@SrividyaA Can you confirm this is working as you expect?

@a.apostoliuk Can you confirm this is working as expected?

If you don't use the firewall (statefully at least) then it will go through the FW_CONNTRACK chain and the NAT_CONNTRACK and/or WLB_CONNTRACK chains will be reached, or fall through to the notrack.

That is how the conntrack enabling system works. FW_CONNTRACK verdict is set to accept when it is determined the firewall needs conntracking (state rules, flowtable etc.), same for NAT_/WLB_ chains. If none require conntrack - all chains will be return and it falls down the chain to the final notrack and conntrack is not enabled.

Not sure what to do on this one. The firewall is depending on conntrack module, which updates the conntrack related sysctls. It'd be the same if someone defines custom sysctls used by other conf scripts.

PR: https://github.com/vyos/vyos-1x/pull/2305

PR removing zone-policy op-mode: https://github.com/vyos/vyos-1x/pull/2304

PR: https://github.com/vyos/vyos-1x/pull/2304

PR: https://github.com/vyos/vyos-1x/pull/2304

This is likely also the issue causing T5376

In T4502#160404, @Apachez wrote:

Perhaps a possible way to detect if the nic supports hardware flowtables or not.

Try to set sudo ethtool -K eth0 hw-tc-offload on.

If the result becomes:

Actual changes:
hw-tc-offload: off [requested on]
Could not change any device features

Then it doesnt support hardware flowtables.

Could also verify by reading the capability like so:

$ ethtool -k eth0 | grep hw-tc-offload
hw-tc-offload: off [fixed]

Fixed in PR: https://github.com/vyos/vyos-1x/pull/2276

https://github.com/vyos/vyos-1x/pull/2272 should fix this

@fernando See here: https://github.com/vyos/vyos-build/pull/297

Builds passing: https://github.com/vyos/vyos-rolling-nightly-builds/actions/runs/6142937552

current PR: https://github.com/vyos/vyatta-cfg-system/pull/205

Can we see the output of sudo nft list table ip raw on an affected router?

PR: https://github.com/vyos/vyos-1x/pull/2221

current PR: https://github.com/vyos/vyos-1x/pull/2217
1.4 PR: https://github.com/vyos/vyos-1x/pull/2218
1.3 PR: https://github.com/vyos/vyos-1x/pull/2219

@svd135 Can you provide a version string when you last had it working? Seeing the firewall config might also be helpful.

PR: https://github.com/vyos/vyos-1x/pull/2208

PR: https://github.com/vyos/vyos-1x/pull/2199

PR: https://github.com/vyos/vyos-1x/pull/2199

PR: https://github.com/vyos/vyos-1x/pull/2190

@csszep Yes it is expected, IPv6 has no sysctl and requires the nftables rule to function. The nftables execution is slightly slower, so there's no benefit to change it for IPv4.

@tjjh89017 This will need to be re-evaluated. The build from your PR was taking in excess of 8 hours on the build server - the defconfig likely needs to be brought down to only the minimum required modules/drivers for successful builds on target devices.

This does still need to be addressed in 1.4. Without a version string, the 2-to-3 migrator is adding the conntrack helpers to the default config.

Duplicate T3275

The kernel modules handle tracking of those, rpc/tns are userspace helpers.

They are only defined. Only when the VYOS_CT_HELPER chain is reached will they take effect - see links in my above comment. Being in the default config will have no effect on connection tracking if bypassed by the notrack rule.