I've done test , regarding the original issues that it was nat+route-leaking (default + foo) , which is working on the last rolling (VyOS 1.4-rolling-202305140317). however, I've tried some test using two vrf+route-leaking and NAT , I can replicated the issue:
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
May 17 2023
May 17 2023
GitHub <[email protected]> committed rVYOSONEX9e9794a763e7: Merge pull request #2004 from sever-sever/T5222 (authored by c-po).
Restricted Repository Identity closed T5226: Deduplicate and standardize validators and constraints for hostname and IP address as Resolved by committing rVYOSONEX0c91c356183b: Merge pull request #2008 from indrajitr/misc-conf-mode-fixes.
GitHub <[email protected]> committed rVYOSONEX0c91c356183b: Merge pull request #2008 from indrajitr/misc-conf-mode-fixes (authored by c-po).
GitHub <[email protected]> committed rVYOSONEXd9c495144d1b: Merge pull request #2009 from indrajitr/mdns-improvements (authored by c-po).
Viacheslav changed the subtype of T5227: mDNS reflector should allow additional domains to browse and allow filtering services from "Task" to "Feature Request".
@ddominet the correct syntax
set protocols bgp neighbor 192.0.2.11 address-family ipv6-unicast allowas-in number 1
indrajitr changed the status of T5226: Deduplicate and standardize validators and constraints for hostname and IP address from Open to In progress.
May 16 2023
May 16 2023
I've managed to adapt Alpine Linux patches to build Debian 11 StrongSwan 5.9.1 package, feel free to use it
0010-charon-add-optional-source-and-remote-overrides-for-.patch22 KBDownload
In T3655#148609, @bbabich wrote:In T3655#131502, @Viacheslav wrote:I have NAT working with vrf in VyOS 1.4-rolling-202208290458 + custom nat offload
set interfaces ethernet eth0 address '192.168.122.14/24' set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 vrf 'foo' set protocols static route 192.0.2.0/24 interface eth1 vrf 'foo' set system conntrack set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 interface 'eth0' set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 vrf 'default' set vrf name foo table '1010'Nftables
root@r14:/home/vyos# cat nat.nft flush ruleset table ip filter { flowtable fastnat { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @fastnat } } table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.0.2.0/24 oif "eth0" snat to 192.168.122.14 persistent } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; } }Conntrack table
vyos@r14:~$ sudo conntrack -F conntrack v1.4.6 (conntrack-tools): connection tracking table has been emptied. vyos@r14:~$ vyos@r14:~$ sudo conntrack -L tcp 6 431999 ESTABLISHED src=192.168.122.14 dst=192.168.122.1 sport=22 dport=44462 src=192.168.122.1 dst=192.168.122.14 sport=44462 dport=22 [ASSURED] mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33018 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33018 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=37517 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=37517 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=59794 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=59794 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39288 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39288 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39616 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39616 [OFFLOAD] mark=0 use=2 icmp 1 29 src=192.0.2.2 dst=1.1.1.1 type=8 code=0 id=12387 src=1.1.1.1 dst=192.168.122.14 type=0 code=0 id=12387 mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=41155 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=41155 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39829 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39829 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33655 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33655 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=44835 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=44835 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=40213 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=40213 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33729 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33729 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=48344 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=48344 [OFFLOAD] mark=0 use=2 conntrack v1.4.6 (conntrack-tools): 14 flow entries have been shown. vyos@r14:~$This works for me too on current rolling releases from Jan-2023 to now.
indrajitr changed the status of T5144: Modernize dynamic dns operation from Needs testing to In progress.
May 15 2023
May 15 2023
I reproduced the problem.
I received the next logs
Viacheslav changed the status of T5197: Conntrack-sync external cache commit error from Open to Needs testing.
Version 1.4-rolling-202305150317 does not have the problem.
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
This can be closed now. I've submitted a Documentation PR
May 14 2023
May 14 2023
GitHub <[email protected]> committed rVYOSONEXe02a722a3e95: Merge pull request #2006 from frebib/frebib/T5224 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX9e287778e073: Merge pull request #2007 from frebib/veth-netns-revert (authored by c-po).
Fixing that causes this to also be logged. We should probably stop the socket too
frebib@vyos# commit [ system syslog ] DEBUG/COMMAND returned (err): Warning: Stopping syslog.service, but it can still be activated by: syslog.socket DEBUG/COMMAND cmd 'systemctl stop syslog.service'
Unknown Object (User) created T5223: tunnel key doesn't clear .
May 13 2023
May 13 2023
May 12 2023
May 12 2023
We should make the ssl-bind ciphers and ssl-bind-options configurable (<multi/> node) by the user
GitHub <[email protected]> committed rVYOSONEX380bc7ddf6b9: T2778: Fix syslog octet_counted format (authored by Bᴇʀɴᴅ Sᴄʜᴏʀɢᴇʀs <[email protected]>).
GitHub <[email protected]> committed rVYOSONEX25ddb57b66de: Merge pull request #2003 from bjw-s/octet_counted (authored by c-po).
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
GitHub <[email protected]> committed rVYOSONEXc60e9c932cab: Merge pull request #1783 from PeppyH/T3896-ocserv-config-per-x (authored by c-po).
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
Viacheslav updated the task description for T5222: Add load-balancing reverse-proxy based on haproxy .
GitHub <[email protected]> committed rVYOSONEX0224707acc72: Merge pull request #2002 from Zen3515/fix-cloudflare-ddns (authored by c-po).
