Wireguard has no link states on the interface, the ip command just does an 'administrative' up down, which won't start a renegotiation. The policy description (remove peer) needs to be removed from the wg interface and re-added, otherwise you need to wait until wg tries to rekey which will then eventually renegotiate the entire connection.
The removal was as far as I recall part of the original vyos code, so it may have been removed at one point, I haven't looked into the code yet.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Jun 23 2021
Jun 23 2021
FileGo reopened T3556: Commit-archive via scp causes 100% CPU on boot, a subtask of T3356: Script for remote file transfers, as Open.
Actually scratch that. I run a HA pair of VyOS routers via VRRP with a transition script on master/backup, and it looks like when it transitions from backup to master, the commit (at the end of the script) still locks in an endless cycle, combined with some sort of memory leak in keepalived-fifo.py (that doesn't occur if commit-archive via scp is not set up).
erkin closed T3556: Commit-archive via scp causes 100% CPU on boot, a subtask of T3356: Script for remote file transfers, as Resolved.
Looks fine on boot now.
Now that the Paramiko and Cryptography versions have been updated, does this problem persist with the newer nightlies? @SrividyaA @FileGo
erkin closed T3356: Script for remote file transfers, a subtask of T3355: Remove all remaining legacy Vyatta code, as Resolved.
erkin changed the status of T3506: Migrate loadkey command to op-mode, a subtask of T3355: Remove all remaining legacy Vyatta code, from In progress to On hold.
Done with generate public-key-command. loadkey is deprecated and will be removed in a future version.
erkin changed the status of T3506: Migrate loadkey command to op-mode, a subtask of T3356: Script for remote file transfers, from In progress to On hold.
In T3640#96876, @c-po wrote:If your host is behind NAT, could it possibly be that the NAT translation entry expired?
Does the following work:
ip link set dev wg0 down; ip link set dev wg0 up
Jun 22 2021
Jun 22 2021
c-po closed T3645: Bullseye: ethtool changed output for ring-buffer information, a subtask of T3641: Upgrade base system from Debian Buster -> Debian Bullseye, as Resolved.
c-po changed the status of T3645: Bullseye: ethtool changed output for ring-buffer information, a subtask of T3641: Upgrade base system from Debian Buster -> Debian Bullseye, from Open to In progress.
c-po changed the status of T3645: Bullseye: ethtool changed output for ring-buffer information from Open to In progress.
If your host is behind NAT, could it possibly be that the NAT translation entry expired?
c-po changed the status of T3641: Upgrade base system from Debian Buster -> Debian Bullseye from Open to In progress.
Viacheslav edited projects for T3582: 'delete log file' does not work, added: VyOS 1.2 Crux (VyOS 1.2.8); removed VyOS 1.2 Crux (VyOS 1.2.7).
erkin changed the status of T3644: Replace GCC with a simpler preprocessor for including nested XML snippets in XML documents from Open to In progress.
In T3640#96771, @Viacheslav wrote:We don't use any configuration file for it, so I think we can't use wg-quick
We use "wg set"$ sudo wg set --help Usage: wg set <interface> [listen-port <port>] [fwmark <mark>] [private-key <file path>] [peer <base64 public key> [remove] [preshared-key <file path>] [endpoint <ip>:<port>] [persistent-keepalive <interval seconds>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...] ]...
Viacheslav added a comment to T2892: Remove command: "set firewall options interface <interface> disable".
I don't see the reason to delete the "disable" option, as it uses for adjust-mss and adjust-mss6.
And you need temporarily disable it.
Viacheslav reassigned T3629: IPoE server shifting address in the range from Viacheslav to Unknown Object (User).
Different format
vyos@r1-roll:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------------------ ------- -------- -------------- ---------------- ---------------- ----------- ---------- peer_192-0-2-2_tunnel_1 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_10 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_11 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_12 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_13 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_14 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_15 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_16 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_17 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_18 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_19 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_2 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_20 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_3 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_4 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_5 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_6 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_7 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_8 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_9 down N/A N/A N/A N/A N/A N/A vyos@r1-roll:~$
@SrividyaA Fixed in PR https://github.com/vyos/vyos-1x/pull/894
Jun 21 2021
Jun 21 2021
Viacheslav updated the task description for T3643: show vpn ipsec sa doesn't show tunnels in "down" state.
Viacheslav renamed T3643: show vpn ipsec sa doesn't show tunnels in "down" state from show vpn ipsec sa doesn't show tunnel in "down" state to show vpn ipsec sa doesn't show tunnels in "down" state.
In fresh/new setup, the output of the command "show vpn ike sa" is throwing an exception error:
We don't use any configuration file for it, so I think we can't use wg-quick
We use "wg set"
$ sudo wg set --help Usage: wg set <interface> [listen-port <port>] [fwmark <mark>] [private-key <file path>] [peer <base64 public key> [remove] [preshared-key <file path>] [endpoint <ip>:<port>] [persistent-keepalive <interval seconds>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...] ]...
