@mickvav I recall that you told in some task about IPT usage
can you share how you currently integrate IPT?
@jclendenan and me(and not only) will be interested to see this in 1.2

Agreed on the description.

Just posting here in case someone can help me out -

In T100#4598, @mtz4718 wrote:

Is this en-devour dead? I really want to help but I wonder I'd be much use. If there's any dumb testing or boring tasks let me know.

Is this en-devour dead? I really want to help but I wonder I'd be much use. If there's any dumb testing or boring tasks let me know.

Not sure if https://github.com/irconan/vyatta-cfg-system/commit/9f9d35251ae726d1ef91c614ce95d347eea5c328 should suffice to fix this. I figure anything disabled in the old init should be disabled in systemd too.

@amos.shapira I was just working through the packer script from the original script you gave me. I'll wait to see what you work out and see if I can apply something similar to GCE

I'm not building the VyOS from source but extract it from the nightly .iso file.
This works great for me with VyOS 1.1.7.
Debian Jessie doesn't have the kernel 3.18 which is required for OverlayFS.

@amos.shapira @silverbp
to save some additional time for you here in T100
You must use Debian Jessie to build 1.2.x

I'm building the VyOS disk image under another OS (latest test using Ubuntu 16.04 LTS) and was testing the extra configuration script under chroot. Your response would explain that the missing unionfs packages on the host OS could explain the error I get. I'll install them and try again.

with ubuntu 14.04 I still get the error above.
mount: wrong fs type, bad option, bad superblock on overlayfs,

@syncer yes please split it off. Sorry for taking over the ticket.

Hey @amos.shapira
Can you move this under separate ticket
or i can do that for you if you wish

I got the VyOS 1.2 AMI built by Packer but it doesn't get the ssh key pulled from the metadata and stored in the configuration. With lots of manual testing I got to a stage where "/bin/cli-shell-api setupSession" fails with a core dump.

I've updated https://github.com/amosshapira/thermal to let you specify VPC ID and subnet ID required to run Packer in AWS.

@jeff What exactly did you do when you "tried it with vpp"? Can you tell us a bit about what hardware you tested on and what your numbers were?

I was just going to try substitute the 1.1.7 url with the 1.2.0 url. I'm stepping through these steps manually until I can get through it. Then I can do a packer script.

How do you get the code for 1.2 into your image? I use the ISO of 1.1.7 and started work for 1.2.0 and made some progress but stopped when I hit too many problems and realised that 1.2 isn't stable (that was a few months ago).

I've just verified that the AMI gets built and runs correctly after making sure that the VPC ID and Subnet ID are set correctly in packer.json. I'll update my code when I get home. The issue to track this is https://github.com/amosshapira/thermal/issues/5

ami-72343365 is Ubuntu official public trusty AMI in us-east-1, name "ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-20161205" owner id "099720109477"

Hm, I can't get this command to work..

@syncer thanks for the heads up!

Hello!
I will advise to work on 1.2 and not spend time on 1.1.x
For GCE just as for Azure required fresher software so 1.1.x is problematic

@amos.shapira what linux / version is this: ami-72343365 I can't find that ami.

I've used packer before, I'll go through those scripts and see if I can replicate something similar on GCE, thanks for the link!

@silverbp have you considered using Packer? I got Packer building AMI's of VyOS on AWS here: https://github.com/amosshapira/thermal/tree/master/vyos-image, perhaps you can use it as a basis for a GCE image. Let me know if you need help with understanding the code there (it uses a trick to work around Packer's lack of support for creating the final image from a "side-mounted" volume by switching volumes and rebooting).

Also as far as variations from AWS

I'm trying to take the 1.1.7 version and get it working in GCE which I haven't had any luck so far.
I've performed the following steps:

You only get this error after deleting the 'global' section from the default configuration.

/var has different permissions between VyOS 1.1.7 and VyOS 1.2.X

OpenVPN released 2.4, a major update. Release notes here: https://github.com/OpenVPN/openvpn/blob/master/Changes.rst

How did you go with OFP? I can compi;e and run it on vyos platform but first I tried in on Ubuntu and found it much worse than stock linux perhaps there are some setup that is required for it to function optimally. I also tried vpp and that doubled the pps at 64bytes.

The issue is that strongswan in 1.1.7 when configures as ikev1 wil use default dh groups (modp1024 and modp1536).
Vyos 1.2 does not use default dh groups, so if you want this config to work you have to set dh group in your "ike-group IKE-YYYY proposal"
(modp1024 or modp1536 if you leave your proposal in 1.1.7 empty).

I tested your config, and it works for me (between vyos 1.1.7 and 1.2)
Also can you Please open an new task for this, this is different than the above issue.

If i test your config the okey gets set for me, this is also the same as in 1.1.7..
Does the okey get set for you correctly, and what are the troubles you are having?

I made it return Unknown if the file in question doesn't exist, hope this fixed the issue.

Seems to work. @hexes, please test and tell me if for you it doesn't.

In for a quick meeting. I think one of the major points would be 118; what goes in and what not; this shouldn't take more than 10 minutes, I think.

I could participate in a meeting next week, this week is "getting ready for Christmas" week ;-)

@aopdal absolutely after previous dev meeting there were some conclusions
I think we just need to repeat meeting and define something more specific
@trickv @dmbaturin @jhendryUK @EwaldvanGeffen @UnicronNL any chance to get quick meeting before 2017?

I like to participate in the testing. But I think we need to break down the point in a bit more specific tests. We should also have requirements which state what is pass / fail. And we should probably create specific test descriptions ant test cases which could be automated.

Hello, @mickvav removed you.
It's wasn't demand or something like that, I just though that you may know that better

Well, I am not sure I can do this fast, as I am using different approach in flow collection - https://github.com/mickvav/ipt-netflow-code and have no idea on what do do with sflow. If you have someone else to assign this job to - do it.

Here is a howto on the openfastpath - https://www.howtoforge.com/tutorial/opendataplane-with-open-fast-path-on-ubuntu/

Complete solution(open-vm-tools and drivers update) will be added in 1.2.x
for 1.1.x series i going to create separate ticket with workaround provided by @higebu

I moved the "task" part to T215.

Hello @carl.byington
this type of questions should go to Ponder Questions,
Maniphest Tasks are purely for bugs, approved feature requests and actually tasks.
Please recreate as question
Thanks!

Hi Carl,

I too would like to participate in testing..