The following commands will commit fine:
set firewall ipv4 forward filter rule 10 action 'jump' set firewall ipv4 forward filter rule 10 jump-target 'chain_1' set firewall ipv4 name chain_1 rule 10 action 'jump' set firewall ipv4 name chain_1 rule 10 jump-target 'chain_2' set firewall ipv4 name chain_2 rule 10 action 'jump' set firewall ipv4 name chain_2 rule 10 jump-target 'chain_3_1' set firewall ipv4 name chain_2 rule 20 action 'jump' set firewall ipv4 name chain_2 rule 20 jump-target 'chain_3_2' set firewall ipv4 name chain_3_1 rule 10 action 'jump' set firewall ipv4 name chain_3_1 rule 10 jump-target 'chain_4' set firewall ipv4 name chain_3_2 set firewall ipv4 name chain_4 default-action 'return' set firewall ipv4 name chain_4 rule 10 action 'accept'
Adding another jump to chain_4 will trigger a "Loop detected in jump-targets:
set firewall ipv4 name chain_3_2 rule 10 action jump set firewall ipv4 name chain_3_2 rule 10 jump-target chain_4
Commit error message:
vyos@vyos# commit [ firewall ] Loop detected in jump-targets, firewall ipv4 name chain_3_1 refers to previously traversed ipv4 name chain_4 [[firewall]] failed Commit failed [edit] vyos@vyos#
Removing one chain layer (chain_3_1 and 3_2) and making multiple rules with jumps to chain_4 seems to work fine.
set firewall ipv4 forward filter rule 10 action 'jump' set firewall ipv4 forward filter rule 10 jump-target 'chain_1' set firewall ipv4 name chain_1 rule 10 action 'jump' set firewall ipv4 name chain_1 rule 10 jump-target 'chain_2' set firewall ipv4 name chain_2 rule 10 action 'jump' set firewall ipv4 name chain_2 rule 10 jump-target 'chain_4' set firewall ipv4 name chain_2 rule 20 action 'jump' set firewall ipv4 name chain_2 rule 20 jump-target 'chain_4' set firewall ipv4 name chain_2 rule 30 action 'jump' set firewall ipv4 name chain_2 rule 30 jump-target 'chain_4' set firewall ipv4 name chain_2 rule 40 action 'jump' set firewall ipv4 name chain_2 rule 40 jump-target 'chain_4' set firewall ipv4 name chain_2 rule 50 action 'jump' set firewall ipv4 name chain_2 rule 50 jump-target 'chain_4' set firewall ipv4 name chain_4 default-action 'return' set firewall ipv4 name chain_4 rule 10 action 'accept'