I am running VyOS in a Zone Based Firewall (ZBF) configuration and have a number of rulesets that have only a default action. For example WAN-LAN default action is drop etc. I have set the system-wide state setting to allow related, established connections and drop invalid ones so that I do not have to declare firewall individual rules for each firewall ruleset. From time to time, I create a rule in order to enable logging as I troubleshoot a particular routing/connection issue. The issue is that when I try to delete the rule, VyOS throws an error and says that the firewall ruleset is still in use.
Firewall ruleset example with no rules (with system-wide state policy allow established, related and deny invalid enabled)
vyos@VyosOverseas# show firewall state-policy established { action accept } invalid { action drop } related { action accept }
name WAN-LAN { default-action drop enable-default-log }
The router functions perfectly and I received no errors when I created and assigned the rulesets with no rule created.
I then created a rule for one of the rulesets in a Trusted VPN zone
name UTAH-LAN { default-action accept rule 10 { action accept log enable } }
However, I no longer want the rule as it does nothing that the default action doesn't do. I merely created the rule in order to enable logging as I was having a connectivity issue. When I got to delete the rule, I get the following:
vyos@VyosOverseas# delete firewall name UTAH-LAN rule 10 [edit] vyos@VyosOverseas# commit [ firewall name UTAH-LAN ] Firewall configuration error: Cannot delete rule set "UTAH-LAN" (still in use) [[firewall name UTAH-LAN]] failed Commit failed [edit]
Again, before I created this rule, the firewall worked just fine with the default action only declared. I don't understand why I cannot revert to the previous ruleset declaration when VyOS accepted that declaration before with no problem. I had a good exchange of thoughts on this situation with Soucy on Reddit and he recommended I submit this as a bug to be fixed. My complete configuration, if needed, is attached.
Thanks!