After local testing, we decided to submit pr
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Jul 15 2020
Jul 15 2020
Jul 13 2020
Jul 13 2020
I have prepared a repair pudding, I use the solution of a, I am hesitating whether to mention PR, otherwise, it should be noted in the document that the writing of B should be ignored in the vyos configuration
I need someone to give me a good choice. I prefer standard writing. That is a
No one's dealing with it?
Jul 12 2020
Jul 12 2020
@c-po Please forgive me that I didn't react until it told me that this is a patch. It has solved the problem. In this case, if it is confirmed that the patch is available, then it is not necessary to discuss the cause of the problem. What we need to do is to apply the patch and conduct relevant tests
If so, you should make it clear that the diff is your own patch. If you are sure that the patch is available in the latest rolling image, you can consider submitting a PR yourself (please refer to the contributor's Guide) to seek consolidation
I thought you were asking for help and trying to report a bug to the community for a fix, so you need more information to help identify the problem, rather than a diff who doesn't know where to find it
You mean you've fixed the bug? If so, you can consider submitting pr
I have just quickly browsed the relevant code of this code base. Generally speaking, the code structure is very clear, which is not difficult to understand. The overall operation of this daemon is divided into the following processes:
I have to say that I saw the diff of this code base for the first time, but in fact, as for my understanding of C troubleshooting, analyzing the log and execution process will become a necessary work (none of them). I can see that the operation process required by this code base may be relatively complex, so that it can be executed as a background daemons rather than a single place According to the description of the questioner, there is hardly any relevant information that can be extracted from the error process. It is suggested to provide the following information:
If the process is simple, you can consider py script. If you need to run uninterrupted in the background or have other complex tasks, it is a good way to continue to use C/C++
Will this issue be fixed in the next release? Just in doubt, I've used Sha instead of MD5.
Thank you. I'm in a hurry to solve the problem. If I neglect, I can try to use Sha and reset it successfully. Do you not support MD5?
The configuration is as follows:
Now, I don't know how to pull the SNMP data again. The command is as follows:
Jul 11 2020
Jul 11 2020
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
Can't I dial on demand when I need to negotiate?
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
@c-po When I manually add the following commands to the following file:
Jul 10 2020
Jul 10 2020
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
Have the opportunity to study whether it is because of pppd configuration file error?
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
pppoe pppoe0 {
authentication {
password pass
user user
}
+ connect-on-demand
default-route force
description ISP
dhcpv6-options {
prefix-delegation {
interface br1 {
address 101
sla-id 2
sla-len 8
}
interface br2 {
address 101
sla-id 1
sla-len 8
}
length 56
}
}
firewall {
in {
ipv6-name WAN-IN
name wan
}
local {
ipv6-name WAN-LOCAL
name wan-local
}
}
idle-timeout 30
ipv6 {
address {
autoconf
}
enable
}
mtu 1492
source-interface eth5
}jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
Dial on demand still doesn't work
If you think about it carefully, maybe for vyos, if you don't consider supporting SDN, then Linux bridge is a good choice.
I have been thinking about a problem. OVS can work in SDN controller mode. However, if OVS works in SDN controller mode, whether router related functions related to routing configuration will fail. If someone wants to implement it, then whether SDN switching control mode and non SDN related modules need exclusive processing to prevent conflicts should be considered.
Jul 9 2020
Jul 9 2020
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
Waiting for the next rolling version, thank you.
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
jack9603301 changed the status of T2693: Dhcp6c cannot be restarted after PPPoE link is reset from Open to Needs testing.
Jul 8 2020
Jul 8 2020
jack9603301 added a comment to T2585: Unable to access the Internet after opening PPPoE on-demand dialing.
Is this bug report not handled?
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
jack9603301 updated the task description for T2693: Dhcp6c cannot be restarted after PPPoE link is reset.
Jul 6 2020
Jul 6 2020
jack9603301 changed Version from 1.3-rolling-202006270117 to 1.3-rolling-202007060117 on T2675: DNS service failed to start.
Jul 5 2020
Jul 5 2020
jack9603301 changed the status of T2680: dhcp6c service cannot recover when it fails from Open to Needs testing.
