Please re-test with latest 1.4 release as the firewall was moved from iptables -> nftables
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed Advanced Search
Advanced Search
Advanced Search
May 22 2023
May 22 2023
Viacheslav changed the status of T5143: Apply constraint on powerdns forward-zones configuration from In progress to Needs testing.
Viacheslav changed the status of T5115: Support custom port for name servers for forwarding zones from Open to Needs testing.
Viacheslav edited projects for T2934: proxy-arp-pvlan on VRRP interface, added: VyOS 1.3 Equuleus (1.3.4); removed VyOS 1.3 Equuleus (1.3.3).
c-po moved T5234: Add bash identifier for given VRF instance from Open to Finished on the VyOS 1.4 Sagitta board.
May 21 2023
May 21 2023
jestabro closed T5218: Revise vyos xml lib for bug fixes and extensions, a subtask of T2665: vyos.xml.defaults for tag nodes, as Resolved.
Hi @daniil and @NikolayP,
Viacheslav renamed T5233: Op-mode flow-accounting netflow with disable-imt errors from Op-mode flow-accounting with disable-imt errors to Op-mode flow-accounting netflow with disable-imt errors.
May 20 2023
May 20 2023
Could you write and test an udev rule which renames the RNDIS usb0 device to wwan*?
Viacheslav renamed T5222: Add load-balancing reverse-proxy based on haproxy from Add load-balancing based on haproxy to Add load-balancing reverse-proxy based on haproxy .
Viacheslav renamed T5231: Add op-mode for load-balancing reverse-proxy from Add op-mode for load-belancing reverse-proxy to Add op-mode for load-balancing reverse-proxy.
Viacheslav changed the status of T5222: Add load-balancing reverse-proxy based on haproxy from Open to Needs testing.
May 19 2023
May 19 2023
There is the task T5169
PR listen-address fixes https://github.com/vyos/vyos-1x/pull/2013
PR refactoring https://github.com/vyos/vyos-1x/pull/2012
May 17 2023
May 17 2023
Draft until the dependency PR is merged:
https://github.com/vyos/vyos-1x/pull/1997
jestabro changed the status of T5228: Simplify get_config_dict and add argument with_defaults from Open to In progress.
I've done test , regarding the original issues that it was nat+route-leaking (default + foo) , which is working on the last rolling (VyOS 1.4-rolling-202305140317). however, I've tried some test using two vrf+route-leaking and NAT , I can replicated the issue:
Restricted Repository Identity closed T5226: Deduplicate and standardize validators and constraints for hostname and IP address as Resolved by committing rVYOSONEX0c91c356183b: Merge pull request #2008 from indrajitr/misc-conf-mode-fixes.
Viacheslav changed the subtype of T5227: mDNS reflector should allow additional domains to browse and allow filtering services from "Task" to "Feature Request".
@ddominet the correct syntax
set protocols bgp neighbor 192.0.2.11 address-family ipv6-unicast allowas-in number 1
indrajitr changed the status of T5226: Deduplicate and standardize validators and constraints for hostname and IP address from Open to In progress.
May 16 2023
May 16 2023
I've managed to adapt Alpine Linux patches to build Debian 11 StrongSwan 5.9.1 package, feel free to use it
0010-charon-add-optional-source-and-remote-overrides-for-.patch22 KBDownload
In T3655#148609, @bbabich wrote:In T3655#131502, @Viacheslav wrote:I have NAT working with vrf in VyOS 1.4-rolling-202208290458 + custom nat offload
set interfaces ethernet eth0 address '192.168.122.14/24' set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 vrf 'foo' set protocols static route 192.0.2.0/24 interface eth1 vrf 'foo' set system conntrack set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 interface 'eth0' set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 vrf 'default' set vrf name foo table '1010'Nftables
root@r14:/home/vyos# cat nat.nft flush ruleset table ip filter { flowtable fastnat { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @fastnat } } table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.0.2.0/24 oif "eth0" snat to 192.168.122.14 persistent } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; } }Conntrack table
vyos@r14:~$ sudo conntrack -F conntrack v1.4.6 (conntrack-tools): connection tracking table has been emptied. vyos@r14:~$ vyos@r14:~$ sudo conntrack -L tcp 6 431999 ESTABLISHED src=192.168.122.14 dst=192.168.122.1 sport=22 dport=44462 src=192.168.122.1 dst=192.168.122.14 sport=44462 dport=22 [ASSURED] mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33018 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33018 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=37517 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=37517 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=59794 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=59794 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39288 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39288 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39616 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39616 [OFFLOAD] mark=0 use=2 icmp 1 29 src=192.0.2.2 dst=1.1.1.1 type=8 code=0 id=12387 src=1.1.1.1 dst=192.168.122.14 type=0 code=0 id=12387 mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=41155 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=41155 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39829 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39829 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33655 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33655 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=44835 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=44835 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=40213 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=40213 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33729 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33729 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=48344 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=48344 [OFFLOAD] mark=0 use=2 conntrack v1.4.6 (conntrack-tools): 14 flow entries have been shown. vyos@r14:~$This works for me too on current rolling releases from Jan-2023 to now.
indrajitr changed the status of T5144: Modernize dynamic dns operation from Needs testing to In progress.
