PR https://github.com/vyos/vyos-1x/pull/1371

Why don't use action accept for nl and drop all others?

PR https://github.com/vyos/vyos-1x/pull/1370

It seems a wrong priority
Mpls configuration applied before creation tunnel
As a result sysctl parameter for the tunnel interface doesn't exist yet
To reproduce it in one commit:

set interfaces dummy dum1 address '10.5.4.8/24'
set interfaces tunnel tun0 address '10.255.0.2/30'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 remote '192.0.2.254'
set interfaces tunnel tun0 source-address '192.0.2.1'
set protocols mpls interface 'dum1'
set protocols mpls interface 'tun0'
set protocols mpls ldp discovery transport-ipv4-address '192.0.2.1'
set protocols mpls ldp interface 'dum1'
set protocols mpls ldp interface 'tun0'
set protocols mpls ldp router-id '192.0.2.1'

Hi,
I think this is a BUG, not a feature.
If I enable mpls on an interface, then the proper sysctl flags must be applied and be persistent.

it's a common behavior when you want to set sysctl variable and bash-cli is used ( vyos-cli by default when restart the vm set this value in 0 ) . however , it's possible to configure it with this command :

I just tested it on VyOS 1.4-rolling-202206260217, everything seems to work so far!
It would be nice to also have the negate option, something like:

Thank you!

PR: https://github.com/vyos/vyos-1x/pull/1368

@Viacheslav As for your other concern, you can filter the actual inbound interface (eth4 in this my case) in mangle-PREROUTING. Maybe you could try packet marking in mangle-PREROUTING, then filter them later in VYOS_FW_FORWARD/VYOS_FW_LOCAL in the filter table?
Something like this:

@Viacheslav I tested your fix in my environment. The inbound filtering worked as expected after the fix. However it did not work correctly for the case we where we want both inbound and outbound firewalls on a single vrf member interface (or any case that has more than 2 directions on the same interface).

PR for 1.4: https://github.com/vyos/vyos-1x/pull/1367

• https://github.com/vyos/vyatta-cfg/pull/48
• https://github.com/vyos/vyos-1x/pull/1366

We don't have such option client-hostname in dhcpdv6.leases

PR https://github.com/vyos/vyos-1x/pull/1365

Tested and works correct. Thanks @jestabro

PR: https://github.com/vyos/vyos-utils/pull/4
Adding the additional validator to policy.xml.in allows the smoketest (above) to pass.

One approach is linked below; to be discussed before PR.
https://github.com/vyos/vyos-utils/compare/master...jestabro:increment-decrement?expand=1

I hope it can be found. I have been banging my head against the wall with this issue :( and it's hurting.

load-balancing wan completely broken with nexthop dhcp for 1.4 (it happens after first reboot or renew)
The script gets empty values there https://github.com/vyos/vyatta-wanloadbalance/blob/a831f22d4c34bf947b0335e55573280b75c2bde0/src/lbdecision.cc#L180
So ip route replace table is never executed
Why does it get an empty value?
It parse lease file https://github.com/vyos/vyatta-wanloadbalance/blob/a831f22d4c34bf947b0335e55573280b75c2bde0/src/lbdata.cc#L335-L341
option new_routers and in 1.4 the file looks as

i've checked this issues, it seems to be solved . I think that it was solved for another task. I used the following vyos version :

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1364

I think it should check this parameter per commit and it is a bug with validation as we don't have a tunnel interface yet
But after commit it will be valid value

PR https://github.com/vyos/vyos-1x/pull/1363

vyos@r14# set service webproxy url-filtering squidguard source-group fdsf-dg
[edit]
vyos@r14#

It seems issue with this validator https://github.com/vyos/vyos-1x/blob/1978946312a36f4913e1e5ea7754668b1c653d09/interface-definitions/service_webproxy.xml.in#L487

route-maps support a relative adjustment of the metric (https://github.com/vyos/vyos-1x/blob/current/interface-definitions/policy.xml.in#L1402-L1417)

PR: https://github.com/vyos/vyos-1x/pull/1362

PR: https://github.com/vyos/vyos-1x/pull/1361

PR https://github.com/vyos/vyos-1x/pull/1360

Since in previous version set protocols nhrp tunnel tun0 cisco-authentication "" was allowed, a migration script is required. Otherwise, when upgrading, configuration fails.

PR https://github.com/vyos/vyos-1x/pull/1358

set protocols failover route 203.0.113.1/32 next-hop 192.168.100.1 check target '192.168.100.1'
set protocols failover route 203.0.113.1/32 next-hop 192.168.100.1 check timeout '10'
set protocols failover route 203.0.113.1/32 next-hop 192.168.100.1 check type 'icmp'
set protocols failover route 203.0.113.1/32 next-hop 192.168.100.1 interface 'eth1'
set protocols failover route 203.0.113.1/32 next-hop 192.168.100.1 metric '2'

Working on moving groups to named set as part of a refactor in some firewall code.

Tested with VyOS 1.4-rolling-202206100921
Works as expected
Described in the documentation

Extra checks are needed not only when attaching a policy route to an interface, but also when attaching firewall.
For example:

vyos@vyos# set firewall name FOO rule 10 action accept 
[edit]
vyos@vyos# set firewall name FOO rule 10 destination group address-group NOAG
[edit]
vyos@vyos# commit

PR: https://github.com/vyos/vyos-1x/pull/1357

PR: https://github.com/vyos/vyos-1x/pull/1356