We use the netavark plugin for the containers, which fixes this.
set container name alp01 image 'alpine' set container name alp01 network NET01 set container network NET01 prefix '100.64.0.0/24'
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Jan 10 2024
Jan 10 2024
Viacheslav closed T3499: Podman is not compatible with nat rules, a subtask of T2216: Containerized third-party applications for VyOS, as Resolved.
dmbaturin changed the status of T4646: USB serial output console does not work from Unknown Status to Resolved.
dmbaturin triaged T4114: Allow software running as systemd service write coredumps as Normal priority.
Viacheslav closed T3430: Cloud-init failing with “Unable to render networking” on VyOS 1.3 as Resolved.
@fernando Thanks!
i've re-checked with the new image from GCP and new cloud-init version , it seems to be working as expexted :
Viacheslav moved T5918: Verification problem for `set vpn ipsec interface` from Open to Finished on the VyOS 1.4 Sagitta board.
GitHub <[email protected]> committed rVYOSONEX348892a97be2: Merge pull request #2792 from vyos/mergify/bp/sagitta/pr-2791 (authored by Viacheslav).
The kernel is not supporting pseudowire/VPLS now
this patch was never merged into the kernel
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX60127f12d6bd: T5918: Fix typo in verify vpn ipsec interface (authored by Viacheslav).
GitHub <[email protected]> committed rVYOSONEX7c6cb9829356: Merge pull request #2791 from sever-sever/T5918 (authored by c-po).
Viacheslav changed the status of T3429: Hyper-V integration services not working on VyOS 1.4 (sagitta/current) from Open to Needs testing.
Viacheslav changed the status of T5918: Verification problem for `set vpn ipsec interface` from Open to In progress.
No, installing the miniupnpd_functions.sh file does not correct the problem.
GitHub <[email protected]> committed rVYOSONEX3eaf0ca3978a: Merge pull request #2788 from vyos/mergify/bp/sagitta/pr-2787 (authored by Viacheslav).
Another bug it that /config/upnp.leases is hardcoded, but there is no script who creates it https://github.com/vyos/vyos-1x/blob/aebb458262072457c6a3840d1b17031fbd780eca/data/templates/firewall/upnpd.conf.j2#L128
sarthurdev changed the status of T5814: VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration from In progress to Needs testing.
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEXb588e0784626: T5688: Changed 'range' to multi in 'client-ip-pool' for accell-ppp (authored by a.apostoliuk).
GitHub <[email protected]> committed rVYOSONEXaebb45826207: Merge pull request #2777 from aapostoliuk/T5688-multirange (authored by c-po).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX345a59a99b4d: bgp: T5913: allow peer-group support for ipv4|6-labeled-unicast SAFI (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX9bfc538e7af5: Merge pull request #2782 from vyos/mergify/bp/sagitta/pr-2780 (authored by c-po).
Viacheslav moved T5916: Added segment routing check for index size and SRGB size from Open to Finished on the VyOS 1.5 Circinus board.
Viacheslav added a project to T5916: Added segment routing check for index size and SRGB size : VyOS 1.5 Circinus.
Will it work if you manually download the functions? https://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_1/miniupnpd/netfilter_nft/scripts/miniupnpd_functions.sh
OK, a little digging around in the grub configs led me to a "workaround" solution for the serial console problem after the machine is booted.
Can confirm this is exactly the same in 1.4 rolling (as of Jan 09). Same errors. The miniupnpd daemon receives the request (for either a UPnP, NAT-PMP, or PCP port mapping) and then reports the errors @simplysoft reports in the description.
GitHub <[email protected]> committed rVYOSONEXe890527d7300: Merge pull request #2787 from c-po/bgp-5913 (authored by Viacheslav).
c-po closed T5766: http: rewrite conf-mode script to get_config_dict() , a subtask of T5782: Use a single config mode script for https and http-api, as Resolved.
c-po closed T5766: http: rewrite conf-mode script to get_config_dict() , a subtask of T5768: Remove auxiliary http-api.conf for simplification of http-api config mode script, as Resolved.
c-po closed T5911: pki: service update ignored if certificate name contains a hyphen (-), a subtask of T3642: PKI configuration, as Resolved.
c-po closed T5911: pki: service update ignored if certificate name contains a hyphen (-) as Resolved.
c-po moved T5911: pki: service update ignored if certificate name contains a hyphen (-) from Open to Finished on the VyOS 1.4 Sagitta board.
c-po closed T5902: http: remove virtual-host configuration in webserver, a subtask of T5766: http: rewrite conf-mode script to get_config_dict() , as Resolved.
c-po moved T5902: http: remove virtual-host configuration in webserver from In Progress to Finished on the VyOS 1.4 Sagitta board.
c-po closed T5886: Add support for ACME protocol (LetsEncrypt), a subtask of T3642: PKI configuration, as Resolved.
c-po closed T5886: Add support for ACME protocol (LetsEncrypt), a subtask of T5894: Extend get_config_dict() with additional parameter with_pki that defaults to False, as Resolved.
c-po moved T5913: Allow for Peer-Groups in ipv4-labeled-unicast SAFI from Open to Finished on the VyOS 1.5 Circinus board.
c-po changed the status of T5913: Allow for Peer-Groups in ipv4-labeled-unicast SAFI from Open to In progress.
