Page MenuHomeVyOS Platform

Commit fails to apply configuration: /run/nftables-ct.conf on conntrack timeout rule removal
Closed, ResolvedPublicBUG

Description

Remove conntrack custom timeout rule:

delete system conntrack timeout custom ipv4 rule 1 destination port '53'
delete system conntrack timeout custom ipv4 rule 1 protocol udp replied '700'

commit fails:

vyos@vyos# commit
[ system conntrack ]
Failed to apply configuration: /run/nftables-ct.conf:20:21-21: Error:
syntax error, unexpected '}', expecting string     policy = { }

/run/nftables-ct.conf:

vyos@vyos# cat /run/nftables-ct.conf
#!/usr/sbin/nft -f


delete table ip vyos_conntrack
table ip vyos_conntrack {
    chain VYOS_CT_IGNORE {
         return
    }
    chain VYOS_CT_TIMEOUT {
        # rule-1 
        meta l4proto udp counter ct timeout set ct-timeout-1 comment "timeout-1"
        return
    }

    ct timeout ct-timeout-1 {
        l3proto ip;
        protocol udp;
        policy = {  }
    }
...

Steps to reproduce:

set system conntrack timeout custom ipv4 rule 1 destination port '53'
set system conntrack timeout custom ipv4 rule 1 protocol udp replied '700'
commit
delete system conntrack timeout custom ipv4 rule 1 destination port '53'
delete system conntrack timeout custom ipv4 rule 1 protocol udp replied '700'
commit

Details

Version
vyos-2025.08.18-0022-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

Unknown Object (User) triaged this task as Normal priority.Aug 13 2025, 7:16 AM
a.kudientsov changed Version from VyOS 2025.08.02-0020-rolling to vyos-2025.08.18-0022-rolling.
Viacheslav changed the task status from Open to In progress.Sep 11 2025, 12:45 AM
Viacheslav assigned this task to ryanzuwala.
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
Viacheslav moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.
Viacheslav moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.4) board.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.