Page MenuHomeVyOS Platform

Implement 'feasible' RPF
Needs reporter action, WishlistPublic

Description

Reverse Path Forwarding (RPF) as defined in RFC 3704 specifies 3 modes: 'strict' (drop traffic if the ingress interface does not have the best egress route to the source), 'feasible' (drop traffic if the ingress interface has no egress route to the source), and 'loose' (drop traffic if the entire system has no egress route to the source).

VyOS currently only implements the 'strict' and 'loose' modes:

set firewall source-validation 'strict'

and

set firewall source-validation 'loose'

I would like to see 'feasible' mode added as a third option, as it is a very pragmatic compromise between the existing 'strict' and 'loose' modes.

Details

Difficulty level
Unknown (require assessment)
Version
1.3.x
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Unspecified (please specify)

Event Timeline

matzus created this object in space S1 VyOS Public.
matzus updated the task description. (Show Details)
dmbaturin triaged this task as Wishlist priority.Jan 9 2024, 8:30 PM
dmbaturin set Issue type to Unspecified (please specify).
dmbaturin added a project: Restricted Project.
dmbaturin changed Is it a breaking change? from Behavior change to Perfectly compatible.

Hi @matzus,

could you provide us with a documentational like answer how you would implement the requested thing?
We have not yet found a good solution/idea internally and wanted to loop you in on this.

c-po changed the task status from Open to Needs reporter action.Mar 7 2024, 9:05 PM

I'm not the original reporter, but i think this is already implemented in T3509 and T5550

https://github.com/vyos/vyos-1x/pull/2793

vyosbot added a subscriber: n.fort.