To reproduce add firewall with flowtable offload
set firewall flowtable FLOW interface 'eth0' set firewall flowtable FLOW interface 'eth1' set firewall flowtable FLOW interface 'lo' set firewall ipv4 forward filter default-action 'accept' set firewall ipv4 forward filter rule 10 action 'offload' set firewall ipv4 forward filter rule 10 offload-target 'FLOW'
Wait for conntrack entries for forward with offload
vyos@r4:~$ show conntrack table ipv4
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/conntrack.py", line 150, in <module>
res = vyos.opmode.run(sys.modules[__name__])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 263, in run
res = func(**args)
^^^^^^^^^^^^
File "/usr/libexec/vyos/op_mode/conntrack.py", line 137, in show
return get_formatted_output(conntrack_data)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/libexec/vyos/op_mode/conntrack.py", line 115, in get_formatted_output
timeout = meta['timeout']
~~~~^^^^^^^^^^^
KeyError: 'timeout'
vyos@r4:~$
vyos@r4:~$ sudo conntrack -L | grep -i off
udp 17 src=192.0.2.14 dst=1.1.1.1 sport=38006 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=38006 [OFFLOAD] mark=0 use=2
conntrack v1.4.6 (conntrack-tools): 12 flow entries have been shown.
vyos@r4:~$Needs to check the parser
Example for getting entries for parse
vyos@r4:~$ sudo conntrack --dump --family ipv4 --output XML <?xml version="1.0" encoding="utf-8"?> <conntrack> <flow><meta direction="original"><layer3 protonum="2" protoname="ipv4"><src>192.0.2.14</src><dst>34.117.118.44</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>47650</sport><dport>80</dport></layer4></meta><meta direction="reply"><layer3 protonum="2" protoname="ipv4"><src>34.117.118.44</src><dst>192.168.122.14</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>80</sport><dport>47650</dport></layer4></meta><meta direction="independent"><state>TIME_WAIT</state><timeout>114</timeout><mark>0</mark><use>1</use><id>904325086</id><assured/></meta></flow> <flow><meta direction="original"><layer3 protonum="2" protoname="ipv4"><src>192.0.2.14</src><dst>1.1.1.1</dst></layer3><layer4 protonum="17" protoname="udp"><sport>39957</sport><dport>53</dport></layer4></meta><meta direction="reply"><layer3 protonum="2" protoname="ipv4"><src>1.1.1.1</src><dst>192.168.122.14</dst></layer3><layer4 protonum="17" protoname="udp"><sport>53</sport><dport>39957</dport></layer4></meta><meta direction="independent"><mark>0</mark><use>2</use><id>2458037145</id></meta></flow> <flow><meta direction="original"><layer3 protonum="2" protoname="ipv4"><src>192.168.122.14</src><dst>192.168.122.1</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>22</sport><dport>56010</dport></layer4></meta><meta direction="reply"><layer3 protonum="2" protoname="ipv4"><src>192.168.122.1</src><dst>192.168.122.14</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>56010</sport><dport>22</dport></layer4></meta><meta direction="independent"><state>ESTABLISHED</state><timeout>431999</timeout><mark>0</mark><use>1</use><id>931438034</id><assured/></meta></flow> </conntrack> conntrack v1.4.6 (conntrack-tools): 3 flow entries have been shown.