This will be resolved / migrated away in T3048.

We have a basic implementation available. Additional changes should be submitted via feature requests.

VyOS 1.2 adds a random link-local address on tunnel interfaces by default.

Now there is a new plan, please see T3071

Now there is a new plan, please see T3071

@runar The latest image already supports VLAN aware bridge, so this task list can be closed

In the specified timerange

Next rolling release will carry the revert

Thank you for the feedback! Will incorporate this into the rolling releases. Looks like once again Intel did us a favor.

Your revert appears to do the trick. Image booted fine with QAT enabled, and "show system acceleration qat status" shows the QAT device came up fine and is running happily.

@c-po It was thought that possibly the nftables migration was doing something funny here because of the potential overlaps.

I will take at look if I can implement a short fix to generate IPv6 Link Local addresses on wireguard interfaces.

Further configurations and an overview via email

T2802

@cjeanneret Can you re-check it? And close it if all works fine.

T3060

Fix for "remote-host" on client side
PR https://github.com/vyos/vyos-1x/pull/606

Server conf

set interfaces openvpn vtun0 encryption cipher 'aes256gcm'
set interfaces openvpn vtun0 encryption disable-ncp
set interfaces openvpn vtun0 hash 'sha512'
set interfaces openvpn vtun0 local-host '100.64.0.1'
set interfaces openvpn vtun0 local-port '1194'
set interfaces openvpn vtun0 mode 'server'
set interfaces openvpn vtun0 openvpn-option 'tls-version-min 1.3'
set interfaces openvpn vtun0 openvpn-option 'comp-lzo no'
set interfaces openvpn vtun0 persistent-tunnel
set interfaces openvpn vtun0 protocol 'tcp-passive'
set interfaces openvpn vtun0 server client client1 ip '10.10.3.2'
set interfaces openvpn vtun0 server client client1 subnet '10.10.3.0/29'
set interfaces openvpn vtun0 server client client1 subnet '10.20.0.0/16'
set interfaces openvpn vtun0 server subnet '10.10.3.0/29'
set interfaces openvpn vtun0 server topology 'subnet'
set interfaces openvpn vtun0 tls ca-cert-file '/config/auth/ovpn/ca.crt'
set interfaces openvpn vtun0 tls cert-file '/config/auth/ovpn/central.crt'
set interfaces openvpn vtun0 tls dh-file '/config/auth/ovpn/dh.pem'
set interfaces openvpn vtun0 tls key-file '/config/auth/ovpn/central.key'

The check on DH length is backwards.

Is there a reason you're assuming the proto is v6, or do those options allow fallback to v4 remotes? I can't find clear information on that in the manpages.

I have reverted the commit of QAT driver update. can you please try out this image:

In the new version client configuration

Request merge PR:

I have written an "fast" fix until tunnel is rewritten. Can you test it?

@ernstjo yeah we also have this "situation" with wireguard tunnels. Should be fixed in general with the rewrite of tunnel to get_config_dict() which is the second last interface not using this scheme, vti is last.

Usually all of them have a serial failback thus they should work, currently there is only a smakk subset of vyos verified LTE modules as each and every modules comes with its own problems: