PR removes the empty line when there are no group members, also adds a warning message when empty groups are used in rules.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed Advanced Search
Advanced Search
Advanced Search
Jan 11 2022
Jan 11 2022
sarthurdev changed the status of T4159: Empty firewall group (address, network & port) generates invalid nftables config, commit fails, a subtask of T2199: Rewrite firewall in new XML/Python style, from Open to Needs testing.
sarthurdev changed the status of T4159: Empty firewall group (address, network & port) generates invalid nftables config, commit fails from Open to Needs testing.
sarthurdev changed the status of T4131: Show firewall group incorrect format members from Open to Needs testing.
@Viacheslav Not using exact ipset format, however addresses are sorted and output one per line.
sarthurdev changed the status of T4144: Firewall address-group - Improve error messages from In progress to Needs testing.
Should resolve the rest of the error messages.
Jan 10 2022
Jan 10 2022
sarthurdev changed the status of T4144: Firewall address-group - Improve error messages from Open to In progress.
IPv4 address range error messages are included in PR: https://github.com/vyos/vyos-1x/pull/1152
sarthurdev changed the status of T4148: Firewall - Error messages not that clear as it were in old firewall from Open to Needs testing.
Error for rule being in use when deleting base node was fixed in https://github.com/vyos/vyos-1x/pull/1151
sarthurdev changed the status of T4137: Firewall group configuration allows to set incorrect port range and invalid port from Open to Needs testing.
sarthurdev changed the status of T4149: [Firewall-IPV6] Error delete Fw rules on VIF/INT from In progress to Needs testing.
sarthurdev changed the status of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases , a subtask of T2199: Rewrite firewall in new XML/Python style, from Open to Needs testing.
sarthurdev changed the status of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases from Open to Needs testing.
Thanks for catching that!
sarthurdev changed the status of T4149: [Firewall-IPV6] Error delete Fw rules on VIF/INT from Open to In progress.
Jan 6 2022
Jan 6 2022
sarthurdev moved T4133: Firewall network group error with zone-based firewall rules from Need Triage to In Progress on the VyOS 1.4 Sagitta board.
sarthurdev moved T4145: Conntrack table not showing after firewall rewriting from Need Triage to In Progress on the VyOS 1.4 Sagitta board.
Updates the vyatta-conntrack package to work without legacy firewall and fixes the op-mode commands. Should also fix some conntrack functionality (untested).
Jan 5 2022
Jan 5 2022
sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from In progress to Needs testing.
sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from Open to In progress.
sarthurdev changed the status of T3635: Add ability to use mDNS repeater with VRRP from In progress to Needs testing.
sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from In progress to Needs testing.
sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from Open to In progress.
Jan 4 2022
Jan 4 2022
Duplicate of T4130
sarthurdev changed the status of T4130: Firewall state policy errors chain from In progress to Needs testing.
Jan 3 2022
Jan 3 2022
sarthurdev changed the status of T4130: Firewall state policy errors chain from Open to In progress.
Nov 4 2021
Nov 4 2021
sarthurdev changed the status of T3970: Add support for op-mode PKI direct install into an active config session, a subtask of T3642: PKI configuration, from Open to In progress.
sarthurdev changed the status of T3970: Add support for op-mode PKI direct install into an active config session from Open to In progress.
Nov 3 2021
Nov 3 2021
Oct 31 2021
Oct 31 2021
Included this feature in the firewall/zone-policy rewrite: https://github.com/vyos/vyos-1x/pull/1033
Oct 20 2021
Oct 20 2021
Oct 19 2021
Oct 19 2021
sarthurdev changed the status of T3917: Use Avahi as mDNS repeater for IPv6 support from Open to In progress.
Sep 24 2021
Sep 24 2021
Sep 14 2021
Sep 14 2021
sarthurdev added a comment to T3828: ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta.
Good shout, fixed in following PR: https://github.com/vyos/vyos-1x/pull/1005
Sep 13 2021
Sep 13 2021
Aug 13 2021
Aug 13 2021
sarthurdev changed the status of T3752: generate pki certificate file xxx doesn't touch file from Open to Needs testing.
Aug 10 2021
Aug 10 2021
Jul 22 2021
Jul 22 2021
sarthurdev changed the status of T3642: PKI configuration, a subtask of T2799: VyOS Certificates Manager, from In progress to Needs testing.