In T3640#96759, @Viacheslav wrote:Is it helps in your case?
set interfaces wireguard wg0 disable commit del interfaces wireguard wg0 disable commitThere is no any native command for reset wireguard interface in Linux (as I know). Also, we don't use any daemons which we can restart to "re-establish" session.
Is one host behind nat?
Is it helps in your case?
set interfaces wireguard wg0 disable commit del interfaces wireguard wg0 disable commit
There is no any native command for reset wireguard interface in Linux (as I know). Also, we don't use any daemons which we can restart to "re-establish" session.
Is one host behind nat?
erkin closed T3628: commit-archive source-address Interface Broken, a subtask of T3356: Script for remote file transfers, as Resolved.
erkin closed T3563: commit-archive breaks with IPv6 source addresses, a subtask of T3356: Script for remote file transfers, as Resolved.
Jun 20 2021
Jun 20 2021
c-po moved T3641: Upgrade base system from Debian Buster -> Debian Bullseye from Open to In Progress on the VyOS 1.4 Sagitta board.
erkin changed the status of T3628: commit-archive source-address Interface Broken, a subtask of T3356: Script for remote file transfers, from Open to In progress.
erkin changed the status of T3628: commit-archive source-address Interface Broken from Open to In progress.
Now that all major instances of curl have been replaced with the in-house script, we can begin to backport these changes to v1.3 in small pieces ahead of the first stable version.
c-po moved T1522: If a config session is not close cleanly, the unionfs-mount is not cleaned up from Open to Backlog on the VyOS 1.4 Sagitta board.
c-po moved T3635: Add ability to use mDNS repeater with VRRP from Open to Finished on the VyOS 1.4 Sagitta board.
c-po renamed T3318: Update Linux Kernel to v5.4.208 / 5.10.142 from Update Linux Kernel to v5.4.126 / 5.10.44 to Update Linux Kernel to v5.4.127 / 5.10.45.
Now I see the problem. paramiko.client.SSHClient().close() calls paramiko.transport.Transport().close() which implicitly calls socket.close() regardless of whether the socket was internally created or externally provided. This is a bit counterintuitive but I'll simply remove the socket closing logic then.
erkin changed the subtype of T1522: If a config session is not close cleanly, the unionfs-mount is not cleaned up from "Task" to "Bug".
Yes, though the error has changed:
trae@cr01b-vyos# commit
Using source address fd52:d62e:8011:fffe:192:168:253:3
Archiving config...
sftp://stor01z-rh8.int.trae32566.org:/int/cr01b-vyos Traceback (most recent call last):
File "<string>", line 1, in <module>
File "/usr/lib/python3/dist-packages/vyos/remote.py", line 299, in upload
upload_sftp(local_path, url.hostname, url.path, username, password, port, source, progressbar)
File "/usr/lib/python3/dist-packages/vyos/remote.py", line 178, in upload_sftp
transfer_sftp('upload', *args, **kwargs)
File "/usr/lib/python3/dist-packages/vyos/remote.py", line 174, in transfer_sftp
sock.shutdown(socket.SHUT_RDWR)
OSError: [Errno 9] Bad file descriptorJun 19 2021
Jun 19 2021
sarthurdev changed the status of T3635: Add ability to use mDNS repeater with VRRP from Open to In progress.
c-po changed the status of Restricted Maniphest Task, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Confirmed to Needs testing.
c-po closed T3632: policy: route-map: unable to configure route-target / site-of-origin as Resolved.
c-po moved T3632: policy: route-map: unable to configure route-target / site-of-origin from In Progress to Finished on the VyOS 1.2 Crux (VyOS 1.2.8) board.
c-po moved T3632: policy: route-map: unable to configure route-target / site-of-origin from In Progress to Finished on the VyOS 1.3 Equuleus board.
c-po moved T3633: Add LRO offload for interface ethernet from Backport Candidates to Finished on the VyOS 1.4 Sagitta board.
c-po moved T3633: Add LRO offload for interface ethernet from Need Triage to Finished on the VyOS 1.3 Equuleus board.
Jun 18 2021
Jun 18 2021
Viacheslav moved T3633: Add LRO offload for interface ethernet from Open to Backport Candidates on the VyOS 1.4 Sagitta board.
Works fine VyOS 1.4-rolling-202106180929
vyos@r1-roll# set interfaces ethernet eth1 offload lro [edit] vyos@r1-roll# commit [edit] vyos@r1-roll# sudo ethtool -k eth1 | match large-receive-offload large-receive-offload: on [edit] vyos@r1-roll#
Jun 17 2021
Jun 17 2021
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Added PR:
Cheeze_It edited a custom field on T3634: Add op command option for ping for do not fragment bit to be set.
@SrividyaA Fixed in PR: https://github.com/vyos/vyos-1x/pull/884
Tested with basic ipsec configuration and it does not seem to work when 3des encryption is configured. It works with default (aes128) and aes192.
Version
Viacheslav renamed T3633: Add LRO offload for interface ethernet from Add LRO offload to Add LRO offload for interface ethernet.