@Viacheslav Confirmed fixed, thank you.

The firewall for ocserv is handled by https://gitlab.com/openconnect/ocserv/-/blob/master/src/ocserv-fw and uses iptables by default

Supporting (draft) PR and minor fixes linked in PR:
https://github.com/vyos/vyos-1x/pull/1768

PR 1.3 https://github.com/vyos/vyos-1x/pull/1951

@Harliff Could you re-check?

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1954

In T5153#146789, @Viacheslav wrote:

Could you send sudo nft list ruleset ?

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1952
PR for 1.4 fix https://github.com/vyos/vyos-1x/pull/1953

For 1.4 rate-limit in the wrong place

set vpn pptp remote-access authentication rate-limit

Expected in the radius section:

set vpn pptp remote-access authentication radius rate-limit

Yes, I forgot to add this task. I'll make the PR

@n.fort Could you add PR for 1.3?

@fernando Could you add PR for 1.3?

PR https://github.com/vyos/vyos-1x/pull/1950

Could you send sudo nft list ruleset ?

In T4891#139693, @RyVolodya wrote:

I reproduced this configuration. Version VyOS 1.4-rolling-202212270317 - BFD works fine.

Configuration:

set interfaces ethernet eth0 address '10.221.3.18/30'
set interfaces ethernet eth0 mtu '9000'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso

BFD peer status:

BFD Peers:
        peer 10.221.3.17 vrf default
                ID: 2428685750
                Remote ID: 2382320760
                Active mode
                Status: up
                Uptime: 30 minute(s), 19 second(s)
                Diagnostics: ok
                Remote diagnostics: ok
                Peer Type: configured
                RTT min/avg/max: 0/0/0 usec
                Local timers:
                        Detect-multiplier: 5
                        Receive interval: 100ms
                        Transmission interval: 100ms
                        Echo receive interval: 50ms
                        Echo transmission interval: disabled
                Remote timers:
                        Detect-multiplier: 5
                        Receive interval: 100ms
                        Transmission interval: 100ms
                        Echo receive interval: 50ms

[edit]

Try upgrading the VyOS to the latest version.

Fixed in T5047

PR https://github.com/vyos/vyos-1x/pull/1949

I found the issue. This was caused by bumping the debian packaging scripts from debian/2%2.10-10 to debian/2%2.10-12, which includes https://salsa.debian.org/debian/wpa/-/commit/d204ceb5a2dc33db888eb55b5fee542a1005e69c. This is not compatible with vyos because vyos uses a config path in /run.

Thanks, I ran the ethernet smoke tests, but not the wireless ones. I'll investigate right away.

So we can close it. Thank you for contributing.

kk, will try to remember to setup a box for that; Usually rolling my own images. ;-)

Just waiting for a new rolling image and checking that those commands are present for CLI :)
If all goods we can close it

What is meant with testing? Writing the unit tests? Or seeing whether it actually works? If it is the latter, this is in prod on my boxes for roughly a month ;-)

Targets and logs will be fixed in the next rolling release

My fault, the double quotes were mis-removed in the PR when cleaning code.

Smoketest PR https://github.com/vyos/vyos-1x/pull/1947

done

After applying above rules an a system without any qos configured, it failed to create the redirect, commit was succesfull but tc disk show did not show the redirect. After removing and applying the redirect between commits, the redirect was present.
Changing the max bandwidth to 10mbit and commiting removed the redirect again.

Create please the PR
Thanks.

It cannot pass the smoketest /usr/libexec/vyos/tests/smoke/cli/test_interfaces_wireless.py

06:48:28  DEBUG - test_wireless_access_point_bridge (__main__.WirelessInterfaceTest.test_wireless_access_point_bridge) ... FAIL
06:48:29  DEBUG - test_wireless_access_point_bridge (__main__.WirelessInterfaceTest.test_wireless_access_point_bridge) ... ERROR
06:48:30  DEBUG - test_wireless_add_single_ip_address (__main__.WirelessInterfaceTest.test_wireless_add_single_ip_address) ... ERROR
06:48:32  DEBUG - test_wireless_add_single_ip_address (__main__.WirelessInterfaceTest.test_wireless_add_single_ip_address) ... ERROR
06:48:33  DEBUG - test_wireless_hostapd_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_config) ... FAIL
06:48:34  DEBUG - test_wireless_hostapd_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_config) ... ERROR
06:48:37  DEBUG - test_wireless_hostapd_wpa_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_wpa_config) ... FAIL
06:48:38  DEBUG - test_wireless_hostapd_wpa_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_wpa_config) ... ERROR

PR https://github.com/vyos/vyos-1x/pull/1945

Closing as resolved because the PRs were merged (thanks for the quick review!)

For eapol specifically, if your use case involves only a single chain (1 root CA + 1 or more intermediate CAs), then my fix from T4245 should do the trick. You can add each root/intermediate CA to the PKI and then set eapol to the leaf intermediate CA. When the wpa_supplicant configuration is generated, vyos will add the intermediate CA and all of its parents to the .crt file.

Submitted PRs:

Otp not configured

PR https://github.com/vyos/vyos-1x/pull/1941

We have targets-checks 203.0.113.1, 192.0.2.1, and if any of these targets are unreachable, we delete this route.
Is it correct?

@c-po How is the review and discussion on this feature going?

A similar output exists

 show system login users 
Possible completions:
  <Enter>               Execute the current command
  all                   Show information about all accounts
  locked                Show information about locked accounts
  other                 Show information about non VyOS user accounts
  vyos                  Show information about VyOS user accounts`

PR https://github.com/vyos/vyos-1x/pull/1940

In T4362#146398, @Viacheslav wrote:

@marc_s Will be fixed in the next rolling release, could you check?

Thanks @Viacheslav will test ASAP, next week I have a maintenance window, will let you know.

PR https://github.com/vyos/vyos-1x/pull/1939

set system login max-login-session '1'
set system login timeout '600'