@svd135 Can you provide a version string when you last had it working? Seeing the firewall config might also be helpful.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Sep 6 2023
Sep 6 2023
Sep 5 2023
Sep 5 2023
sarthurdev changed the status of T5550: Source validation on interface does not work properly from In progress to Needs testing.
sarthurdev changed the status of T5550: Source validation on interface does not work properly from Open to In progress.
Sep 4 2023
Sep 4 2023
sarthurdev changed the status of T4903: Support IPv6 addresses in "set system conntrack ignore" from In progress to Needs testing.
sarthurdev changed the status of T4309: Support network/address-groups and ipv6-network/ipv6-address-groups in "conntrack ignore" from In progress to Needs testing.
sarthurdev changed the status of T4309: Support network/address-groups and ipv6-network/ipv6-address-groups in "conntrack ignore" from Open to In progress.
sarthurdev changed the status of T4903: Support IPv6 addresses in "set system conntrack ignore" from Open to In progress.
Sep 3 2023
Sep 3 2023
Aug 31 2023
Aug 31 2023
sarthurdev changed the status of T4782: Allow multiple CA certificates (on e.g. EAPoL) from In progress to Needs testing.
Aug 30 2023
Aug 30 2023
sarthurdev changed the status of T4782: Allow multiple CA certificates (on e.g. EAPoL) from Confirmed to In progress.
@csszep Yes it is expected, IPv6 has no sysctl and requires the nftables rule to function. The nftables execution is slightly slower, so there's no benefit to change it for IPv4.
Aug 27 2023
Aug 27 2023
sarthurdev closed T1097: Make firewall groups work everywhere that's appropropriate, a subtask of T2199: Rewrite firewall in new XML/Python style, as Resolved.
@tjjh89017 This will need to be re-evaluated. The build from your PR was taking in excess of 8 hours on the build server - the defconfig likely needs to be brought down to only the minimum required modules/drivers for successful builds on target devices.
This does still need to be addressed in 1.4. Without a version string, the 2-to-3 migrator is adding the conntrack helpers to the default config.
Duplicate T3275
sarthurdev added a comment to T5479: Helper leftovers found in nftables (firewall) even with all helpers disabled.
The kernel modules handle tracking of those, rpc/tns are userspace helpers.
sarthurdev added a comment to T5479: Helper leftovers found in nftables (firewall) even with all helpers disabled.
They are only defined. Only when the VYOS_CT_HELPER chain is reached will they take effect - see links in my above comment. Being in the default config will have no effect on connection tracking if bypassed by the notrack rule.
sarthurdev changed the status of T5080: Disable conntrack by default, a subtask of T5160: Firewall refactor, from In progress to Needs testing.
sarthurdev changed the status of T5080: Disable conntrack by default from In progress to Needs testing.
sarthurdev closed T5479: Helper leftovers found in nftables (firewall) even with all helpers disabled as Invalid.
They are created but unused by default (see VYOS_CT_HELPER chain)
sarthurdev changed the status of T5511: Cleanup of unused directories (and files) in order to shrink image-size from Open to Needs testing.
sarthurdev changed the status of T5018: Redirect to IFB removed after change in qos policy from Confirmed to Needs testing.
Thanks for following up on this issue @rayzilt
Aug 26 2023
Aug 26 2023
Closing as dupe of T5080
sarthurdev changed the status of T5080: Disable conntrack by default, a subtask of T5160: Firewall refactor, from Open to In progress.
sarthurdev changed the status of T3509: No BCP38 for IPv6 on VyOS from In progress to Needs testing.
Aug 25 2023
Aug 25 2023
PR to fix indentation: https://github.com/vyos/vyos-1x/pull/2171
Aug 23 2023
Aug 23 2023
Aug 22 2023
Aug 22 2023
I did start writing support for this but didn't have time to build and test it at the time. If anyone wants to test it out: https://github.com/sarthurdev/vyos-1x/commit/9199b75d75ceea3b7d49f0e3d71a19175b7b1326
Aug 16 2023
Aug 16 2023
In T5160#156025, @Apachez wrote:2.2: Invalid shall ALWAYS be processed BEFORE established/related/other rules otherwise it will not serve it purpose.
Jul 27 2023
Jul 27 2023
It is a bug that it’s on by default, see other task. Will be fixed after new firewall refactor is merged.
Jul 11 2023
Jul 11 2023
sarthurdev changed the status of T5275: Add op mode commands for exporting certificates to PEM files with correct headers from Open to Needs testing.
Jul 3 2023
Jul 3 2023
Jun 15 2023
Jun 15 2023
sarthurdev added a comment to T5293: Support for Floating Rules (Global Firewall-Rules that are automatically applied before all other Zone Rules).
Should be possible when new refactor is merged: T5160
sarthurdev added a comment to T5294: Wildcard Domains / TLDs in Firewall-Rules (and perhaps groups).
This would have to be handled with DNS and not in the firewall. Hostnames work on firewall because they are resolved prior to use in rules.
May 4 2023
May 4 2023
It might be a boot/slow DHCP lease issue.
May 3 2023
May 3 2023
sarthurdev renamed T5200: Static routing tables are not created with dhcp route from Static routing tables are not created to Static routing tables are not created with dhcp route.
Apr 20 2023
Apr 20 2023
Apr 17 2023
Apr 17 2023
Apr 14 2023
Apr 14 2023
sarthurdev changed the status of T5162: Invalid json in configd-include.json from Open to Needs testing.
Just to clarify, it changes again to pod-networkname in https://github.com/vyos/vyos-1x/commit/2a876059826927ef204e359a40395955f27503ce (next rolling image) to avoid name constraint issues.
Apr 13 2023
Apr 13 2023
Can you share container config section?
Mar 29 2023
Mar 29 2023
sarthurdev added a comment to T5101: VYOS 1.4 release no longer displayes output for 'sudo ipsec statusall'.
Management Commands
Mar 23 2023
Mar 23 2023
Mar 22 2023
Mar 22 2023
sarthurdev changed the status of T5018: Redirect to IFB removed after change in qos policy from In progress to Needs testing.
Mar 11 2023
Mar 11 2023
Mar 9 2023
Mar 9 2023
sarthurdev changed the status of T5018: Redirect to IFB removed after change in qos policy from Confirmed to In progress.
My bad
sarthurdev changed the status of T5075: QoS removes interface mirror/redirect rules from Open to In progress.
Discovered a couple of problems with chrony using the existing CLI.
Mar 2 2023
Mar 2 2023
sarthurdev changed the status of T3316: Use Kea DHCP(v6) instead of ISC DHCP(v6), a subtask of T3315: Supports dhcpv6 agent execution from pppoe0 interface, from Open to In progress.
sarthurdev changed the status of T3316: Use Kea DHCP(v6) instead of ISC DHCP(v6) from Open to In progress.
Have started work on migrating isc-dhcp v4/v6 server to Kea.
Feb 22 2023
Feb 22 2023
sarthurdev changed the status of T5023: PKI commit fails to update dependents from In progress to Needs testing.
sarthurdev changed the status of T5023: PKI commit fails to update dependents from Open to In progress.
Feb 21 2023
Feb 21 2023
sarthurdev changed the status of T5003: Upgrade base system to Debian 12 "Bookworm" from In progress to Needs testing.
Builds completing. ISO worker on Jenkins should be fixed and pushing new rolling images shortly.
Feb 15 2023
Feb 15 2023
Feb 13 2023
Feb 13 2023