Page MenuHomeVyOS Platform

custome firewall network-group and update CIDR from a file
Closed, InvalidPublic

Description

As we know vyos 1.4 merge iptables to nftables, then ipset command is not working anymore.
Is there any way to implement shell script loading CIDR on VyOS 1.4?

#implement with ipset
set firewall group network-group us-ip-ranges

# cat /config/scripts/vyos-postconfig-bootup.script
for l in `cat /config/usipranges.txt`; do sudo ipset add us-ip-ranges $l;done

Details

Version
1.4
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Event Timeline

The similar task https://vyos.dev/T4797
You can add manually nft rules that used for firewall group, but they will overwritten per next firewall change/commit. The whole firewall config will overwritten.
There are 2 ways. Somehow use it in CLI or use native (nft) tables, chains, group-sets and rules which are not overlapping with generated “system” firewall ruleset

Viacheslav triaged this task as Wishlist priority.Jan 20 2024, 12:49 PM

Something like set policy route PBR rule 1 destination group network-group us such that PBR is able to route towards a GEOIP network group will be awesome. I believe it is available in firewall already.

You can ask on the forum
Close the task as duplicate