Could someone make another evaluation of the code being used for source-validation both at firewall global-options but also individually per interface?
From my post at the forum:
To me that looks at bit odd.
Because first we have this (firewall) who acts on vyos_global_rpfilter:
If loose than add this line, else if strict than add that line, else do nothing.
But then we also have this (interface) that acts on vyos_rpfilter iifname:
And not only that they seem to be independent as in will do double work but also for example at global doing loose for all traffic and at the same time doing strict for a specific interface will result in two checks being performed first loose and then in another chain strict?
But also that the logic as I interpret it seems a bit bogus in the interface code?
Its like:
if mode strict or loose then do nothing, else if mode strict add this line, else if mode loose add that line.
So like the two else if’s will never be reached or will they?