Flowtable couldn't enable with zone-based-firewall at VyOS 1.5 rolling 2026.03.09-0026 and VyOS 2026.03(stream)
The error message differs between the first commit attempt after boot and subsequent commit attempts.
I also tried deleting and recreating the firewall rules, but the behavior is the same.
version info
・VyOS 1.5 rolling
vyos@vyos:~$ show version Version: VyOS 2026.03.09-0026-rolling Release train: current Release flavor: generic Built by: autobuild@vyos.net Built on: Mon 09 Mar 2026 00:27 UTC Build UUID: 834eecd2-208b-4429-9371-eb3d2b2a473a Build commit ID: fbdce6466748fd Architecture: x86_64 Boot via: installed image System type: bare metal Secure Boot: disabled Hardware vendor: Dell Inc. Hardware model: OptiPlex 3070 Hardware S/N: ******* Hardware UUID: ********-****-****-****-************ Copyright: VyOS maintainers and contributors
・VyOS 1.5 stream(2026.03)
vyos@vyos:~$ show ver Version: VyOS 2026.03 Release train: circinus Release flavor: generic Built by: autobuild@vyos.net Built on: Wed 18 Mar 2026 20:03 UTC Build UUID: 3969e1c7-a4bb-459a-ac7f-54749c153d21 Build commit ID: 1cac4fd63750b0 Architecture: x86_64 Boot via: installed image System type: bare metal Hardware vendor: Dell Inc. Hardware model: OptiPlex 3070 Hardware S/N: ******* Hardware UUID: ********-****-****-****-************ Copyright: VyOS maintainers and contributors
・lspci
vyos@vyos:~$ lspci 00:00.0 Host bridge: Intel Corporation 8th Gen Core Processor Host Bridge/DRAM Registers (rev 07) 00:01.0 PCI bridge: Intel Corporation 6th-10th Gen Core Processor PCIe Controller (x16) (rev 07) 00:02.0 VGA compatible controller: Intel Corporation CoffeeLake-S GT2 [UHD Graphics 630] 00:08.0 System peripheral: Intel Corporation Xeon E3-1200 v5/v6 / E3-1500 v5 / 6th/7th/8th Gen Core Processor Gaussian Mixture Model 00:12.0 Signal processing controller: Intel Corporation Cannon Lake PCH Thermal Controller (rev 10) 00:14.0 USB controller: Intel Corporation Cannon Lake PCH USB 3.1 xHCI Host Controller (rev 10) 00:14.2 RAM memory: Intel Corporation Cannon Lake PCH Shared SRAM (rev 10) 00:16.0 Communication controller: Intel Corporation Cannon Lake PCH HECI Controller (rev 10) 00:17.0 SATA controller: Intel Corporation Cannon Lake PCH SATA AHCI Controller (rev 10) 00:1c.0 PCI bridge: Intel Corporation Cannon Lake PCH PCI Express Root Port #5 (rev f0) 00:1f.0 ISA bridge: Intel Corporation H370 Chipset LPC/eSPI Controller (rev 10) 00:1f.3 Audio device: Intel Corporation Cannon Lake PCH cAVS (rev 10) 00:1f.4 SMBus: Intel Corporation Cannon Lake PCH SMBus Controller (rev 10) 00:1f.5 Serial bus controller: Intel Corporation Cannon Lake PCH SPI Controller (rev 10) 01:00.0 Ethernet controller: Mellanox Technologies MT27710 Family [ConnectX-4 Lx] 01:00.1 Ethernet controller: Mellanox Technologies MT27710 Family [ConnectX-4 Lx] 02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15) vyos@vyos:~$
Below are the steps I followed in my configuration:
1, Configure the flowtable.
set firewall flowtable FT interface ‘eth0’ set firewall flowtable FT interface ‘eth1’ set firewall flowtable FT interface ‘pppoe0’ set firewall flowtable FT offload ‘software’
2, Define the zone-based firewall rules.
*At this stage, I mistakenly assumed that the offload rule should use action accept. set firewall ipv4 name Any-WAN-v4 default-action ‘accept’ set firewall ipv4 name Any-WAN-v4 rule 10 action ‘accept’ set firewall ipv4 name Any-WAN-v4 rule 10 offload-target ‘FT’ set firewall ipv4 name Any-WAN-v4 rule 10 state ‘established’ set firewall ipv4 name Any-WAN-v4 rule 10 state ‘related’ set firewall ipv4 name Any-WAN-v4 rule 20 action ‘accept’ set firewall ipv4 name Any-WAN-v4 rule 20 state ‘established’ set firewall ipv4 name Any-WAN-v4 rule 20 state ‘related’ set firewall ipv4 name Any-WAN-v4 rule 30 action ‘drop’ set firewall ipv4 name Any-WAN-v4 rule 30 state ‘invalid’
3, Apply the zone-based firewall rules.
