PR https://github.com/vyos/vyos-1x/pull/2004

We should make the ssl-bind ciphers and ssl-bind-options configurable (<multi/> node) by the user

In T3655#131502, @Viacheslav wrote:

I have NAT working with vrf in VyOS 1.4-rolling-202208290458 + custom nat offload

set interfaces ethernet eth0 address '192.168.122.14/24'
set interfaces ethernet eth1 address '192.0.2.1/24'
set interfaces ethernet eth1 vrf 'foo'
set protocols static route 192.0.2.0/24 interface eth1 vrf 'foo'
set system conntrack
set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 interface 'eth0'
set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 vrf 'default'
set vrf name foo table '1010'

Nftables

root@r14:/home/vyos# cat nat.nft 
flush ruleset

table ip filter {
	flowtable fastnat {
		hook ingress priority filter
		devices = { eth0, eth1 }
	}

	chain forward {
		type filter hook forward priority filter; policy accept;
		ip protocol { tcp, udp } flow add @fastnat
	}
}
table ip nat {
	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 192.0.2.0/24 oif "eth0" snat to 192.168.122.14 persistent
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
	}
}

Conntrack table

vyos@r14:~$ sudo conntrack -F
conntrack v1.4.6 (conntrack-tools): connection tracking table has been emptied.
vyos@r14:~$ 
vyos@r14:~$ sudo conntrack -L
tcp      6 431999 ESTABLISHED src=192.168.122.14 dst=192.168.122.1 sport=22 dport=44462 src=192.168.122.1 dst=192.168.122.14 sport=44462 dport=22 [ASSURED] mark=0 use=1
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=33018 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33018 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=37517 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=37517 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=59794 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=59794 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=39288 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39288 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=39616 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39616 [OFFLOAD] mark=0 use=2
icmp     1 29 src=192.0.2.2 dst=1.1.1.1 type=8 code=0 id=12387 src=1.1.1.1 dst=192.168.122.14 type=0 code=0 id=12387 mark=0 use=1
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=41155 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=41155 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=39829 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39829 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=33655 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33655 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=44835 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=44835 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=40213 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=40213 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=33729 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33729 [OFFLOAD] mark=0 use=2
udp      17 src=192.0.2.2 dst=1.1.1.1 sport=48344 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=48344 [OFFLOAD] mark=0 use=2
conntrack v1.4.6 (conntrack-tools): 14 flow entries have been shown.
vyos@r14:~$

PR with the fix: https://github.com/vyos/vyos-build/pull/350

In T5186#148559, @c-po wrote:

Reverted Kernel back to 5.4.234 for upcoming 1.3.3. release.

I've create a pull request for this task at https://github.com/vyos/vyos-1x/pull/2002

Reverted Kernel back to 5.4.234 for upcoming 1.3.3. release.

Backport for 1.3.3 https://github.com/vyos/vyos-1x/pull/2001

PR:
https://github.com/vyos/vyos1x-config/pull/17

@c-po I guess it should be v5.4.234

In T4362#148361, @masterit wrote:

one issue.
the migration scripts don't take into account older load balancing configs.

if the test > rule > type > ping isn't explicitly set then the rule defaults to the next hop address and ignores the rule entirely.
the default rule seems to be the next hop address for the interface.

set default check type ping https://github.com/vyos/vyos-1x/pull/1998

This issue was tested in two version which are
1.4-rolling-202212080318
1.4-rolling-202209130217

Veth is not ready to work together with netns
As Interface moves entirely to logical stack and with the next commit will be recreated and try to move to netns again. As it doesn't see veth interface which moved to another logical stack, it tryes to recreate this interface.
We should either fix it or revert the previous commit.

PR:
https://github.com/vyos/vyos-1x/pull/1997
This will remain in draft until corresponding PR fro vyos1x-config is merged.

Add kernel module https://github.com/vyos/vyos-build/pull/348

PR for L2TP https://github.com/vyos/vyos-1x/pull/1988

Not working. The same errors

one issue.
the migration scripts don't take into account older load balancing configs.

PR https://github.com/vyos/vyatta-wanloadbalance/pull/18

Fixed with rewriting to systemd unit vyos-wan-load-balance.service

In T5213#148346, @joshua.hanley wrote:

@Viacheslav Thanks for the prompt response. Not sure if the change will also cover L2TP as well. For example:

set vpn l2tp remote-access authentication radius accounting-interim-interval '60'

Sometimes it stuck for ~1.5 minutes after deleting.

vyos@r14# delete load-balancing 
[edit]
vyos@r14# commit

@Viacheslav Thanks for the prompt response. Not sure if the change will also cover L2TP as well. For example:

PR https://github.com/vyos/vyos-1x/pull/1986

PR https://github.com/vyos/vyos-1x/pull/1986

set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication radius accounting-interim-interval '60'
set service pppoe-server authentication radius server 203.0.113.1 key '123'
set service pppoe-server client-ip-pool name POOL-01 gateway-address '192.0.2.1'
set service pppoe-server client-ip-pool name POOL-01 subnet '192.0.2.0/24'
set service pppoe-server interface eth1

In T5186#148294, @rh7819 wrote:

this is cause by

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.4.235&id=7a6fb69bbcb21e9ce13bdf18c008c268874f0480

tcindex classifier is removed by upstream kernel, so

08:04:48 DEBUG - filter add dev eth1 parent 11: protocol ip prio 1 handle 128 tcindex classid 11:a

fails.

We use FRR as the backend and it uses logical AND for match entries

https://github.com/vyos/vyos-1x/pull/1985

https://github.com/vyos/vyos-1x/pull/1985

this is cause by

PR https://github.com/vyos/vyos-1x/pull/1984

set high-availability disable
set high-availability vrrp group GRP01 address 192.0.2.47/32
set high-availability vrrp group GRP01 interface 'eth1'
set high-availability vrrp group GRP01 vrid '10'

It doesn't like protocol tcp

vyos@r14# sudo tc filter replace dev eth1 parent 1: protocol all u32 match ip protocol tcp 0xff action police rate 300000000 burst 15k flowid 1:a
Illegal "match"
[edit]
vyos@r14#

But it works with protocol 6

vyos@r14# sudo tc filter replace dev eth1 parent 1: protocol all u32 match ip protocol 6 0xff action police rate 300000000 burst 15k flowid 1:a
[edit]
vyos@r14#

And next fail:

ardware UUID:    4d6f4d29-1ae8-446f-8d2b-3decd9da64c7

On 1.4-rolling-202305080742, speed limit and protocol detection still not worked out correctly too.