Output plugins that we use in 1.4
"github.com/influxdata/telegraf/plugins/outputs/azure_data_explorer" "github.com/influxdata/telegraf/plugins/outputs/influxdb_v2" "github.com/influxdata/telegraf/plugins/outputs/prometheus_client" "github.com/influxdata/telegraf/plugins/outputs/http"
I re-created a new VM and it is Not reproducing
I closed it
Interface virtio
vyos@r1# run show interfaces ethernet eth1 physical
Settings for eth1:
Supported ports: [ ]
Supported link modes: Not reported
Supported pause frame use: No
Supports auto-negotiation: No
Supported FEC modes: Not reported
Advertised link modes: Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: Unknown!
Duplex: Unknown! (255)
Port: Other
PHYAD: 0
Transceiver: internal
Auto-negotiation: off
Link detected: yes
Ring parameters for eth1:
Pre-set maximums:
RX: 256
RX Mini: 0
RX Jumbo: 0
TX: 256
Current hardware settings:
RX: 256
RX Mini: 0
RX Jumbo: 0
TX: 256In T3933#124952, @sandwichdoge wrote:@Viacheslav I tested your fix in my environment. The inbound filtering worked as expected after the fix. However it did not work correctly for the case we where we want both inbound and outbound firewalls on a single vrf member interface (or any case that has more than 2 directions on the same interface).
table ip filter { chain VYOS_FW_LOCAL { type filter hook input priority filter; policy accept; oifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO # <<< Problem here, oifname should be eth0, not vrf name iifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO jump VYOS_POST_FW } ... chain NAME_FOO { ip saddr 8.8.8.8 counter packets 79 bytes 6636 drop comment "FOO-10" counter packets 3 bytes 984 return comment "FOO default-action accept" } }
@a.apostoliuk Could you create PR for 1.3?
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392
PR https://github.com/vyos/vyos-1x/pull/1389
set service dns forwarding dns64-prefix 2001:db8:aabc::/96
@dsummers Could you provide an example of VyOS configuration and an example of what you add?
Bug of testing
I tested commit_in_progress instead of commit_in_progress()
Potentially slow validators:
src/validators/interface-address:ipaddrcheck --is-ipv4-host $1 || ipaddrcheck --is-ipv6-host $1
src/validators/ip-address:ipaddrcheck --is-any-single $1
src/validators/ip-cidr:ipaddrcheck --is-any-cidr $1
src/validators/ip-host:ipaddrcheck --is-any-host $1
src/validators/ip-prefix:ipaddrcheck --is-any-net $1
src/validators/ipv4:ipaddrcheck --is-ipv4 $1
src/validators/ipv4-address:ipaddrcheck --is-ipv4-single $1
src/validators/ipv4-host:ipaddrcheck --is-ipv4-host $1
src/validators/ipv4-multicast:ipaddrcheck --is-ipv4-multicast $1 && ipaddrcheck --is-ipv4-single $1
src/validators/ipv4-prefix:ipaddrcheck --is-ipv4-net $1
src/validators/ipv4-range: ipaddrcheck --is-ipv4-single ${strarr[0]}
src/validators/ipv4-range: ipaddrcheck --is-ipv4-single ${strarr[1]}
src/validators/ipv6:ipaddrcheck --is-ipv6 $1
src/validators/ipv6-address:ipaddrcheck --is-ipv6-single $1
src/validators/ipv6-host:ipaddrcheck --is-ipv6-host $1
src/validators/ipv6-multicast:ipaddrcheck --is-ipv6-multicast $1 && ipaddrcheck --is-ipv6-single $1
src/validators/ipv6-prefix:ipaddrcheck --is-ipv6-net $1I can't reproduce it in VyOS 1.3.1-S1 and VyOS 1.3-stable-202206240423
vyos@r1:~$ show conf com | match eth1 set interfaces ethernet eth1 address 'dhcp' set interfaces ethernet eth1 mtu '9000'
@a.apostoliuk Will be fixed in the next rolling release, could you re-test it?
@n.fort Could you create PR for 1.3?
I think it should be here https://github.com/vyos/vyatta-cfg-quagga/blob/d4097690c40f619bc0e78a0d674985f7880a19a3/templates/policy/route-map/node.tag/rule/node.tag/match/peer/node.def#L3-L4
The same behavior for 1.2
It seems some old/depricated pkg ipp2p
vyos@r12# set firewall ipv6-name TEST rule 1 action drop [edit] vyos@r12# set firewall ipv6-name TEST rule 1 p2p all [edit] vyos@r12# commit [ firewall ipv6-name TEST ] ip6tables v1.4.21: Couldn't load match `ipp2p':No such file or directory
@marekm Did you set a proper listen to address for it?
set system ntp listen-address x.x.x.x
There is no dict if exists only one record in the https://github.com/vyos/vyos-1x/blob/cefc7ce9bfcf7750700e73edbc21864fe8ab0bee/src/op_mode/show_nat_translations.py#L103-L110
So it can't parse correctly
Cherry-pick for 1.3 https://github.com/vyos/vyos-1x/pull/1381
@trae32566 Extentd conntrack table and reduce timeouts:
for example
set system sysctl parameter net.netfilter.nf_conntrack_generic_timeout value 60 set system sysctl parameter net.netfilter.nf_conntrack_icmp_timeout value 10 set system sysctl parameter net.netfilter.nf_conntrack_icmpv6_timeout value 10 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_close_wait value 20 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 1800 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_fin_wait value 30 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_syn_recv value 30 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_syn_sent value 60 set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_time_wait value 120 set system sysctl parameter net.netfilter.nf_conntrack_udp_timeout_stream value 60
PR https://github.com/vyos/vyos-1x/pull/1379 (without completion help)
If the default option is enabled or 1
Maybe it makes sense to create disable option like:
set interfaces bridge br0 ip disable-multicast-snooping