@c-po When you submit the following commit, the problem seems to be solved, when I need to do further testing tomorrow, waiting for tomorrow's daily build
@c-po The basic cause of the failure has been determined.This time, the problem may be relatively serious, because it is not the configuration of the service, but the execution of commit will not start the dhcp6c service at all.
Jul 4 2020
Jul 4 2020
Oddly enough, whether I change the service settings or change the default settings of systemd, there are problems.
@c-po The problem was found when upgrading to the latest version, and the reason is not clear.
PPPoE is configured as follows (account password is hidden):
I want to do it and have to re explore the cause of the failure, but I haven't found out why dhcp6c can't start, I have to start it manually.
Strange, I found that this service may not have been started at all!
forwarding {
allow-from 192.168.0.0/16
allow-from 2001:470:f1cd::/48
cache-size 1024
domain pve. {
addnta
recursion-desired
server 192.168.0.47
server 2001:470:f1cd::47
}
listen-address 0.0.0.0
listen-address ::
name-server 2001:470:f1cd::ff00
name-server 192.168.0.254
name-server 202.96.134.33
name-server 202.96.128.86
name-server 114.114.114.114
name-server 1.1.1.1
name-server 1.0.0.1
system
}jack9603301 added a comment to T2678: High RAM usage on SSH logins with lots of IPv6 routes in the routing table..
Oh, in a system like vyos, SSH memory leak appears to be relatively serious. If there is a solution, it should be handled first
Jul 3 2020
Jul 3 2020
I wish you success in advance. Porting and compiling has always been a large-scale application project, which may take a lot of time. However, in addition to rewriting and porting related code to a more portable language, we can also try to transplant and cross build the existing old code first. Of course, this is only the first step. If possible, porting the code base has made it easier for the code base to be transplanted Meaningful.
Jul 2 2020
Jul 2 2020
I found that this problem may be related to T2673
jack9603301 updated the task description for T2673: After the bridge is configured with Mac, bridge is automatically disabled.
jack9603301 updated the task description for T2673: After the bridge is configured with Mac, bridge is automatically disabled.
Jun 30 2020
Jun 30 2020
Sorry, I may have made a mistake. I've confused the order. If there's a problem, I'll reopen it.
Jun 28 2020
Jun 28 2020
@Viacheslav If so, the following commands are recommended at least:
Jun 27 2020
Jun 27 2020
If you don't consider the complete IDS/IPS support for the time being and only consider DDOS/DOS detection, then the command line may be changed to the following form:
OK, I think IDS detection may not only be the scope of DOS/DDOS detection and action linkage. Snort can monitor and scan data packets, and according to some set rule base to detect the existence of attack behavior, but open snort The detection and defense functions have requirements on the system hardware and software equipment configuration indicators. The specific addresses can be found at the following addresses (as far as I know, opnsense and pfsense support this detection):
The router operating system supports intrusion detection and automatic defense, which may increase the memory and hardware requirements as well as performance load of the router, but for the optional, I feel it is OK.
No, I mean, depending on your console option, it's better to provide complete IDs and IPS functions based on Snort. At present, we use snort to provide IDs or IPS protection functions to pfsense or opnsense open source firewalls, but full startup of this function requires system memory and CPU performance. Maybe it can work with DDoS detection instead of just providing DDoS attack detection. If not, I think the best way is to change the options of the console in order to avoid induction.
In this case, it is better to consider snort as the defense and detection backend of IDS/IPS.
