation for geo-ip parsing code. Typo fix in….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX0300bf433d9a: T5160: firewall refactor: move <set firewall ipv6 ipv6-name ...> to <set….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXdbb069151f37: T5160: firewall refactor: fix firewall template for correct rule parsing that….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXa07a46d5d4ac: T5160: firewall refactor: change default value for <default-action> from <drop>….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEXf57ad85b346a: T5160: firewall refactor: fix regexep for connection-status. Create new file….
Aug 11 2023, 8:14 PM
n.fort committed rVYOSONEX4e07fa25f551: T5460: remove config-trap from firewall.
Aug 11 2023, 8:14 PM

Aug 10 2023

n.fort changed the status of T5460: Firewall - remove config-trap from Open to Confirmed.
Aug 10 2023, 7:04 PM · VyOS 1.4 Sagitta
n.fort created T5460: Firewall - remove config-trap.
Aug 10 2023, 7:04 PM · VyOS 1.4 Sagitta
n.fort closed T5416: Ignoring "ipsec match-none" for firewall as Resolved.
Aug 10 2023, 6:54 PM · VyOS 1.4 Sagitta
n.fort claimed T5453: Fix nat66 - broken after load-balance was introduced in nat.
Aug 10 2023, 6:38 PM · VyOS 1.4 Sagitta
n.fort added a comment to T660: 802.1p CoS priority support.

Some internal test where done, using integration between:

  • Traffic shaper. Currently supported in vyos cli
  • Bridge firewall. Currently not supported in vyos cli.
Aug 10 2023, 1:53 PM · VyOS Rolling

Aug 9 2023

n.fort added a comment to T5450: Firewall interface group - Allow inverted matcher.

PR https://github.com/vyos/vyos-1x/pull/2142

Aug 9 2023, 9:19 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5450: Firewall interface group - Allow inverted matcher from Confirmed to In progress.
Aug 9 2023, 9:18 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5453: Fix nat66 - broken after load-balance was introduced in nat from Open to Needs testing.
Aug 9 2023, 6:48 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEXbaf6d9ced3a2: T5453: nat66: exclude checks for nat load-balance when using ipv6 while parsing….
Aug 9 2023, 11:29 AM
n.fort renamed T5453: Fix nat66 - broken after load-balance was introduced in nat from Fix nat66 smoketest to Fix nat66 - broken after load-balance was introduced in nat.
Aug 9 2023, 10:53 AM · VyOS 1.4 Sagitta
n.fort added a comment to T5453: Fix nat66 - broken after load-balance was introduced in nat.

Not only affects, smoketest.. nat66 got broken

Aug 9 2023, 10:52 AM · VyOS 1.4 Sagitta
n.fort created T5453: Fix nat66 - broken after load-balance was introduced in nat.
Aug 9 2023, 10:03 AM · VyOS 1.4 Sagitta

Aug 8 2023

n.fort changed the status of T5450: Firewall interface group - Allow inverted matcher from Open to Confirmed.
Aug 8 2023, 6:03 PM · VyOS 1.4 Sagitta
n.fort created T5450: Firewall interface group - Allow inverted matcher.
Aug 8 2023, 6:02 PM · VyOS 1.4 Sagitta
n.fort committed rVYOSONEX7ae9d8953ddc: T5014: fix conflicts. Add code for redirection, which is causing conflicts..
Aug 8 2023, 4:39 AM
n.fort committed rVYOSONEXb7825f1f2b9b: T5014: nat: add source and destination nat options for configuring load balance….
Aug 8 2023, 4:39 AM

Aug 7 2023

n.fort committed rVYOSONEX2b05ac9e3413: T5446: BGP: change <bgp paramater bestpath med> from node to leafNode, in order….
Aug 7 2023, 8:50 PM
n.fort added a comment to T5446: bgp: validity check for bestpath med option.

PR: https://github.com/vyos/vyos-1x/pull/2137

Aug 7 2023, 5:07 PM · VyOS 1.4 Sagitta
n.fort changed the status of T5446: bgp: validity check for bestpath med option from Open to In progress.
Aug 7 2023, 4:07 PM · VyOS 1.4 Sagitta
n.fort closed T5406: "update webproxy blacklists" fails when vrf is being configured as Resolved.
Aug 7 2023, 9:43 AM · VyOS 1.4 Sagitta

Aug 3 2023

n.fort closed T5301: NTP: chrony only allows one bind address as Resolved.
Aug 3 2023, 11:22 AM · VyOS 1.4 Sagitta
n.fort closed T5154: Chrony - multiple listen addresses as Resolved.
Aug 3 2023, 11:21 AM · VyOS 1.4 Sagitta

Jul 31 2023

n.fort committed rVYOSONEXbefd4045b59f: T5406: webproxy op-mode command: add vrf support for blacklist update command.
Jul 31 2023, 5:20 PM