Page MenuHomeVyOS Platform

Vyatta firewall service (vyatta-router.service) times out with zone-based policies
Closed, ResolvedPublicBUG

Description

It's a known issue that, due to Vyatta cruft while building firewall policies, the initial loading of zone-based firewall policies takes a long time. The transition from Sys-V to systemd has brought with it a startup timeout of 5 minutes to vyatta-router.service:

TimeoutSec=5min

In order for this service to have time to fully come up under non-ideal conditions, e.g. zone-based firewalls and/or less powerful hardware, this value should probably be increased to 15 minutes or more:

TimeoutSec=20min

Obviously on systems with simple policies no actual time will be added to the startup process, but on others with more complex policies there will be enough time allotted to allow the service to fully start.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0-rc2
Why the issue appeared?
Will be filled on close

Event Timeline

Do you experience this now? How many rules / what hardware may I ask?
edit: Not trying to undermine your request for this change, just to get an idea at which point it becomes a problem with the current setting to estimate whether we need to address the root-cause urgently.

Do you experience this now? How many rules / what hardware may I ask?

Yes, unfortunately. 8 zones, 74 rules. Atom D525.

syncer triaged this task as Normal priority.Oct 14 2018, 7:09 PM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc4); removed VyOS 1.2 Crux.

With less powerfull hardware (as this Atom D525) I'm fine with this change request.

Please note it's a timeout - if you have more powerful hardware you don't see any behavioral changes - only on slow hardware it will become better (in - not crashing).