Page MenuHomeVyOS Platform

Firewall: Support combined ipv4&6 rules using netfilter family inet
Open, WishlistPublicFEATURE REQUEST


It would be very useful to be able to combine ipv4 & ipv6 rules into one ruleset. Nftables has support for this using the inet-family.

Support for this would considerably simplify firewall rules in a dual-stack environment.
This/similar functionality has also been requested in the forums a few times: 1 2

I don't think any automated configuration migrations would be necessary. Instead (like nftables) all variants should be supported (ipv4/ipv6/inet).
However, perhaps it may be possible to simplify manual migration from a ipv4/ipv6 based rules set to a common inet based ruleset. Maybe of some sort of rename or copy of ipv4/ipv6 based rulesets to inet based rules may be possible. Not sure how one would handle rule number collisions though.


Difficulty level
Unknown (require assessment)
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)