[Service]
LimitNOFILE=4096
LimitNOFILESoft=4096
ExecStartPre=/bin/bash -c 'mkdir -p /run/frr/config; \
echo "log syslog" > /run/frr/config/frr.conf; \ echo "log facility local7" >> /run/frr/config/frr.conf; \ chown frr:frr /run/frr/config/frr.conf; \ chmod 664 /run/frr/config/frr.conf; \ mount --bind /run/frr/config/frr.conf /etc/frr/frr.conf'
[edit]
vyos@r14#
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1892
@marc_s thanks, it makes sense.
Will be fixed in the next rolling release
Jenkins job looks simple
git clone https://github.com/sflow/host-sflow make deb FEATURES="NFLOG PCAP TCP DBUS SYSTEMD"
PR https://github.com/vyos/vyos-1x/pull/1888
set policy route-map RMAP6 rule 10 action 'deny' set policy route-map RMAP6 rule 10 match ip address prefix-len '0' set protocols ospfv3 route-map 'RMAP6'
PR for 1.4 https://github.com/vyos/vyos-1x/pull/1886
vyos@91800359325b# set interfaces ethernet eth0 address 192.0.2.5/24 [edit] vyos@91800359325b# commit [ interfaces ethernet eth0 ] sudo: unable to resolve host 91800359325b: System error
PR https://github.com/vyos/vyos-1x/pull/1884
>>> range_to_regex(['10-20', '22-35', '50']) '(1\\d|20|2[2-9]|3[0-5]|50)' >>>
Will be fixed in the next rolling release
If we add vlan to range we get error
set service ipoe-server authentication mode 'noauth' set service ipoe-server client-ip-pool name POOL1 gateway-address '192.0.2.1' set service ipoe-server client-ip-pool name POOL1 subnet '192.0.2.0/24' set service ipoe-server interface eth1 vlan '2000-3000' commit set service ipoe-server interface eth1 vlan '50' commit
The second commit:
@Jimz could you share an example of configuration?
I can't reproduce it with
set service dhcp-server shared-network-name Lan01 authoritative set service dhcp-server shared-network-name Lan01 name-server '1.1.1.1' set service dhcp-server shared-network-name Lan01 subnet 192.0.2.0/24 default-router '192.0.2.1' set service dhcp-server shared-network-name Lan01 subnet 192.0.2.0/24 range R1 start '192.0.2.10' set service dhcp-server shared-network-name Lan01 subnet 192.0.2.0/24 range R1 stop '192.0.2.254' set service dhcp-server shared-network-name Lan01 subnet 192.0.2.0/24 static-mapping myhost ip-address '192.0.2.5' set service dhcp-server shared-network-name Lan01 subnet 192.0.2.0/24 static-mapping myhost mac-address '02:a6:0c:88:3e:a2'
Could you create a PR?
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1878
There is the regex
It seems don't validate correctly if only one letter before the hyphen, underscores
vyos@r14# set firewall group domain-group a_aa
For "SSH" we have dynamic-protection
vyos@r14# set service ssh dynamic-protection
Possible completions:
+ allow-from Always allow inbound connections from these systems
block-time Block source IP in seconds. Subsequent blocks increase by a
factor of 1.5 (default: 120)
detect-time Remember source IP in seconds before reset their score (default:
1800)
threshold Block source IP when their cumulative attack score exceeds
threshold (default: 30)@dex Update please the documentation if you want to help project or we'll do it later.
Thanks
The same task T5047
We cannot disable keepalived as it is used not only for VRRP and also for virtual-server
set high-availability virtual-server xxxx
So it should be something like set high-availability disable
Or just clean the VRRP configuration with set high-availability vrrp disable
To make sure that a script is not accidentally called without the vyattacfg group, the script can be safeguarded like this:
if [ "$(id -g -n)" != 'vyattacfg' ] ; then
exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
fihttps://docs.vyos.io/en/latest/automation/command-scripting.html#executing-configuration-scripts
In T5045#144137, @aserkin wrote:
PR https://github.com/vyos/vyos-1x/pull/1870
>>> from vyos.template import range_to_regex >>> >>> range_to_regex(['11-12', '14-15']) '(1[1-2]|1[4-5])' >>> >>>
I created a separate task for it T5057
The second bug is interface Regex does not work
Get:
interface=re:eth1\.\d+
Expect:
interface=re:^eth1\.(200\d|20[1-9]\d|2[1-9]\d{2}|3000)$PR https://github.com/vyos/vyos-1x/pull/1869
vyos@r14# run show conf com | match ipoe set service ipoe-server authentication mode 'noauth' set service ipoe-server interface eth1 client-subnet '100.64.24.0/24' set service ipoe-server interface eth1 network 'vlan' set service ipoe-server interface eth1 vlan '2000-3000' [edit] vyos@r14#
Check config:
vyos@r14# cat /run/accel-pppd/ipoe.conf | grep "\[ipoe" -A 7 [ipoe] verbose=1 interface=re:eth1\.\d+,shared=0,mode=L2,ifcfg=1,range=100.64.24.0/24,start=dhcpv4,ipv6=1 noauth=1 proxy-arp=1
It is incompatible with static entries.
Maybe it should be fixed after migrating to KEA-DHCP T3316
The similar task T5042
VyOS 1.3-stable-202303030442 Works as expected
vyos@r1# run show conf com | match open set vpn openconnect authentication mode 'radius' set vpn openconnect authentication radius server 192.168.122.14 key 'vyos-secret' set vpn openconnect listen-ports tcp '4433' set vpn openconnect listen-ports udp '4433' set vpn openconnect network-settings client-ip-settings subnet '100.64.12.0/24' set vpn openconnect ssl ca-cert-file '/config/auth/ca.crt' set vpn openconnect ssl cert-file '/config/auth/server.crt' set vpn openconnect ssl key-file '/config/auth/server.key' [edit] vyos@r1# [edit] vyos@r1# run show version all | match ocser ii ocserv 1.1.6-3 amd64 OpenConnect VPN server compatible with Cisco AnyConnect VPN [edit] vyos@r1# [edit] vyos@r1# run show openconnect-server sessions interface username ip remote IP RX TX state uptime ----------- ---------- ------------- --------------- ------ --------- --------- -------- sslvpn0 foo 100.64.12.225 192.168.122.205 1.3 KB 152 bytes connected 55s [edit] vyos@r1#