Page MenuHomeVyOS Platform
Create Task
Maniphest T7781

Firewall chains are created when unnecessary
Open, NormalPublicFEATURE REQUEST
Actions

Description

Currently, if you configure any base section ('ipv4, ipv6, etc..."), it will create all chains for that table. The intention of the nftables.j2 file is to only create the chains if the user defined them:

{%     if ipv4.forward is vyos_defined %}
{%     if ipv4.input is vyos_defined %}
{%     if ipv4.output is vyos_defined %}
....etc

But default-action has a <defaultValue> defined, which always makes those sections present. This can slow down routing functions by forcing "through" traffic to enter a forward hook unnecessarily when the user just wanted to secure VyOS itself (authentication, CoPP, etc...).

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Related Objects

Event Timeline

L0crian created this task.Sep 3 2025, 5:01 PM
L0crian mentioned this in T7475: Make it possible to disable connection tracking for specific firewall chains.
pasik subscribed.Sep 4 2025, 6:28 AM
Unknown Object (User) triaged this task as Normal priority.Sep 5 2025, 8:43 AM
L0crian renamed this task from Firewall chains are created no matter if the user intended to Firewall chains are created when unnecessary.Sep 25 2025, 4:49 PM
L0crian added a comment.Sep 25 2025, 6:17 PM

PR: https://github.com/vyos/vyos-1x/pull/4757

L0crian claimed this task.Sep 25 2025, 6:34 PM
Viacheslav removed L0crian as the assignee of this task.Apr 24 2026, 11:37 AM
Viacheslav assigned this task to jestabro.Apr 24 2026, 11:55 AM
L0crian added a comment.Sat, Aug 22, 10:57 PM

@jestabro

I had a thought about this today, and I think a more immediate fix for this specific issue could simply be replacing these lines in the nftables.j2 templates:

"{%     if ipv4.forward is vyos_defined %}"

With these lines:

"{%     if ipv4.forward is vyos_defined and ((ipv4.forward.filter | length) > 1 or ipv4.forward.filter.default_action == 'drop') %}"

So if someone has anything other than default-action configured, like description, then it will generate that chain. Or if default-action is configured as "drop", as that differs from the <defaultValue> element. But this could maybe be a better fix for this specific issue, and be a better backport candidate if it is deemed so.

Of course the generic solution you're working on is still needed, rather than playing whack-a-mole against unnecessary generated config from the <defaultValue> element.

opswill subscribed.Mon, Aug 24, 3:35 AM
itspngu subscribed.Mon, Aug 24, 6:25 PM