firewall {
all-ping enable
broadcast-ping enable
config-trap disable
ipv6-receive-redirects enable
ipv6-src-route enable
ip-src-route enable
log-martians enable
name wan {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
}
name wan-local {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action accept
icmp {
type-name echo-request
}
protocol icmp
state {
new enable
}
}
rule 3 {
action drop
destination {
port 22
}
protocol tcp
recent {
count 4
time 60
}
state {
new enable
}
}
rule 4 {
action accept
protocol tcp
state {
new enable
}
}
}
options {
interface pppoe0 {
adjust-mss 1452
adjust-mss6 1452
}
}
receive-redirects disable
send-redirects enable
source-validation disable
state-policy {
established {
action accept
log {
enable
}
}
invalid {
action accept
log {
enable
}
}
related {
action accept
log {
enable
}
}
}
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
bridge br1 {
address 192.168.0.1/24
address fc00:470:f1cd::1/64
description Services
member {
interface eth1.1 {
}
interface eth2 {
}
}
stp
}
bridge br2 {
address 192.168.101.1/24
address fc00:470:f1cd:101::1/64
description Terminal
member {
interface eth0 {
}
interface eth1.2 {
}
interface eth3 {
}
interface eth4 {
}
}
stp
}
ethernet eth0 {
description "netgear R6260 AP"
hw-id 00:98:2b:f8:3f:11
ipv6 {
address {
}
dup-addr-detect-transmits 1
}
mtu 1492
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
}
ethernet eth1 {
description "DELL R410(Trunk)"
hw-id 00:98:2b:f8:3f:12
mtu 1500
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
vif 1 {
description "vlan 1 of eth1"
mtu 1492
}
vif 2 {
description "vlan 2 of eth1"
mtu 1492
}
}
ethernet eth2 {
description LAN
hw-id 00:98:2b:f8:3f:13
mtu 1492
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
}
ethernet eth3 {
description LAN
hw-id 00:98:2b:f8:3f:14
mtu 1492
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
}
ethernet eth4 {
description "Huawei is secondary home router (Telecom special edition, switching and AP mode)"
hw-id 00:98:2b:f8:3f:15
mtu 1492
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
}
ethernet eth5 {
description "ISP WAN"
disable-flow-control
firewall {
in {
name wan
}
local {
name wan-local
}
}
hw-id 00:98:2b:f8:3f:16
mtu 1500
offload-options {
generic-receive on
generic-segmentation on
scatter-gather on
tcp-segmentation on
udp-fragmentation on
}
}
loopback lo {
address 127.0.0.1/8
address ::1/128
description loopback
}
pppoe pppoe0 {
authentication {
password pass
user user
}
default-route force
description ISP
dhcpv6-options {
prefix-delegation {
interface br1 {
address 101
sla-id 2
sla-len 8
}
interface br2 {
address 101
sla-id 1
sla-len 8
}
}
}
idle-timeout 30
ipv6 {
address {
autoconf
}
enable
}
mtu 1492
source-interface eth5
}
}
nat {
nptv6 {
rule 2 {
outbound-interface pppoe0
source {
prefix fc00:470:f1cd::/64
}
translation {
prefix 240e:fc:7d:b79b::/64
}
}
}
source {
rule 1 {
description PUBLIC
log
outbound-interface pppoe0
protocol all
source {
address 0.0.0.0/0
}
translation {
address masquerade
}
}
}
}
protocols {
static {
interface-route 0.0.0.0/0 {
next-hop-interface pppoe0 {
}
}
interface-route6 ::/0 {
next-hop-interface pppoe0 {
}
}
table 150 {
interface-route 0.0.0.0/0 {
next-hop-interface pppoe0 {
}
}
interface-route6 ::/0 {
next-hop-interface pppoe0 {
}
}
}
}
}
service {
dhcp-server {
shared-network-name pri101 {
description "DHCP 101"
subnet 192.168.101.0/24 {
default-router 192.168.101.1
dns-server 192.168.0.254
dns-server 192.168.101.1
dns-server 192.168.0.1
lease 86400
ntp-server 192.168.101.1
range 0 {
start 192.168.101.9
stop 192.168.101.254
}
}
}
}
dns {
forwarding {
allow-from 192.168.0.0/16
allow-from 2001:470:f1cd::/48
cache-size 1024
domain pve. {
addnta
recursion-desired
server 192.168.0.47
server 2001:470:f1cd::47
}
listen-address 0.0.0.0
listen-address ::
name-server 2001:470:f1cd::ff00
name-server 192.168.0.254
name-server 202.96.134.33
name-server 202.96.128.86
name-server 114.114.114.114
