Page MenuHomeVyOS Platform

nftables: Operation not supported when using match-ipsec in outbound firewall
Closed, ResolvedPublicBUG

Description

Commit fails when trying to use match-ipsec in firewall ipv4 output filter rule

vyos@vyos# commit

Failed to apply firewall: /run/nftables.conf:45:9-38: Error: Could not
process rule: Operation not supported         meta ipsec == 1 counter
accept comment "ipv4-OUT-filter-10"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:46:9-22: Error: Could
not process rule: Operation not supported         counter accept comment
"OUT-filter default-action accept"         ^^^^^^^^^^^^^^
/run/nftables.conf:50:9-62: Error: Could not process rule: Operation not
supported         ip frag-off & 0x3fff != 0 meta mark set 0xffff1 return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[[firewall]] failed
Commit failed

Commands to reproduce:

set firewall ipv4 output filter rule 10 action accept
set firewall ipv4 output filter rule 10 ipsec match-ipsec

This also occurs when jumping to a rule set that contains a match-ipsec.

Details

Difficulty level
Unknown (require assessment)
Version
1.4.0-rc3, 1.5-rolling-202401230024
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

n.fort changed the task status from Open to Confirmed.Jan 23 2024, 10:49 AM

Also, issues with the input

vyos@r4# set firewall ipv4 input filter rule 10 action accept
[edit]
vyos@r4# set firewall ipv4 input filter rule 10 ipsec match-ipsec
[edit]
vyos@r4# 
[edit]
vyos@r4# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:19:17-27: Error: No such
file or directory; did you mean table ‘vyos_filter’ in family ip? delete
table ip vyos_filter                 ^^^^^^^^^^^
/run/nftables.conf:47:18-28: Error: No such file or directory; did you
mean table ‘vyos_filter’ in family ip? delete table ip6 vyos_filter
^^^^^^^^^^^ /run/nftables.conf:75:21-31: Error: No such file or
directory; did you mean table ‘vyos_filter’ in family ip? delete table
bridge vyos_filter                     ^^^^^^^^^^^

[[firewall]] failed
Commit failed
[edit]
vyos@r4#

Update, input fixed with removing /run/nftables*

n.fort changed the task status from Confirmed to In progress.Jan 23 2024, 11:47 AM
n.fort claimed this task.
n.fort added a project: VyOS 1.5 Circinus.
n.fort changed Version from 1.4.0-rc3 to 1.4.0-rc3, 1.5-rolling-202401230024.
n.fort changed Issue type from Unspecified (please specify) to Bug (incorrect behavior).
n.fort changed the task status from In progress to Needs testing.Thu, Feb 1, 10:21 AM