May 15 2023
May 15 2023
I reproduced the problem.
I received the next logs
Viacheslav changed the status of T5197: Conntrack-sync external cache commit error from Open to Needs testing.
Version 1.4-rolling-202305150317 does not have the problem.
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
This can be closed now. I've submitted a Documentation PR
May 13 2023
May 13 2023
May 12 2023
May 12 2023
We should make the ssl-bind ciphers and ssl-bind-options configurable (<multi/> node) by the user
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
In T3655#131502, @Viacheslav wrote:I have NAT working with vrf in VyOS 1.4-rolling-202208290458 + custom nat offload
set interfaces ethernet eth0 address '192.168.122.14/24' set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 vrf 'foo' set protocols static route 192.0.2.0/24 interface eth1 vrf 'foo' set system conntrack set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 interface 'eth0' set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 vrf 'default' set vrf name foo table '1010'Nftables
root@r14:/home/vyos# cat nat.nft flush ruleset table ip filter { flowtable fastnat { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @fastnat } } table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.0.2.0/24 oif "eth0" snat to 192.168.122.14 persistent } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; } }Conntrack table
vyos@r14:~$ sudo conntrack -F conntrack v1.4.6 (conntrack-tools): connection tracking table has been emptied. vyos@r14:~$ vyos@r14:~$ sudo conntrack -L tcp 6 431999 ESTABLISHED src=192.168.122.14 dst=192.168.122.1 sport=22 dport=44462 src=192.168.122.1 dst=192.168.122.14 sport=44462 dport=22 [ASSURED] mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33018 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33018 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=37517 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=37517 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=59794 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=59794 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39288 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39288 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39616 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39616 [OFFLOAD] mark=0 use=2 icmp 1 29 src=192.0.2.2 dst=1.1.1.1 type=8 code=0 id=12387 src=1.1.1.1 dst=192.168.122.14 type=0 code=0 id=12387 mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=41155 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=41155 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39829 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39829 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33655 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33655 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=44835 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=44835 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=40213 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=40213 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33729 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33729 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=48344 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=48344 [OFFLOAD] mark=0 use=2 conntrack v1.4.6 (conntrack-tools): 14 flow entries have been shown. vyos@r14:~$
Viacheslav renamed T5222: Add load-balancing reverse-proxy based on haproxy from Add loadbalancing based on haproxy to Add load-balancing based on haproxy .
Zen3515 changed the status of T5219: ddclient: Cloudflare doesn't require login from Open to In progress.
I've create a pull request for this task at https://github.com/vyos/vyos-1x/pull/2002
c-po closed T2778: Migrate "system syslog" to get_config_dict() to support new features as Resolved.
c-po moved T2778: Migrate "system syslog" to get_config_dict() to support new features from Backlog to Finished on the VyOS 1.4 Sagitta board.
c-po changed the status of T2769: Add VRF support for syslog, a subtask of T2778: Migrate "system syslog" to get_config_dict() to support new features, from Unknown Status to Resolved.
May 11 2023
May 11 2023
c-po moved T2769: Add VRF support for syslog from Backlog to Finished on the VyOS 1.4 Sagitta board.
c-po moved T2769: Add VRF support for syslog from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
Backport for 1.3.3 https://github.com/vyos/vyos-1x/pull/2001
Viacheslav edited projects for T5219: ddclient: Cloudflare doesn't require login, added: VyOS 1.4 Sagitta; removed ddclient.
In T4362#148361, @masterit wrote:one issue.
the migration scripts don't take into account older load balancing configs.if the test > rule > type > ping isn't explicitly set then the rule defaults to the next hop address and ignores the rule entirely.
the default rule seems to be the next hop address for the interface.
Viacheslav added a comment to T5171: Use XML for conf-mode "load-balancing wan" instead of legacy templates.
set default check type ping https://github.com/vyos/vyos-1x/pull/1998
Viacheslav changed the status of T5213: Accel-ppp sending accounting interim updates acct-interim-interval option from In progress to Needs testing.
Veth is not ready to work together with netns
As Interface moves entirely to logical stack and with the next commit will be recreated and try to move to netns again. As it doesn't see veth interface which moved to another logical stack, it tryes to recreate this interface.
We should either fix it or revert the previous commit.
May 10 2023
May 10 2023
jestabro added a parent task for T5218: Revise vyos xml lib for bug fixes and extensions: T2665: vyos.xml.defaults for tag nodes.
PR:
https://github.com/vyos/vyos-1x/pull/1997
This will remain in draft until corresponding PR fro vyos1x-config is merged.
jestabro changed the status of T5218: Revise vyos xml lib for bug fixes and extensions from Open to In progress.
syncer changed the status of T3829: Support separated TCP/IP stack via "ip netns" from Open to In progress.
Add kernel module https://github.com/vyos/vyos-build/pull/348
Viacheslav added a comment to T5213: Accel-ppp sending accounting interim updates acct-interim-interval option.
PR for L2TP https://github.com/vyos/vyos-1x/pull/1988
Not working. The same errors