name-server 1.1.1.1
name-server 1.0.0.1
system
}
}
https {
api {
debug
keys {
id admin {
key jack960330
}
}
port 8000
}
api-restrict {
virtual-host vhost0
}
certificates {
system-generated-certificate {
lifetime 365
}
}
virtual-host vhost0 {
listen-address "*"
server-name 192.168.0.1
}
}
mdns {
repeater {
interface br1
interface br2
}
}
router-advert {
interface br1 {
default-preference high
interval {
max 600
min 10
}
name-server fc00:470:f1cd::ff00
prefix ::/64 {
}
reachable-time 0
retrans-timer 0
}
interface br2 {
default-preference high
hop-limit 60
interval {
max 600
min 10
}
name-server fc00:470:f1cd::ff00
prefix ::/64 {
}
reachable-time 0
retrans-timer 0
}
}
ssh {
listen-address 0.0.0.0
listen-address ::
}
}
system {
config-management {
commit-revisions 100
}
console {
device ttyS0 {
speed 115200
}
}
domain-name router
host-name vyos
ip {
arp {
table-size 2048
}
multipath {
layer4-hashing
}
}
ipv6 {
multipath {
layer4-hashing
}
neighbor {
table-size 2048
}
strict-dad
}
login {
user vyos {
authentication {
encrypted-password $6$UaXQViDvJ.Hr$85U/9Q5d/tc9hdtrnntMVgrztOCext..OJCHaJYZUo82GAdD95lchvSjI3vCZJTNte7cIAs87YctYlXODGXAz1
plaintext-password ""
}
}
}
ntp {
allow-clients {
address 192.168.0.0/16
address fc00:470:f1cd::/48
}
listen-address ::
listen-address 0.0.0.0
server 0.debian.pool.ntp.org {
}
server 1.debian.pool.ntp.org {
}
server 2.debian.pool.ntp.org {
}
server 3.debian.pool.ntp.org {
}
}
options {
reboot-on-panic
}
sysctl {
custom net.ipv4.conf.all.rp_filter {
value 0
}
custom net.ipv4.conf.default.rp_filter {
value 0
}
custom net.ipv4.conf.eth0.rp_filter {
value 0
}
custom net.ipv6.conf.all.accept_ra {
value 2
}
custom net.ipv6.conf.all.forwarding {
value 1
}
}
syslog {
global {
facility all {
level info
}
facility protocols {
level debug
}
}
}
time-zone Asia/Shanghai
}Jun 26 2020
Jun 26 2020
I checked the usage of netmap, but unfortunately I only found the equivalent configuration method of IPv4 on Wiki
Jun 23 2020
Jun 23 2020
Jun 15 2020
Jun 15 2020
@alexandrestein Sorry, I didn't understand some of them, but I opened this task list to track 1.3 nptv6 process, not about the DHCP support of wireguard. If you need this function or find that there is a bug in wireguard's DHCP, you should submit a bug report task list separately.
Jun 14 2020
Jun 14 2020
You may use dpkg to unpack and install according to the following information:
For driver firmware, it's just a ko file, which can then be used by setting the boot in the configuration directory to automatically load the kernel file, or by using the following command:
Adding custom install firmware command may be a good way. I tried to manually compile and upload firmware to vyos before.
There are two main disadvantages to the third-party files and packages installed outside the packaged files of the installed vyos system. You need to determine by yourself that if:
a) does not match the basic debian system of vyos, ABI conflicts may occur.
Although this is not an orthodox solution, it is the fault of artificially installing drivers when there is a lack of drivers. Vyos is based on debian for secondary development, although unorthodox solutions should be allowed to use debian underlying commands to install appropriate firmware packages. Judging from the error message, it appears that the unpacking failed because there are other packages in conflict.
Jun 12 2020
Jun 12 2020
The purpose of choosing wide-dhcpv6 is to achieve DHCPv6 PD.
Jun 11 2020
Jun 11 2020
Jun 10 2020
Jun 10 2020
@alexandrestein Note that vyos 1.2 (crux) does not implement DHCPv6 PD.
@alexandrestein Or, a disguised solution is to directly use iptables instruction rules to manually implement temporary nptv6 conversion. But I don't know when it will work. You can try it.
PS: because vyos uses nftables to implement NAT in 1.3, but because of the function limitation of nftables version, this function cannot be realized at present.