Page MenuHomeVyOS Platform
Create Task
Maniphest T7414

Conntrack Rule Fails When Using Comma-Separated Ports
Closed, ResolvedPublicBUG
Actions

Description

The commit fails with an error when attempting to configure system conntrack ignore rules in VyOS using a comma-separated list of destination ports.

Steps to reproduce:

set system conntrack ignore ipv4 rule 1 destination address '192.0.2.0/24'
set system conntrack ignore ipv4 rule 1 destination port '500,4500'
set system conntrack ignore ipv4 rule 1 protocol 'udp'
commit

Expected behavior:
The rule should be accepted and applied successfully.

Actual result:
Commit fails with:

vyos@vyos# commit

Failed to apply configuration: /run/nftables-ct.conf:8:59-61: Error:
Basetype of type internet network service is not bitmask         meta
l4proto udp ip daddr  192.0.2.0/24 th dport  500,4500 counter notrack
comment "ignore-1"
^^^

[[system conntrack]] failed
Commit failed
[edit]
vyos@vyos#

But the CLI provides the following suggestion for port configuration:

vyos@vyos# set system conntrack ignore ipv4 rule 1 destination port
Possible completions:
   <text>               Named port (any name in /etc/services, e.g., http)
   <1-65535>            Numeric IP port
   start-end            Numbered port range (e.g. 1001-1005)
   None

Multiple destination ports can be specified as a comma-separated list.
The whole list can also be negated using '!'.
For example: '!22,telnet,http,123,1001-1005'

However, splitting the rule into two separate rules, each with one port (e.g., 500 and 4500), works as expected:

set system conntrack ignore ipv4 rule 1 destination address '192.0.2.0/24'
set system conntrack ignore ipv4 rule 1 destination port '500'
set system conntrack ignore ipv4 rule 1 protocol 'udp'
set system conntrack ignore ipv4 rule 2 destination address '192.0.2.0/24'
set system conntrack ignore ipv4 rule 2 destination port '4500'
set system conntrack ignore ipv4 rule 2 protocol 'udp'
vyos@vyos# set system conntrack ignore ipv4 rule 1 destination address '192.0.2.0/24'
[edit]
vyos@vyos# set system conntrack ignore ipv4 rule 1 destination port '500'
[edit]
vyos@vyos# set system conntrack ignore ipv4 rule 1 protocol 'udp'
[edit]
vyos@vyos# set system conntrack ignore ipv4 rule 2 destination address '192.0.2.0/24'
[edit]
vyos@vyos# set system conntrack ignore ipv4 rule 2 destination port '4500'
[edit]
vyos@vyos# set system conntrack ignore ipv4 rule 2 protocol 'udp'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos#
[edit]

Details

Version
1.4.2
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

a.hajiyev created this task.Apr 30 2025, 7:05 AM
Viacheslav triaged this task as High priority.Apr 30 2025, 7:08 AM
Viacheslav edited projects, added VyOS 1.4 Sagitta (1.4.3), VyOS 1.5 Circinus, VyOS Rolling; removed VyOS 1.4 Sagitta.
pasik subscribed.Apr 30 2025, 7:20 AM
Viacheslav subscribed.EditedApr 30 2025, 7:27 AM

Generated rules:

vyos@r14# cat /run/nftables-ct.conf
#!/usr/sbin/nft -f


delete table ip vyos_conntrack
table ip vyos_conntrack {
    chain VYOS_CT_IGNORE {
        # rule-1 
        meta l4proto udp ip daddr  192.0.2.0/24 th dport  500,4500 counter notrack comment "ignore-1"
         return
    }

Expected: th dport { 500,4500 }
https://github.com/vyos/vyos-1x/blob/b6a43b7810c89c9f3eb2d45771a9ff4be538e010/python/vyos/template.py#L701C1-L707C68

There should be something like this:

if 'port' in side_conf:
    port = side_conf['port']
    operator = ''
    
    if isinstance(port, str) and port.startswith('!'):
        operator = '!='
        port = port[1:]

    # Split port string if it's comma-separated
    if isinstance(port, str) and ',' in port:
        ports = port.split(',')
    elif isinstance(port, list):
        ports = port
    else:
        ports = [port]

    # Format ports properly for nftables
    if len(ports) > 1:
        port_expr = '{' + ', '.join(ports) + '}'
    else:
        port_expr = ports[0]

    output.append(f'th {prefix}port {operator} {port_expr}')
Viacheslav changed the task status from Open to In progress.May 16 2025, 10:27 AM
Viacheslav claimed this task.

PR https://github.com/vyos/vyos-1x/pull/4510

Viacheslav mentioned this in rVYOSONEXea6eff904070: T7414: Fix conntrack ignore rules for using several ports.May 19 2025, 11:05 AM
Restricted Repository Identity mentioned this in rVYOSONEXa99174d0e4a3: Merge pull request #4510 from sever-sever/T7414.May 19 2025, 11:05 AM
Viacheslav closed this task as Resolved.Jun 5 2025, 12:54 PM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
Viacheslav edited projects, added VyOS 1.5 Circinus (1.5-stream-2025-Q2); removed VyOS 1.5 Circinus.
Viacheslav moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.3) board.
Viacheslav moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q2) board.
dmbaturin mentioned this in 1.4.3.Jul 17 2025, 8:18 AM
MattK mentioned this in T7685: WAN load balancing rule fails when using comma-separated ports.Aug 4 2025, 9:58 AM