Will it affect also tunnels/openvpn/wireguard/vxlan etc?
If you get rid of the default MTU values you get more pain.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Jul 27 2022
I can reproduce it:
Jul 26 2022
VyOS config:
set nat source rule 10 destination address '192.0.2.0/24' set nat source rule 10 exclude set nat source rule 10 outbound-interface 'any' set nat source rule 10 protocol 'all' set nat source rule 10 source address '0.0.0.0/0' set nat source rule 100 outbound-interface 'eth0' set nat source rule 100 source address '203.0.113.0/24' set nat source rule 100 translation address masquerade
The bug is still here:
vyos@r14# run show nat source rules
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/nat.py", line 157, in <module>
res = vyos.opmode.run(sys.modules[__name__])
File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 118, in run
res = func(**args)
File "/usr/libexec/vyos/op_mode/nat.py", line 152, in show_rules
return _get_formatted_output_rules(nat_rules, direction)
File "/usr/libexec/vyos/op_mode/nat.py", line 103, in _get_formatted_output_rules
sport {sport}'''
UnboundLocalError: local variable 'sport' referenced before assignment
[edit]
vyos@r14#It seems not related to kernel and definitely another bug
vyos@r14# run show conf com | match bri set interfaces bridge br0 enable-vlan set interfaces bridge br0 member interface eth1 allowed-vlan '5-50' set interfaces bridge br0 member interface eth1 native-vlan '5' [edit] vyos@r14# [edit] vyos@r14# run show bridge vlan port vlan-id br0 1 PVID Egress Untagged [edit] vyos@r14#
@aderouineau Describe please all steps of how to reproduce it (with commands set xxx)
I don't have any issues with it
set interfaces vxlan vxlan0 group '239.0.0.241' set interfaces vxlan vxlan0 mtu '1370' set interfaces vxlan vxlan0 port '4789' set interfaces vxlan vxlan0 source-interface 'wg0' set interfaces vxlan vxlan0 vni '123' set interfaces wireguard wg0 address '100.64.0.1/24' set interfaces wireguard wg0 peer PEER01 allowed-ips '0.0.0.0/0' set interfaces wireguard wg0 peer PEER01 public-key 'VVfR5S0yi+QPEJRLr25ZAfzFnwZM40G5WCZ/7ou7h3k=' set interfaces wireguard wg0 private-key 'yGOy08Kv8KUe8rsO6WHeo5jC7YdOAzQK0SJkDFQWlmA='
PR https://github.com/vyos/vyos-1x/pull/1435
vyos@r14:~$ show bridge Bridge interface br0: Member State MTU Flags Prio -------- ---------- ----- ------------------------------- ------ dum0 forwarding 1500 broadcast,noarp,up,lower_up 32 eth1.30 forwarding 1500 broadcast,multicast,up,lower_up 32 eth1.55 forwarding 1500 broadcast,multicast,up,lower_up 32
Jul 25 2022
I can't reproduce it (VyOS 1.4-rolling-202207220217):
set policy prefix-list BARRA32 rule 5 action 'permit' set policy prefix-list BARRA32 rule 5 ge '32' set policy prefix-list BARRA32 rule 5 le '32' set policy prefix-list BARRA32 rule 5 prefix '0.0.0.0/0' set policy prefix-list UTRSv4s25 rule 5 action 'permit' set policy prefix-list UTRSv4s25 rule 5 le '25' set policy prefix-list UTRSv4s25 rule 5 prefix '0.0.0.0/0' set policy prefix-list6 BARRA128 rule 5 action 'permit' set policy prefix-list6 BARRA128 rule 5 ge '128' set policy prefix-list6 BARRA128 rule 5 le '128' set policy prefix-list6 BARRA128 rule 5 prefix '::/0' set policy prefix-list6 UTRSv6s49 rule 5 action 'permit' set policy prefix-list6 UTRSv6s49 rule 5 le '49' set policy prefix-list6 UTRSv6s49 rule 5 prefix '::/0'
