PR: https://github.com/vyos/vyos-1x/pull/4644

An easy mitigation is to just update the command that is run to:

journalctl --no-hostname --boot -k | grep "ipv4-NAM-${6:0:15}"

The only issue with this as the only solution, is you could lose granularity in logging if you were to have names like:

test-test-test-1
test-test-test-2

Running show log firewall ipv4 name test-test-test-1 would return log entries for both names since the string would be ipv4-NAM-test-test-test-. That's where a warning could come into play, stating it is recommended to keep names to no more than 15 characters.

I created a task for this as well https://vyos.dev/T7469

PR: https://github.com/vyos/vyos-1x/pull/4496

@Viacheslav Can you assign me to this task?

@a.apostoliuk @sarthurdev I saw this a while back and was thinking about it today. I think it'd be useful to be able to disable conntrack per chain. It could be useful for people using VyOS in an ISP environment, where the firewall is more a mechanism to secure VyOS itself, rather than filter through traffic. It'd be pretty easy to implement.

PR https://github.com/vyos/vyos-1x/pull/4458

PR https://github.com/vyos/vyos-1x/pull/4459

PR: https://github.com/vyos/vyos-1x/pull/4457

Since there is already a task for this, do you want me to go ahead and close this one? Or keep it up as a reminder for work that still needs to be done?

PR: https://github.com/vyos/vyos-1x/pull/4456/

Added PR: https://github.com/vyos/vyos-1x/pull/4447

PR: https://github.com/vyos/vyos-1x/pull/4444

Added PR: https://github.com/vyos/vyos-1x/pull/4422

Will this be backported to 1.4 ahead of the 1.4.2 release?

I can't assign myself to this task for whatever reason, but here is a PR to correct this behavior:
https://github.com/vyos/vyos-1x/pull/4400

Approaching implementation of ZeroTier from a different angle in:
https://vyos.dev/T6455

Added PR: https://github.com/vyos/vyos-1x/pull/3623

Draft PR Added: https://github.com/vyos/vyos-1x/pull/3599

Added PR: https://github.com/vyos/vyos-1x/pull/3591

In T6439#190868, @Viacheslav wrote:

Should be fixed in T6373

NFT rate-limiting is effectively a policer instead of a shaper, so I don't think it'd be a good way to accomplish this. All drops would be aggressive and not tail-drops.

PR: https://github.com/vyos/vyos-1x/pull/3493

PR: https://github.com/vyos/vyos-1x/pull/3458

Adding additional PR to add bonding.py to op-mode-standardized.json: https://github.com/vyos/vyos-1x/pull/3408

Added PR: https://github.com/vyos/vyos-1x/pull/3389

In T6258#184716, @Viacheslav wrote:

Most likely needs to change priority to 319 for the sysctl

vyos@r4:~$ /usr/libexec/vyos/priority.py | match "ethernet|sysctl"
       300  interfaces_virtual-ethernet.py      ['interfaces', 'virtual-ethernet']
       318  interfaces_ethernet.py              ['interfaces', 'ethernet']
       318  system_sysctl.py                    ['system', 'sysctl']
       321  interfaces_pseudo-ethernet.py       ['interfaces', 'pseudo-ethernet']
vyos@r4:~$

Since descriptions can be very long I assume there will be a linewrap at the end?

Added PR:
https://github.com/vyos/vyos-1x/pull/3219

@jestabro Thanks, a solution definitely seems close.

In T5991#181120, @Viacheslav wrote:

It is not an actual ethernet interface, but you name it as an ethernet interface.
You can check the output sudo ip link show type wireguard or sudo ip link show type tun