Page MenuHomeVyOS Platform

Can not specify multiple deny ports in FW rule
Closed, ResolvedPublicBUG

Description

vyos@vyos# set firewall ipv6-name WAN-TO-VLAN810-6 rule 1000 destination port
Possible completions:
   <port name>  Named port (any name in /etc/services, e.g., http)
   <1-65535>    Numbered port
   <start>-<end>
                Numbered port range (e.g., 1001-1005)


Detailed information:
  Multiple destination ports can be specified as a comma-separated list.
  The whole list can also be "negated" using '!'. For example:
    '!22,telnet,http,123,1001-1005'
vyos@vyos# set firewall ipv6-name WAN-TO-VLAN810-6 rule 1000 destination port "!22"
[edit]
vyos@vyos# set firewall ipv6-name WAN-TO-VLAN810-6 rule 1000 destination port "!22,!80"

  Value validation failed
  Set failed

Details

Difficulty level
Unknown (require assessment)
Version
1.2.6
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

@c-po It's mean all NOT ports. If you want to drop not 22,23,24,25

set firewall ipv6-name FOO rule 1000 action 'drop'
set firewall ipv6-name FOO rule 1000 destination port '!22,23,24,25'
set firewall ipv6-name FOO rule 1000 protocol 'tcp'
-A FOO -p tcp -m multiport ! --dports 22,23,24,25 -m comment --comment FOO-1000 -j DROP

Ah, thanks for the clarification.