PR https://github.com/vyos/vyos-1x/pull/1333

PR pending approval https://github.com/vyos/vyos-1x/pull/1332

PR fixing exposed errors:
https://github.com/vyos/vyos-1x/pull/1331

I removed my comment as my issue was not a bug AFAIK, but rather a miss-configuration and operation.

Yeah I discovered the same in forums:

I was not aware that the nft implementation changes the kind of how groups are used.
We have implemented a blacklisting approach which heavily relates on using ipset because no one wants to have hundred thousand of addresses in the config file.
So I think this is essential, at least for us.

FRR match always mean logical AND

In T4350#123620, @c-po wrote:

Is the fix for DMVPN hub or spoke?

There is an issue with vrf device for LOCAL direction
Imagine if you have 50 interfaces in one VRF and you want to drop all traffic from one interface for example - eth2 and don't touch other interfaces
You set firewall on eth2 Local - drop all traffic for device vrf and it will be affected to another 49 interfaces as iifname VRF_DEVICE the same

Is the fix for DMVPN hub or spoke?

PR https://github.com/vyos/vyos-1x/pull/1330

set firewall name FOO default-action 'accept'
set firewall name FOO description 'desc'
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 source address '8.8.8.8'
set interfaces ethernet eth0 firewall local name 'FOO'
set interfaces ethernet eth0 vrf 'ONE'
set vrf name ONE table '150'

Check:

table ip filter {
	chain VYOS_FW_LOCAL {
		type filter hook input priority filter; policy accept;
		iifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO
		jump VYOS_POST_FW
	}
...
	chain NAME_FOO {
		ip saddr 8.8.8.8 counter packets 79 bytes 6636 drop comment "FOO-10"
		counter packets 3 bytes 984 return comment "FOO default-action accept"
	}
}

https://github.com/vyos/vyos-utils/commit/5bbda46493d0c11c8a90e50a68c9788a7488345e
https://github.com/vyos/vyos-utils/commit/4aa302a05fad95f3d13eb2ff20bbfee88c32e7ff

@jjakob could you re-check it with new fix?

Draft PR here:
https://github.com/vyos/vyos-1x/pull/1328

PR https://github.com/vyos/vyatta-op-firewall/pull/3

PR https://github.com/vyos/vyatta-op-firewall/pull/3