Will be fixed with syntax migration in T4118
@NikolayP Try the next command:
Jul 24 2022
Jul 23 2022
It will be fixed in T4545
PR https://github.com/vyos/vyos-1x/pull/1426
PR https://github.com/vyos/vyos-1x/pull/1430
vyos@r14:~$ show vrf Name State MAC address Flags Interfaces ------ ------- ----------------- ------------------------ --------------- foo up be:e3:5c:f1:54:99 noarp,master,up,lower_up eth1.50,eth1.55 bar up 1e:7c:94:da:e0:35 noarp,master,up,lower_up n/a vyos@r14:~$
PR https://github.com/vyos/vyos-1x/pull/1428
vyos@r14:~$ reset vpn ipsec-peer 2001:db8::2
CHILD_SA {21241} closed successfully
CHILD_SA {21243} closed successfully
CHILD_SA {21245} closed successfully
CHILD_SA {21244} closed successfully
CHILD_SA {21247} closed successfully
CHILD_SA {21246} closed successfully
CHILD_SA {21249} closed successfully
CHILD_SA {21248} closed successfully
closing CHILD_SA peer_2001-db8--2_tunnel_0{21250} with SPIs cab47d6b_i (0 bytes) c3cbba13_o (0 bytes) and TS 2001:db8:1111::/64 === 2001:db8:2222::/64
sending DELETE for ESP CHILD_SA with SPI cab47d6b
generating INFORMATIONAL request 14065 [ D ]
sending packet: from 2001:db8::1[500] to 2001:db8::2[500] (69 bytes)
received packet: from 2001:db8::2[500] to 2001:db8::1[500] (69 bytes)
parsed INFORMATIONAL response 14065 [ D ]
received DELETE for ESP CHILD_SA with SPI c3cbba13
CHILD_SA closed
CHILD_SA {21250} closed successfully
establishing CHILD_SA peer_2001-db8--2_tunnel_0{21251}
generating CREATE_CHILD_SA request 14066 [ SA No KE TSi TSr ]
sending packet: from 2001:db8::1[500] to 2001:db8::2[500] (497 bytes)
received packet: from 2001:db8::2[500] to 2001:db8::1[500] (497 bytes)
parsed CREATE_CHILD_SA response 14066 [ SA No KE TSi TSr ]
selected proposal: ESP:AES_GCM_16_256/MODP_2048/NO_EXT_SEQ
CHILD_SA peer_2001-db8--2_tunnel_0{21251} established with SPIs ccaff1e5_i c5a2b674_o and TS 2001:db8:1111::/64 === 2001:db8:2222::/64
connection 'peer_2001-db8--2_tunnel_0' established successfully
Peer reset result: success
vyos@r14:~$Jul 22 2022
PR https://github.com/vyos/vyos-1x/pull/1426
An example with only one rule 10 raw output
vyos@r14:~$ /usr/libexec/vyos/op_mode/nat.py show_rules --direction source --raw
[
{
"rule": {
"family": "ip",
"table": "nat",
"chain": "POSTROUTING",
"handle": 114,
"comment": "SRC-NAT-10",
"expr": [
{
"match": {
"op": "==",
"left": {
"meta": {
"key": "oifname"
}
},
"right": "eth0"
}
},
{
"counter": {
"packets": 0,
"bytes": 0
}
},
{
"masquerade": null
}
]
}
}
]
vyos@r14:~$PR to new format + IPv6 entries https://github.com/vyos/vyos-1x/pull/1425
@aalmenar try the next command
vyos@r14# run reset bgp ipv6
Possible completions:
<h:h:h:h:h:h:h:h>
IPv6 neighbor to clear
1-4294967295 Reset peers with the AS number
all Clear all peers
external Reset all external peers
peer-group Reset all members of peer-groupI just leave it here. We must not return to bug T2189 with this fix.
Jul 21 2022
As I remember fastnetmon wasn’t rewritten to dict
And requires manual set default value in config dictionary
Jul 20 2022
@daniil Could you re-check it?
It seems wpa_supplicant doesn't support GCM-AES-256
https://w1.fi/wpa_supplicant/devel/dir_4261af1259721e3e39e0d2dd7354b511.html