It is not related to VRF at all and is related to the policy routing logic:
Reproduced even on 1.3.2
set interfaces ethernet eth1 address '192.168.122.14/24'
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Apr 17 2024
Apr 17 2024
n.fort changed the status of T5535: Move disable-directed-broadcast to firewall global-options from Confirmed to Needs testing.
n.fort changed the status of T6191: Policy route set-mss option is not working correctly from Confirmed to Needs testing.
Viacheslav triaged T6237: IPSec remote access VPN: ability to set EAP ID of clients as Wishlist priority.
indrajitr closed T5612: Miscellaneous improvements and fixes for dynamic DNS configuration as Resolved.
indrajitr closed T5723: mdns repeater: Always reload systemd daemon before applying changes as Resolved.
indrajitr closed T5966: Adjust dynamic dns configuration address subpath to be more intuitive and other op-mode adjustments as Resolved.
Updates have been applied on 1.4 and 1.5.
This can probably be closed.
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX292f4b8efe2a: T6191: do not append action to firewall and policy route|route6 when its not… (authored by n.fort).
GitHub <noreply@github.com> committed rVYOSONEX24c997dee169: Merge pull request #3320 from nicolas-fort/T6191 (authored by c-po).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX9f62c3082429: image-tools: T6168: compat mode update should preserve console type (authored by jestabro).
jestabro closed T6154: Installer should ask for password twice, a subtask of T4516: Rewrite system image manipulation tools in Python, as Resolved.
jestabro moved T6154: Installer should ask for password twice from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
GitHub <noreply@github.com> committed rVYOSONEX06a08f61abb9: Merge pull request #3322 from vyos/mergify/bp/sagitta/pr-3321 (authored by jestabro).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEXabfd62665359: image-tools: T6154: installer prompts to confirm a non-default passwd (authored by jestabro).
GitHub <noreply@github.com> committed rVYOSONEXce7023bea759: Merge pull request #3321 from jestabro/confirm-pass (authored by jestabro).
Apr 16 2024
Apr 16 2024
I decided to dig into this a little more and try to trace this out:
sudo nft add chain inet vrf_zones trace_chain { type filter hook prerouting priority -301\; }
sudo nft add rule inet vrf_zones trace_chain meta nftrace set 1@dmbaturin, @sever
Would love your input regarding the lack of headers when using the -c option. I've created a PoC around "chronyc -c activity" as it was the most straight forward command to start with.
Viacheslav changed the status of T6242: Add an option to disable certificate verification to reverse proxy from Open to Needs testing.
@dmbaturin , @Viacheslav - I use debian snapshot repository when building VyOS LTS on my own.
side note, if you flush ruleset, and only add:
Something I just figured out is that the minute I do:
jestabro moved T6243: Update vyos-http-api-tools for package idna security advisory from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
jestabro moved T6243: Update vyos-http-api-tools for package idna security advisory from Open to Finished on the VyOS 1.5 Circinus board.
n.fort changed Version from 1.4.0-epa2 to 1.4.0-epa2, 1.5-rolling-202404141045 on T6191: Policy route set-mss option is not working correctly.
n.fort changed the status of T6191: Policy route set-mss option is not working correctly from Open to Confirmed.
The regression causing 'image cannot be found" was fixed in https://vyos.dev/T6186.
jestabro removed a parent task for T5917: Restore annotations of (running)/(default boot) in select image list: T6022: set system image default-boot.
GitHub <noreply@github.com> committed rVYOSONEX41663efaba26: Merge pull request #3317 from natali-rs1985/T6141-equuleus (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX8f778f989d8f: Merge pull request #3318 from vyos/mergify/bp/sagitta/pr-3315 (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX5a481813c059: Merge pull request #3319 from vyos/mergify/bp/sagitta/pr-3313 (authored by c-po).
Viacheslav changed the status of T5722: Commit failure when trying to add a route in failover if the gateway is not in the same interface network from In progress to Needs testing.
jestabro triaged T6243: Update vyos-http-api-tools for package idna security advisory as Normal priority.
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX6cace2df99c7: T5722: Failover route add option onlink (authored by Viacheslav).
GitHub <noreply@github.com> committed rVYOSONEX6825873bd1e8: Merge pull request #3313 from sever-sever/T5722 (authored by dmbaturin).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEXdeb92e466110: T6242: load-balancing reverse-proxy: Ability for ssl backends to not verify… (authored by Embezzle).
