I only see one solution - exclude mirror node from interface and add it as a separate option/service
set service redirect|port-mirror <x> source tunX set service redirect|port-mirror <x> destination tunY
As tc filter applied for every interface step by step and in this case (adding tun0) we don't have tun1 yet
To reproduce:
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1410
Similar task T3810 points 5, 8
PR https://github.com/vyos/vyos-1x/pull/1407
vyos@r14# run show conntrack table ipv4 Id Original src Original dst Reply src Reply dst Protocol State Timeout Mark Zone ---------- ------------------- ----------------- ----------------- ------------------- ---------- ----------- --------- ------ ------ 3529842617 192.168.122.1:53508 192.168.122.14:22 192.168.122.14:22 192.168.122.1:53508 tcp ESTABLISHED 431999 0 4102830655 192.0.2.10 1.0.0.1 1.0.0.1 192.168.122.14 icmp 18 0 59651 179791316 192.0.2.10 1.1.1.1 1.1.1.1 192.168.122.14 icmp 12 0 59651 [edit] vyos@r14#
The same task T4511
@raphielscape Could you re-test it?
vyos@r14# set interfaces ethernet eth0 ip adjust-mss Possible completions: clamp-mss-to-pmtu Automatically sets the MSS to the proper value <500-65535> TCP Maximum segment size in bytes
Fixed
S>* 0.0.0.0/0 [210/0] via 192.0.2.1, eth1, weight 1, 00:02:31 C>* 192.0.2.0/24 is directly connected, eth1, 00:02:31 C>* 192.168.122.0/24 is directly connected, eth0, 00:04:09
You can get duid data from python
https://github.com/vyos/vyos-1x/blob/44b1bdd3273dce4e74a5474c401ac7107950635b/src/op_mode/show_dhcpv6.py#L95-L97
Replace format_hex_string(lease.host_identifier_string) to `lease.duid
and lease_display_fields['iaid_duid'] = 'IAID_DUID'
https://github.com/vyos/vyos-1x/blob/44b1bdd3273dce4e74a5474c401ac7107950635b/src/op_mode/show_dhcpv6.py#L44
As we have the 1.3 LTS release (where it is fixed) I propose to close it.
It is a big change for 1.2 that we should avoid.
Output plugins that we use in 1.4
"github.com/influxdata/telegraf/plugins/outputs/azure_data_explorer" "github.com/influxdata/telegraf/plugins/outputs/influxdb_v2" "github.com/influxdata/telegraf/plugins/outputs/prometheus_client" "github.com/influxdata/telegraf/plugins/outputs/http"
I re-created a new VM and it is Not reproducing
I closed it
Interface virtio
vyos@r1# run show interfaces ethernet eth1 physical
Settings for eth1:
Supported ports: [ ]
Supported link modes: Not reported
Supported pause frame use: No
Supports auto-negotiation: No
Supported FEC modes: Not reported
Advertised link modes: Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: Unknown!
Duplex: Unknown! (255)
Port: Other
PHYAD: 0
Transceiver: internal
Auto-negotiation: off
Link detected: yes
Ring parameters for eth1:
Pre-set maximums:
RX: 256
RX Mini: 0
RX Jumbo: 0
TX: 256
Current hardware settings:
RX: 256
RX Mini: 0
RX Jumbo: 0
TX: 256In T3933#124952, @sandwichdoge wrote:@Viacheslav I tested your fix in my environment. The inbound filtering worked as expected after the fix. However it did not work correctly for the case we where we want both inbound and outbound firewalls on a single vrf member interface (or any case that has more than 2 directions on the same interface).
table ip filter { chain VYOS_FW_LOCAL { type filter hook input priority filter; policy accept; oifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO # <<< Problem here, oifname should be eth0, not vrf name iifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO jump VYOS_POST_FW } ... chain NAME_FOO { ip saddr 8.8.8.8 counter packets 79 bytes 6636 drop comment "FOO-10" counter packets 3 bytes 984 return comment "FOO default-action accept" } }
@a.apostoliuk Could you create PR for 1.3?
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392
PR https://github.com/vyos/vyos-1x/pull/1389
set service dns forwarding dns64-prefix 2001:db8:aabc::/96
@dsummers Could you provide an example of VyOS configuration and an example of what you add?
Bug of testing
I tested commit_in_progress instead of commit_in_progress()