Page MenuHomeVyOS Platform

Firewall chains are created when unnecessary
Open, NormalPublicFEATURE REQUEST

Description

Currently, if you configure any base section ('ipv4, ipv6, etc..."), it will create all chains for that table. The intention of the nftables.j2 file is to only create the chains if the user defined them:

{%     if ipv4.forward is vyos_defined %}
{%     if ipv4.input is vyos_defined %}
{%     if ipv4.output is vyos_defined %}
....etc

But default-action has a <defaultValue> defined, which always makes those sections present. This can slow down routing functions by forcing "through" traffic to enter a forward hook unnecessarily when the user just wanted to secure VyOS itself (authentication, CoPP, etc...).

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)