Also add IPv6 link local address support to auto generate a link-local address as on any other type of interface.

With recent versions of strongSwan and XFRM interface in VyOS 1.4 this is now possible.

In T1641#125443, @Viacheslav wrote:

@trae32566 Extentd conntrack table and reduce timeouts:
for example

PR https://github.com/vyos/vyos-1x/pull/1382

There is no dict if exists only one record in the https://github.com/vyos/vyos-1x/blob/cefc7ce9bfcf7750700e73edbc21864fe8ab0bee/src/op_mode/show_nat_translations.py#L103-L110
So it can't parse correctly

Maybe it depends on the version of accel-ppp.
In 1.2.8:

Cherry-pick for 1.3 https://github.com/vyos/vyos-1x/pull/1381

https://docs.strongswan.org/docs/5.9/config/IPv6.html
https://docs.strongswan.org/docs/5.9/features/routeBasedVpn.html

In T2455#68732, @dmbaturin wrote:

VTI is secretly IPIP, so it doesn't support IPv6. The real issue is that we don't support the IPv6 variant of VTI yet.

@trae32566 Extentd conntrack table and reduce timeouts:
for example

set system sysctl parameter net.netfilter.nf_conntrack_generic_timeout value 60
set system sysctl parameter net.netfilter.nf_conntrack_icmp_timeout value 10
set system sysctl parameter net.netfilter.nf_conntrack_icmpv6_timeout value 10
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_close_wait value 20
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 1800
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_fin_wait value 30
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_syn_recv value 30
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_syn_sent value 60
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_time_wait value 120
set system sysctl parameter net.netfilter.nf_conntrack_udp_timeout_stream value 60

@Viacheslav There is already a set interfaces bridge brN igmp node. If the default option is enabled, I think set interfaces bridge brN igmp disable-snooping would sound better.
I prefer to have IGMP snooping disabled as the default option, since improper IGMP snooping causes issues while disabling IGMP snooping doesn't.

This seems to be an issue in 1.4 as well, I have the exact same symptoms, and removing the accept-protocol fixes the issue.

PR: https://github.com/vyos/vyos-1x/pull/1380

Implemented as: set service router-advert interface eth0 name-server-lifetime <value> which will be option A

PR https://github.com/vyos/vyos-1x/pull/1379 (without completion help)

Because with a rule like that I accept everything coming from nl from wan to lan, or I would need to add the source nl to every rule. That's why I did it with a deny not coming from nl on top, and then specific rules for the traffic that I want to accept.

If the default option is enabled or 1
Maybe it makes sense to create disable option like:

set interfaces bridge br0 ip disable-multicast-snooping

PR to add the option: https://github.com/vyos/vyos-1x/pull/1378

PR:
https://github.com/vyos/vyos1x-config/pull/9

It is not related to a router bug/feature
Close it

Did you try dns forwarding domain?

set service dns forwarding domain abc.local server 192.0.2.5

PR https://github.com/vyos/vyos-1x/pull/1377

Task for rewriting wan-loadbalancing to XML/Python T4470

@Viacheslav thanks

PR https://github.com/vyos/vyos-1x/pull/1376

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1375

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1374

Will be fixed in the next rolling release

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1372

PR https://github.com/vyos/vyos-1x/pull/1371

Why don't use action accept for nl and drop all others?

In T4457#124584, @NikolayP wrote:

The problem seems to be in these lines:

set vpn l2tp remote-access authentication local-users username test static-ip '172.25.255.1'
set vpn l2tp remote-access client-ip-pool start '172.25.255.1'
set vpn l2tp remote-access client-ip-pool stop '172.25.255.14'

Replacing "static IP" with 172.25.255.2 makes it work in VyOS 1.3.1

set vpn l2tp remote-access authentication local-users username test static-ip '172.25.255.2'

Full corrected config for 1.3.1 from the first post:

set interfaces dummy dum4 address '4.4.4.4/32'
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth1 address '192.168.6.31/24'
set service ssh
set vpn ipsec ipsec-interfaces interface 'eth1'
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn ipsec nat-traversal 'enable'
set vpn l2tp remote-access authentication local-users username test password 'test'
set vpn l2tp remote-access authentication local-users username test static-ip '172.25.255.2'
set vpn l2tp remote-access authentication mode 'local'
set vpn l2tp remote-access authentication require 'mschap-v2'
set vpn l2tp remote-access client-ip-pool start '172.25.255.1'
set vpn l2tp remote-access client-ip-pool stop '172.25.255.14'
set vpn l2tp remote-access idle '1800'
set vpn l2tp remote-access ipsec-settings authentication mode 'pre-shared-secret'
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret 'test'
set vpn l2tp remote-access ipsec-settings ike-lifetime '3600'
set vpn l2tp remote-access ipsec-settings lifetime '3600'
set vpn l2tp remote-access outside-address '192.168.6.31'

PR https://github.com/vyos/vyos-1x/pull/1370

It seems a wrong priority
Mpls configuration applied before creation tunnel
As a result sysctl parameter for the tunnel interface doesn't exist yet
To reproduce it in one commit:

set interfaces dummy dum1 address '10.5.4.8/24'
set interfaces tunnel tun0 address '10.255.0.2/30'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 remote '192.0.2.254'
set interfaces tunnel tun0 source-address '192.0.2.1'
set protocols mpls interface 'dum1'
set protocols mpls interface 'tun0'
set protocols mpls ldp discovery transport-ipv4-address '192.0.2.1'
set protocols mpls ldp interface 'dum1'
set protocols mpls ldp interface 'tun0'
set protocols mpls ldp router-id '192.0.2.1'