in the VyOS 1.4-rolling-202306190317

set qos interface eth0 egress 'test'
set qos policy shaper test bandwidth '300bit'
set qos policy shaper test class 100 bandwidth '150mbit'
set qos policy shaper test class 100 burst '3760k'
set qos policy shaper test class 100 match internal mark '100'
set qos policy shaper test class 100 queue-type 'fq-codel'
set qos policy shaper test default bandwidth '20mbit'
set qos policy shaper test default burst '188k'
set qos policy shaper test default queue-type 'fq-codel'

comimt

DEBUG/QoS: tc qdisc replace dev eth0 root handle 1: htb r2q 1 default 65
DEBUG/QoS: tc class replace dev eth0 parent 1: classid 1:1 htb rate 300
DEBUG/QoS: tc class replace dev eth0 parent 1:1 classid 1:64 htb rate 150000000 burst 3760k quantum 1514
DEBUG/QoS: tc qdisc replace dev eth0 parent 1:64 sfq
DEBUG/QoS: tc class replace dev eth0 parent 1:1 classid 1:65 htb rate 20000000 burst 188k quantum 1514 prio 20
DEBUG/QoS: tc qdisc replace dev eth0 parent 1:65 sfq
DEBUG/QoS: tc qdisc replace dev eth0 parent 1:64 fq_codel quantum 1514 flows 1024 interval 100 interval 100 target 5 noecn
DEBUG/QoS: tc filter replace dev eth0 parent 1: protocol all handle 100 fw flowid 1:64

@MartB Could you test it? Should be fixed in vyos-1.4-rolling-202306190317-amd64.iso

Not sure about ipv6, requires more tests, but ip should work
PR https://github.com/vyos/vyos-1x/pull/2048

The similar task https://vyos.dev/T5154

In T4989#144426, @MartB wrote:

set qos policy shaper test bandwidth 100mbit
set qos policy shaper test class 10 bandwidth 50%

It wont be used right now if I add a class that uses a percentage, it will always use the interface speed.
The base __rate_convert should include some check if the "base" speed was already set.

Fix for match protocol https://github.com/vyos/vyos-1x/pull/2047

PR https://github.com/vyos/vyos-1x/pull/2047

It expects ip protocol 1 instead of 'ip protocol icmp' in tc
wrong generation for protocols

PR https://github.com/vyos/vyos-1x/pull/2046

After reboot, I connect to the node and execute reboot again without any config change
But I still see a Warning, that looks like a bug in this case.

If class['bandwidth'] == auto then we should get global bandwidth

PR https://github.com/vyos/vyos-1x/pull/2044
Config

The same config in 1.3 doesn't have tc filter in 1.3

It's time to separate this task into subtasks.

Don't see errors with this configuration:

set interfaces ethernet eth1 vif 11 address '192.0.2.2/24'
set interfaces input ifb0 description 'WAN Ingress'

vhost modules are not included to kernet

PR https://github.com/vyos/vyos-1x/pull/2042

set service config-sync mode 'load'
set service config-sync secondary address '192.168.122.11'
set service config-sync secondary key 'foo'
set service config-sync section 'nat'

Thanks, @jestabro
It works in my tests!!

PR https://github.com/vyos/vyos-build/pull/360

In T2251#150145, @ganawaj wrote:

This bug is still present in the latest 1.4 rolling release

The similar task https://vyos.dev/T4797
You can add manually nft rules that used for firewall group, but they will overwritten per next firewall change/commit. The whole firewall config will overwritten.
There are 2 ways. Somehow use it in CLI or use native (nft) tables, chains, group-sets and rules which are not overlapping with generated “system” firewall ruleset

PR https://github.com/vyos/vyos-build/pull/356
PR https://github.com/vyos/vyos-1x/pull/2033

PR for vyos-1x https://github.com/vyos/vyos-1x/pull/2025