Jul 21 2021
Jul 21 2021
Jul 20 2021
Jul 20 2021
Jul 19 2021
Jul 19 2021
PKI Wireguard PR: https://github.com/vyos/vyos-1x/pull/929
Jul 16 2021
Jul 16 2021
Jul 13 2021
Jul 13 2021
sarthurdev added a comment to T3678: VyOS 1.4: Invalid error message while deleting ipsec vpn configuration.
This error occurs because the ipsec module blindly updates the l2tp module after a commit change to ensure any l2tp via ipsec config is then refreshed also.
Jul 7 2021
Jul 7 2021
vpn rsa-keys migrated: https://github.com/vyos/vyos-1x/pull/912
Jul 2 2021
Jul 2 2021
sarthurdev changed the status of T3659: Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors from In progress to Needs testing.
sarthurdev added a comment to T3656: IPSec 1.4 : "show vpn ike sa" does not show the correct default ike version.
Should be resolved in PR: https://github.com/vyos/vyos-1x/pull/903
sarthurdev added a comment to T3659: Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors.
Fixed in PR: https://github.com/vyos/vyos-1x/pull/903
sarthurdev changed the status of T3659: Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors from Open to In progress.
Jun 29 2021
Jun 29 2021
PR is in: https://github.com/vyos/vyos-1x/pull/901
sarthurdev changed the status of T3642: PKI configuration, a subtask of T2799: VyOS Certificates Manager, from Open to In progress.
I should soon have a PR ready for this, including an update to IPSec config to show how to port existing configs to use PKI.
Jun 26 2021
Jun 26 2021
When using show pki ... commands you would be able to see the relation between certificates and CAs.
Jun 22 2021
Jun 22 2021
@SrividyaA Fixed in PR https://github.com/vyos/vyos-1x/pull/894
Jun 21 2021
Jun 21 2021
Jun 19 2021
Jun 19 2021
sarthurdev changed the status of T3635: Add ability to use mDNS repeater with VRRP from Open to In progress.
Jun 17 2021
Jun 17 2021
@SrividyaA Fixed in PR: https://github.com/vyos/vyos-1x/pull/884
Jun 15 2021
Jun 15 2021
Swanctl migration PR: https://github.com/vyos/vyos-1x/pull/881
Jun 12 2021
Jun 12 2021
Jun 11 2021
Jun 11 2021
Included in PR: https://github.com/vyos/vyos-1x/pull/881
I've left vti esp-group to keep backwards compatibility with current behaviour when vti is configured without any tunnels (when it uses 0.0.0.0/0), in that scenario it would still use the group specified.
I wonder if instead it should just use the existing tunnel node for this. So if VTI is set on a peer, all configured tunnels get marked for the VTI interface. Current VyOS behaviour allows only for tunnels, or VTI - not both.
@krox2 Oh I think I understand what you mean. You'd want to also be able to create multiple child SAs each with unique left/right subnets?
Jun 10 2021
Jun 10 2021
Jun 7 2021
Jun 7 2021
sarthurdev added a comment to T3588: IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan.
Clarifying as requested by c-po:
Jun 4 2021
Jun 4 2021
sarthurdev changed the status of T3599: Migrate NHRP to XML/Python from In progress to Needs testing.
Jun 3 2021
Jun 3 2021
Jun 1 2021
Jun 1 2021
sarthurdev changed the status of T3594: Disable by default service strongswan-starter, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Open to In progress.
sarthurdev changed the status of T3594: Disable by default service strongswan-starter from Open to In progress.
May 30 2021
May 30 2021
sarthurdev added a comment to T3588: IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan.
Also vpn ipsec site-to-site peer x tunnel x allow-nat-networks and vpn ipsec site-to-site peer x tunnel x allow-public-networks
May 28 2021
May 28 2021
sarthurdev changed the status of T3585: Fix NHRP module for updated interfaces tunnel syntax from Open to In progress.
May 27 2021
May 27 2021
IPSec / DMVPN PR: https://github.com/vyos/vyos-1x/pull/856
May 24 2021
May 24 2021
The main issue seems to be a lack of execute permissions on the script vyatta-gen-x509-keypair
May 22 2021
May 22 2021
sarthurdev changed the status of T3570: Prevent setting of a larger MTU on child interfaces from Open to In progress.
May 12 2021
May 12 2021