set firewall zone private default-action ‘drop’ set firewall zone private from vyos firewall ipv6-name ‘VYOS-Any-v6’ set firewall zone private from vyos firewall name ‘VYOS-Private-v4’ set firewall zone private from wan firewall ipv6-name ‘WAN-Any-v6’ set firewall zone private from wan firewall name ‘WAN-Any-v4’ set firewall zone private member interface ‘eth1’ set firewall zone server-local default-action ‘drop’ set firewall zone server-local from vyos firewall ipv6-name ‘VYOS-Any-v6’ set firewall zone server-local from wan firewall ipv6-name ‘WAN-Any-v6’ set firewall zone server-local from wan firewall name ‘WAN-Any-v4’ set firewall zone server-local member interface ‘eth1.10’ set firewall zone vyos default-action ‘drop’ set firewall zone vyos from private firewall ipv6-name ‘Private-Any-v6’ set firewall zone vyos from private firewall name ‘Private-Any-v4’ set firewall zone vyos from wan firewall ipv6-name ‘WAN-VYOS-v6’ set firewall zone vyos from wan firewall name ‘WAN-Any-v4’ set firewall zone vyos local-zone set firewall zone wan default-action ‘drop’ set firewall zone wan from private firewall ipv6-name ‘Any-WAN-v6’ set firewall zone wan from private firewall name ‘Any-WAN-v4’ set firewall zone wan from server-local firewall ipv6-name ‘Any-WAN-v6’ set firewall zone wan from server-local firewall name ‘Any-WAN-v4’ set firewall zone wan from vyos firewall ipv6-name ‘Any-WAN-v6’ set firewall zone wan from vyos firewall name ‘Any-WAN-v4’ set firewall zone wan member interface ‘pppoe0’ set firewall zone wan member interface ‘eth0’
4, Attempted to change rule number 10 in each zone-based firewall rule from accept to offload.
vyos@vyos:~$ configure [edit] vyos@vyos# set firewall ipv4 name Any-WAN-v4 rule 10 action 'offload' [edit] vyos@vyos# set firewall ipv4 name Any-WAN-v4 rule 10 offload-target 'FT' Configuration path: [firewall ipv4 name Any-WAN-v4 rule 10 offload-target FT] already exists
First commit attempt in VyOS 1.5 rolling
[edit]
vyos@vyos# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:139:9-64: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:140:17-35: Error: Could not process rule: Operation
not supported oifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:140:9-50: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter return ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:141:9-20: Error: Could not process rule: Operation
not supported counter drop comment "zone_vyos default-action
drop" ^^^^^^^^^^^^ /run/nftables.conf:144:17-35: Error: Could
not process rule: Operation not supported iifname {
"pppoe0","eth0" } counter return ^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:144:9-50: Error: Could not process rule: Operation
not supported iifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:145:9-55:
Error: Could not process rule: Operation not supported iifname {
"eth1" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:146:9-41: Error: Could not process rule: Operation
not supported iifname { "eth1" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:147:9-58: Error:
Could not process rule: Operation not supported iifname {
"eth1.10" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:148:9-44: Error: Could not process rule: Operation
not supported iifname { "eth1.10" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:149:9-20: Error:
Could not process rule: Operation not supported counter drop
comment "zone_wan default-action drop" ^^^^^^^^^^^^
[[firewall]] failed
Commit failed
[edit]
vyos@vyos#Second and later attemptsin VyOS 1.5 rolling
[edit]
vyos@vyos# commit
[ firewall ]
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script
script.apply(c)
File "/usr/libexec/vyos/conf_mode/firewall.py", line 697, in apply
parse_firewall_error(output.decode())
File "/usr/libexec/vyos/conf_mode/firewall.py", line 685, in parse_firewall_error
error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
^^^^^
UnboundLocalError: cannot access local variable 'chain' where it is not associated with a value
[[firewall]] failed
Commit failed
[edit]
vyos@vyos#First commit attempt in VyOS 1.5 2026.03(stream)
[edit]
vyos@vyos# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:137:9-64: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:138:17-35: Error: Could not process rule: Operation
not supported oifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:138:9-50: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter return ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:139:9-20: Error: Could not process rule: Operation
not supported counter drop comment "zone_vyos default-action
drop" ^^^^^^^^^^^^ /run/nftables.conf:142:17-35: Error: Could
not process rule: Operation not supported iifname {
"pppoe0","eth0" } counter return ^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:142:9-50: Error: Could not process rule: Operation
not supported iifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:143:9-55:
Error: Could not process rule: Operation not supported iifname {
"eth1" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:144:9-41: Error: Could not process rule: Operation
not supported iifname { "eth1" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:145:9-58: Error:
Could not process rule: Operation not supported iifname {
"eth1.10" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:146:9-44: Error: Could not process rule: Operation
not supported iifname { "eth1.10" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:147:9-20: Error:
Could not process rule: Operation not supported counter drop
comment "zone_wan default-action drop" ^^^^^^^^^^^^
[[firewall]] failed
Commit failedSecond and later attemptsin VyOS 1.5 2026.03(stream)
[edit]
vyos@vyos# commit
[ firewall ]
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script
script.apply(c)
File "/usr/libexec/vyos//conf_mode/firewall.py", line 640, in apply
parse_firewall_error(output.decode())
File "/usr/libexec/vyos//conf_mode/firewall.py", line 628, in parse_firewall_error
error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
^^^^^
UnboundLocalError: cannot access local variable 'chain' where it is not associated with a value
[[firewall]] failed
Commit failed