GitHub <noreply@github.com> committed rVYOSONEXc0eec365e2e3: Merge pull request #3315 from Embezzle/T6242 (authored by dmbaturin).
Status update:
- "Like for like" functionality between .sh script and .py script is complete and working (can be viewed in PR)
- Raw output capability -> in progress
Giggum added a comment to T6099: Suppress unsupported interfaces from appearing in messages log by Telegraf .
@Viacheslav concur that it looks to be resolved. The last log entry was at 9:10 and nothing telegraph-related has been logged in almost 30 minutes since. I will close ticket. Thank your help and insight.
Viacheslav changed the status of T6123: Limit NTP allow-client config to internal addresses by default from Open to Needs testing.
Viacheslav changed the status of T4915: Minisign verification failure == pass?? from Needs testing to Needs reporter action.
We'll close it if no response
Viacheslav edited projects for T4982: OpenConnect should have TLS 1.0 and TLS 1.1 disabled by default, added: VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta (1.4.0-epa3), Restricted Project.
Viacheslav closed T5946: TASK [setup-root-partition : Create a fileystem on EFI partition] failing in Docker as Wontfix.
A docker container usually has issues with loop devices:
Use the VM or attach dev
HollyGurza changed the status of T4248: There isn't a way to remove the only rule from the (traffic-policy) class. from Open to In progress.
Apr 15 2024
Apr 15 2024
Embezzle added a comment to T6242: Add an option to disable certificate verification to reverse proxy.
GitHub <noreply@github.com> committed rVYOSONEXd8bca084a1f0: Merge pull request #3310 from vyos/mergify/bp/sagitta/pr-3309 (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX131bb134ec7f: Merge pull request #3314 from vyos/mergify/bp/sagitta/pr-3311 (authored by c-po).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEXc976d71110df: pki: T6241: Fix dependency updates on PKI changes (authored by sarthurdev).
GitHub <noreply@github.com> committed rVYOSONEX42082cba2f0e: Merge pull request #3311 from sarthurdev/T6241 (authored by jestabro).
Viacheslav moved T5734: Unhandled exception when trying to configure OpenVPN server without dh-params from Open to Finished on the VyOS 1.5 Circinus board.
Viacheslav changed the status of T5722: Commit failure when trying to add a route in failover if the gateway is not in the same interface network from Open to In progress.
Viacheslav added a comment to T5722: Commit failure when trying to add a route in failover if the gateway is not in the same interface network.
PR https://github.com/vyos/vyos-1x/pull/3313
Add onlink option
set interfaces ethernet eth0 vif 10 address '10.20.30.1/32' set protocols static route 10.20.30.0/32 interface eth0.10
sarthurdev closed T6174: can't view dhcp server leases if logged in as a tacacs account as Resolved.
GitHub <noreply@github.com> committed rVYOSONEX534a037ffdf0: Merge pull request #3312 from vyos/mergify/bp/sagitta/pr-3308 (authored by dmbaturin).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX9cd746491a4d: T5734: OpenVPN check PKI DH name exists if DH configured (authored by Viacheslav).
sarthurdev changed the status of T6241: Updating CRL in "pki" config does not update OpenVPN from Open to Needs testing.
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX67bc10841f08: T5535: firewall: migrate command <set system ip disable-directed-broadcast> to… (authored by n.fort).
GitHub <noreply@github.com> committed rVYOSONEXf3d45223da40: Merge pull request #3309 from nicolas-fort/T5535 (authored by dmbaturin).
GitHub <noreply@github.com> committed rVYOSONEX8528764c97a5: Merge pull request #3308 from sever-sever/T5734 (authored by dmbaturin).
Viacheslav triaged T6242: Add an option to disable certificate verification to reverse proxy as Wishlist priority.
Viacheslav added a comment to T5722: Commit failure when trying to add a route in failover if the gateway is not in the same interface network.
It is more of a feature request than a bug due to specific kernel routes.
Feature to add onlink option
Viacheslav renamed T5722: Commit failure when trying to add a route in failover if the gateway is not in the same interface network from Failing to add route in failover to Failing to add route in failover if gateway not in the same interface network.