PR for 1.5 https://github.com/vyos/vyos-1x/pull/2787 which will be backported to 1.4
GitHub <[email protected]> committed rVYOSONEX9e3586eb17cb: Merge pull request #2784 from nicolas-fort/T5915 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX085a15059755: Merge pull request #2785 from sarthurdev/kea-options (authored by c-po).
GitHub <[email protected]> committed rVYOSONEXf00779b36af8: Merge pull request #2786 from jestabro/image-annotations (authored by c-po).
sarthurdev changed the status of T5814: VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration from Open to In progress.
jestabro added a comment to T5917: Restore annotations of (running)/(default boot) in select image list.
jestabro triaged T5917: Restore annotations of (running)/(default boot) in select image list as Normal priority.
jestabro changed Issue type from unspecified to feature on T3441: More intelligent config loading scripts.
jestabro lowered the priority of T3871: Resolve unexpected interface name reordering from High to Normal.
Lowering priority to normal to proceed with adding the interface-monitor daemon development, mentioned above, for 1.5.
Quick test done on a VM with 1 CPU and 1G RAM:
[email protected]# for I in {1..2542}; do set firewall ipv6 name Test rule $I action accept ; set firewall ipv6 name Test rule $I destination port $I; set firewall ipv6 name Test rule $I protocol tcp ; done [email protected]# time commit
@sempervictus Thanks for the update!
OK, the grub serial config described here got me as far as seeing the Grub selection screen at boot time.
Oh wow, this is ancient. Can definitely close this out - @zsdc and i figured out a bunch of the insanity around cloud-init since then and i've got it working in our openstacks as well as public clouds on a single config.
What to do with atop and logrorate?
Viacheslav changed the status of T190: two factor authentication for OpenVPN remote VPN tunnels from Open to Needs testing.
It seems we already have mfa T3834 but it never was documented
https://github.com/vyos/vyos-1x/pull/1008
vyos@r4# set interfaces openvpn vtun0 server mfa totp
Possible completions:
challenge Expect password as result of a challenge response protocol
(default: enable)
digits Number of digits to use for totp hash (default: 6)
drift Time drift in seconds (default: 0)
slop Maximum allowed clock slop in seconds (default: 180)
step Step value for totp in seconds (default: 30)@xrobau Could you test it?
Dec 9 13:04:57 vyos charon: 07[IKE] no matching CHILD_SA config found
Do you have several connections from the hosts behind the same NAT external address to the same hub?
It worked in my previous tests, but it was just one host behind NAT to connect to the HUB.
Re-check please and close if it works fine now. Need to update.
This is closed now because the required functionality perfectly works with Cloud-init + NoCloud/ConfigDrive.
@amcmillen Do you have any examples of how to deploy it on Linux / Debian, etc?
Without live examples, we'll mark it as wont fix and task will be closed.
As I understand, there are now ways to implement it natively for sshd
Reopen please if you have/know a solution for it.
@ordex Les us know if you have some ideas
Thanks
Viacheslav edited projects for T190: two factor authentication for OpenVPN remote VPN tunnels, added: VyOS 1.5 Circinus; removed VyOS 1.3 Equuleus (1.3.6).
sarthurdev moved T5912: DHCP Static mapping don't work on every first lease from Open to In Progress on the VyOS 1.5 Circinus board.
sarthurdev changed the status of T5912: DHCP Static mapping don't work on every first lease, a subtask of T3316: Use Kea DHCP(v6) instead of ISC DHCP(v6), from Confirmed to Needs testing.
sarthurdev changed the status of T5912: DHCP Static mapping don't work on every first lease from Confirmed to Needs testing.
sarthurdev changed the status of T5787: dhcp-server allows duplicate static-mapping for the same IP address from In progress to Needs testing.
PR for scoped options and bugfixes: https://github.com/vyos/vyos-1x/pull/2785
Is it still bug? @sempervictus could you re-check?
We probably need more details
Viacheslav closed T4300: Extend list of supported interfaces for Cloud-init Network Configuration as Resolved.
I guess it is already done https://github.com/vyos/vyos-cloud-init/commit/ae74804ede8fb76a7f27ca869f2b880dbe276ca2
@zsdc Can we close it or you are working on it?
n.fort changed the status of T5915: Firewall zone - Re add op-mode commands from Confirmed to In progress.