It is highly desirable to reflect this feature in the documentation
Now it is not clear how to configure and use it

For 1.4 was implemented in T3834

+1 for @Viacheslav proposal.

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1583

I believe the ISC DHCP is now officially deprecated and EOLed:

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1582

PR https://github.com/vyos/vyos-1x/pull/1579

set service dns dynamic interface eth2 ipv6-enable
set service dns dynamic interface eth2 service dynv6 host-name 'xxx.dynv6.net'
set service dns dynamic interface eth2 service dynv6 login 'none'
set service dns dynamic interface eth2 service dynv6 password 'passWorD'
set service dns dynamic interface eth2 service dynv6 protocol 'dyndns2'
set service dns dynamic interface eth2 service dynv6 server 'dynv6.com'

PR https://github.com/vyos/vyos-1x/pull/1576

@pasik you can build your own image: https://github.com/vyos/vyos-build/compare/equuleus...fvlaicu:vyos-build:equuleus-1.3.2

It'd be nice to get a newer igc driver version in 1.3 branch though, as there are now multiple good 2.5 GbE based platforms out there..

Yes, and no updates for the driver in 1.3.2. Ok, thanks!

@pasik the problem is with the igc driver in the 5.4 kernel, not with vyos.

So hmm, is it still the same issue in stock vyos 1.3.2 with i225 nics?

It seems like I was wrong about the netfilter rule not working as intended (and in my testing the clamp was broken for some other reason that was an error on my part), the post has been edited to only indicate the remaining issue of an overly strict MSS clamping range.

See https://unix.stackexchange.com/questions/672742/why-mss-clamping-in-iptables-nft-seems-to-take-no-effect-in-nftables for additional explanation why the iptables version do not work under iptables-nft.

Relevant PRs:

PR for VyOS 1.3.3 https://github.com/vyos/vyos-1x/pull/1548

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1539

Fix for 1.3 https://github.com/vyos/vyos-build/pull/261

It should be possible in https://github.com/vyos/vyos-1x/pull/1534 T2199

set firewall interface ethXvX

Refactor PR: https://github.com/vyos/vyos-1x/pull/1534

Should be fixed in https://github.com/vyos/vyatta-cfg-firewall/pull/34

In T1185#133944, @sdev wrote:

A similar syntax change is in progress as part of a larger firewall refactor. It should reach the 1.4 branch in a week or so. It should allow for any valid existing interface name.

In T1185#133941, @roedie wrote:

Just a suggestion, would it be a weird idea to move the firewall config from the interface section to the firewall section? A bit like the zone config. So something like:

set firewall local interface eth0 name <firewall-filter>
set firewall in interface eth0 name <firewall-filter>
set firewall out interface eth0 name <firewall-filter>
set firewall local interface bond0.10v22v6 ipv6-name <firewall-filter>

The problem is that using zone-policy firewall is a bit overkill for a pure router or even a router with async routing. In which scenario I guess only the local variant would be useful.

Or, come to think, some free from of set interfaces unknown <typeyourownname> firewall local name <ruleset> where you can only config stuff that doesn't really depend on an interface.

Just a suggestion, would it be a weird idea to move the firewall config from the interface section to the firewall section? A bit like the zone config. So something like:

PR https://github.com/vyos/vyos-1x/pull/1530

The real check without IPv4 local/remote:

vyos@r14# commit
[ interfaces openvpn vtun2 ]

PR: https://github.com/vyos/vyos-1x/pull/1525

Changes for the inversion operator (--not-range instead of !) have been made. Generalizing exit codes, as suggested in PR comments will be handled in a separate task.

The serial-getty@ttyUSB0.service seems to work well after the fix. We should backport this to the equuleus as well.

PR for VyOS 1.3

• https://github.com/vyos/vyos-1x/pull/1520
• https://github.com/vyos/vyos-build/pull/261

Resolved in T4664: merged in Sagitta; backport candidate for Equuleus 1.3.3.

The smoketest seems suspect, the error line has nothing to do with this issue and running the smoketest several times results in tests passing/failing arbitrarily on that line (across multiple tests).

It seems can't pass smoketest

05:47:04  DEBUG - ======================================================================
05:47:04  DEBUG - FAIL: test_add_multiple_ip_addresses (__main__.BondingInterfaceTest)
05:47:04  DEBUG - ----------------------------------------------------------------------
05:47:04  DEBUG - Traceback (most recent call last):
05:47:04  DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/base_interfaces_test.py", line 109, in tearDown
05:47:04  DEBUG -     self.assertFalse(process_named_running(daemon))
05:47:04  DEBUG - AssertionError: 8769 is not false
05:47:04  DEBUG - 
05:47:04  DEBUG - ------------------

PR for VyOS 1.3 https://github.com/vyos/vyos-1x/pull/1519

PR for 1.3 https://github.com/vyos/vyos-build/pull/260

Initial draft; suggested changes and testing to follow: