In 1.3, for firewall groups it is used ipset, and it supports character +. But in nftables, present in 1.4, this is not supported
So upgrading from working config in 1.3 results in configuration error in 1.4
For example:
vyos@Equuleus:~$ show config comm | grep firewall set firewall all-ping 'enable' set firewall broadcast-ping 'disable' set firewall config-trap 'disable' set firewall group address-group _MAIN address '10.10.10.10' set firewall group network-group LAN+VLANS network '198.51.100.0/24' set firewall group network-group LAN+VLANS network '192.0.2.0/24' set firewall group network-group LAN+VLANS network '203.0.113.0/24' set firewall group network-group _FOO network '1.1.1.0/24' set firewall group port-group PG_01 port '55' set firewall group port-group PG_01 port '66' set firewall ipv6-receive-redirects 'disable' set firewall ipv6-src-route 'disable' set firewall ip-src-route 'disable' set firewall log-martians 'enable' set firewall name BAR default-action 'drop' set firewall name BAR rule 101 action 'accept' set firewall name BAR rule 101 destination group network-group 'LAN+VLANS' set firewall name BAR rule 101 source group address-group '_MAIN' set firewall name FOO default-action 'drop' set firewall name FOO rule 10 action 'accept' set firewall name FOO rule 10 destination group port-group 'PG_01' set firewall name FOO rule 10 protocol 'tcp' set firewall name FOO+BAR default-action 'drop' set firewall name FOO+BAR rule 10 action 'drop' set firewall receive-redirects 'disable' set firewall send-redirects 'enable' set firewall source-validation 'disable' set firewall syn-cookies 'enable' set firewall twa-hazards-protection 'disable' set interfaces ethernet eth2 firewall in name 'FOO' set interfaces ethernet eth3 firewall in name 'BAR' set interfaces ethernet eth3 firewall out name 'BAR' vyos@Equuleus:~$ sudo ipset -L | grep Name Name: _MAIN Name: PG_01 Name: _FOO Name: LAN+VLANS vyos@Equuleus:~$ vyos@Equuleus:~$ sudo iptables -S | grep "FOO\|BAR" -N BAR -N FOO+BAR -N FOO -A VYATTA_FW_OUT_HOOK -o eth3 -j BAR -A VYATTA_FW_IN_HOOK -i eth3 -j BAR -A VYATTA_FW_IN_HOOK -i eth2 -j FOO -A BAR -m set --match-set _MAIN src -m set --match-set LAN+VLANS dst -m comment --comment BAR-101 -j RETURN -A BAR -m comment --comment "BAR-1000000 default-action drop" -j DROP -A FOO+BAR -m comment --comment "FOO+BAR-10" -j DROP -A FOO+BAR -m comment --comment "FOO+BAR-1000000 default-action drop" -j DROP -A FOO -p tcp -m set --match-set PG_01 dst -m comment --comment FOO-10 -j RETURN -A FOO -m comment --comment "FOO-1000000 default-action drop" -j DROP vyos@Equuleus:~$ And after upgrade to epa2: [ 27.787444] vyos-router[1125]: Waiting for NICs to settle down: settled in 0sec.. [ 31.555061] vyos-router[1125]: Mounting VyOS Config...done. [ 45.263905] vyos-router[1125]: Starting VyOS router: migrate configure failed! [ 46.184097] vyos-config[1131]: Configuration error Welcome to VyOS - Equuleus ttyS0 Equuleus login
Then, loading config, and commit:
vyos@Equuleus:~$ conf
WARNING: There was a config error on boot: saving the configuration now could overwrite data.
You may want to check and reload the boot config
[edit]
vyos@Equuleus# load
Loading configuration from 'config.boot'
Load complete. Use 'commit' to make changes effective.
[edit]
vyos@Equuleus# commit
Failed to apply configuration: /run/nftables-ct.conf:108:14-14: Error:
syntax error, unexpected +, expecting '{' set N_LAN+VLANS {
^ /run/nftables-ct.conf:109:9-12: Error: syntax error, unexpected type
type ipv4_addr ^^^^ /run/nftables-ct.conf:110:15-22: Error:
syntax error, unexpected interval, expecting string flags
interval ^^^^^^^^ /run/nftables-ct.conf:111:9-18: Error:
syntax error, unexpected auto-merge auto-merge
^^^^^^^^^^ /run/nftables-ct.conf:112:9-16: Error: syntax error,
unexpected elements elements = { 198.51.100.0/24 }
^^^^^^^^ /run/nftables-ct.conf:114:16-16: Error: syntax error,
unexpected '{', expecting string or last set N__FOO {
^ /run/nftables-ct.conf:115:9-12: Error: syntax error, unexpected type
type ipv4_addr ^^^^ /run/nftables-ct.conf:116:9-13: Error:
syntax error, unexpected flags flags interval ^^^^^
/run/nftables-ct.conf:117:9-18: Error: syntax error, unexpected auto-
merge auto-merge ^^^^^^^^^^ /run/nftables-
ct.conf:118:9-16: Error: syntax error, unexpected elements
elements = { 1.1.1.0/24 } ^^^^^^^^
[[system conntrack]] failed
[ firewall group address-group _MAIN ]
[ firewall group address-group _MAIN ]
Invalid value
[[firewall]] failed
Commit failed
[edit]
vyos@Equuleus#