VyOS 1.4-rolling-202201041316 - works well.

Ran some quick tests with current vyos installed in a VM and a client ubuntu server VM hooked up to it - since this is all internal stuff it is a double NAT scenario with the vyos external IP allocated out of 192.168.x.x space and using 10.100.100.0/24 internally for the client ubuntu VM.

@jack9603301 Could you test it, also create a pr for the documentation?

PR https://github.com/vyos/vyos-1x/pull/1207

@jestabro you are right. Adding no_tag_node_value_mangle=True will fix this issue.
https://github.com/vyos/vyos-1x/blob/ec13cac66ba612ecc36053158c7517c8fe993547/src/system/keepalived-fifo.py#L73-L74

self.vrrp_config_dict = conf.get_config_dict(base,
                                     key_mangling=('-', '_'), get_first_key=True,
                                     no_tag_node_value_mangle=True)

Found the problem here - I used a different and simpler version of the configuration above and *show openvpn server* returns an output when a client is connected.

PR: https://github.com/vyos/vyos-1x/pull/1206

https://github.com/vyos/vyos-1x/pull/1205

Thanks - works again

PR: https://github.com/vyos/vyos-1x/pull/1201

Adding this issue to this task: https://forum.vyos.io/t/firewall-configuration-issue-after-upgrade/8414

PR https://github.com/vyos/vyos-1x/pull/1200
Fix for telegraf template/scripts for services.

I've used for these tests (VyOS 1.4-rolling-202202010836)
The same situation in general when you want to use "!".
Bad exampels.

set nat source rule 10 destination port !1-5
set nat source rule 10 destination port !22
set nat source rule 10 destination port !http
set nat source rule 10 destination port telnet,!http,!123,1001-1005
set nat source rule 10 destination port telnet,http,!123,1001-1005

( VyOS 1.4-rolling-202202010836)- Rule name which starts with a number work well.

docs: https://github.com/vyos/vyos-documentation/pull/707

I have found the following links:

tested my previous code in latest rolling, looking good so far.
no errors on commiting.

Is there any Linux implementation?

reverted broken commit

reverted commit

Confirm
VyOS 1.4-rolling-202201291849

My hunch would be that this is the breaking commit, given the context:

PR: https://github.com/vyos/vyos-1x/pull/1199

PR: https://github.com/vyos/vyos-1x/pull/1199

The same situation if you set the number or special symbol.

PR: https://github.com/vyos/vyos-1x/pull/1196

PR: https://github.com/vyos/vyos-1x/pull/1195

Good question. I missed this moment.
So, if you want to reload in some minutes, VYOS offered you two variants:

1. To choose between 1 and 99
2. To set time when you want to reload VYOS if 99 minutes too short for you (for example 10:00, 12:45, 23:59, and so on)

But descriptions of thees command doesn't have enough information about it.

I've actually found a way to define this properly, resulting rule now looks like below:

tcp dport { 22 } add @FOO_30 { ip saddr limit rate over 4/minute burst 4 packets } counter packets 3 bytes 156 reject comment "FOO-30"
ct state { new } tcp dport { 22 } counter packets 5 bytes 260 return comment "FOO-40"

I agree with @johannrichard, having recent "change" behavior is probably going to cause some confusion.

I‘m no expert here nor extremely strong opiniated. My thoughts though: if theres no exact equivalent, why try to re-implement the recent functionality with nftables at „all“ cost?

Why is it 1-99?
If I want to reboot the router in 1500 min?

Hi again, I found another bug, if I have two policy routes with the same table it tries to create the table twice, and it doesn't work because the table is already created:

We didn't receive the customer's request.
The timers work without problems.
I'll open a design request to see the range 1-99.

Good to hear, going to mark this as resolved.

Hi,
I applied your new policy-route.py manually, and now my ipv6 pbr works again!! Thanks a lot!

PR: https://github.com/vyos/vyos-1x/pull/1194

In T4209#117579, @thomasjsn wrote:

In T4209#117429, @sdev wrote:

Would changing the guide to use limit rate 4/minute achieve the same target functionality?

What is the practical difference between limit rate and recent? Is it just two different ways of accomplishing the same?

In T4209#117429, @sdev wrote:

Would changing the guide to use limit rate 4/minute achieve the same target functionality?

I've come up with a working idea how to implement but would like feedback before submitting a PR.

Thanks for the report, I believe I know what's caused it to break. Hopefully will have a fix in for the build tomorrow.