In T3655#131502, @Viacheslav wrote:I have NAT working with vrf in VyOS 1.4-rolling-202208290458 + custom nat offload
set interfaces ethernet eth0 address '192.168.122.14/24' set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 vrf 'foo' set protocols static route 192.0.2.0/24 interface eth1 vrf 'foo' set system conntrack set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 interface 'eth0' set vrf name foo protocols static route 0.0.0.0/0 next-hop 192.168.122.1 vrf 'default' set vrf name foo table '1010'Nftables
root@r14:/home/vyos# cat nat.nft flush ruleset table ip filter { flowtable fastnat { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @fastnat } } table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.0.2.0/24 oif "eth0" snat to 192.168.122.14 persistent } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; } }Conntrack table
vyos@r14:~$ sudo conntrack -F conntrack v1.4.6 (conntrack-tools): connection tracking table has been emptied. vyos@r14:~$ vyos@r14:~$ sudo conntrack -L tcp 6 431999 ESTABLISHED src=192.168.122.14 dst=192.168.122.1 sport=22 dport=44462 src=192.168.122.1 dst=192.168.122.14 sport=44462 dport=22 [ASSURED] mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33018 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33018 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=37517 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=37517 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=59794 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=59794 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39288 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39288 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39616 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39616 [OFFLOAD] mark=0 use=2 icmp 1 29 src=192.0.2.2 dst=1.1.1.1 type=8 code=0 id=12387 src=1.1.1.1 dst=192.168.122.14 type=0 code=0 id=12387 mark=0 use=1 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=41155 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=41155 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=39829 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=39829 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33655 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33655 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=44835 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=44835 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=40213 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=40213 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=33729 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=33729 [OFFLOAD] mark=0 use=2 udp 17 src=192.0.2.2 dst=1.1.1.1 sport=48344 dport=53 src=1.1.1.1 dst=192.168.122.14 sport=53 dport=48344 [OFFLOAD] mark=0 use=2 conntrack v1.4.6 (conntrack-tools): 14 flow entries have been shown. vyos@r14:~$
Viacheslav changed the status of T5221: BGP as-override behavior differs from new FRR and other vendors from In progress to Needs testing.
Viacheslav edited projects for T5221: BGP as-override behavior differs from new FRR and other vendors, added: VyOS 1.3 Equuleus (1.3.3); removed VyOS 1.3 Equuleus.
Viacheslav renamed T5222: Add load-balancing reverse-proxy based on haproxy from Add loadbalancing based on haproxy to Add load-balancing based on haproxy .
PR with the fix: https://github.com/vyos/vyos-build/pull/350
zsdc changed the status of T5221: BGP as-override behavior differs from new FRR and other vendors from Open to In progress.
In T5186#148559, @c-po wrote:Reverted Kernel back to 5.4.234 for upcoming 1.3.3. release.
Zen3515 changed the status of T5219: ddclient: Cloudflare doesn't require login from Open to In progress.
I've create a pull request for this task at https://github.com/vyos/vyos-1x/pull/2002
Reverted Kernel back to 5.4.234 for upcoming 1.3.3. release.
c-po closed T2778: Migrate "system syslog" to get_config_dict() to support new features as Resolved.
c-po moved T2778: Migrate "system syslog" to get_config_dict() to support new features from Backlog to Finished on the VyOS 1.4 Sagitta board.
c-po changed the status of T2769: Add VRF support for syslog, a subtask of T2778: Migrate "system syslog" to get_config_dict() to support new features, from Unknown Status to Resolved.
GitHub <[email protected]> committed rVYOSONEX0b85c416525e: Merge pull request #2001 from c-po/t2769-syslog-vrf-backport (authored by Viacheslav).
GitHub <[email protected]> committed rVYOSONEX25545b1e3cf2: Merge pull request #1999 from dmbaturin/T5251-vrrp-group-ping-fix (authored by jestabro).
May 11 2023
May 11 2023
GitHub <[email protected]> committed rVYOSONEX59b8b3879a3f: Merge pull request #1998 from sever-sever/T5171 (authored by c-po).
c-po moved T2769: Add VRF support for syslog from Backlog to Finished on the VyOS 1.4 Sagitta board.
c-po moved T2769: Add VRF support for syslog from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
Backport for 1.3.3 https://github.com/vyos/vyos-1x/pull/2001
GitHub <[email protected]> committed rVYOSONEXd051e9def858: Merge pull request #2000 from dmbaturin/T5195-remove-snake-case-function (authored by jestabro).
Viacheslav edited projects for T5219: ddclient: Cloudflare doesn't require login, added: VyOS 1.4 Sagitta; removed ddclient.
@c-po I guess it should be v5.4.234
In T4362#148361, @masterit wrote:one issue.
the migration scripts don't take into account older load balancing configs.if the test > rule > type > ping isn't explicitly set then the rule defaults to the next hop address and ignores the rule entirely.
the default rule seems to be the next hop address for the interface.
Viacheslav added a comment to T5171: Use XML for conf-mode "load-balancing wan" instead of legacy templates.
set default check type ping https://github.com/vyos/vyos-1x/pull/1998
Zen3515 added a comment to T4983: `shutdown_required` should be set when running command `connect interface wwan0`.
This issue was tested in two version which are
1.4-rolling-202212080318
1.4-rolling-202209130217
mkorobeinikov <[email protected]> committed rVYOSONEX292ac4e7c4d4: T5158: Refactoring the commad '$ sh interfaces counters'.
GitHub <[email protected]> committed rVYOSONEXc3f957b9bfc7: Merge pull request #1956 from mkorobeinikov/current (authored by c-po).
Viacheslav changed the status of T5213: Accel-ppp sending accounting interim updates acct-interim-interval option from In progress to Needs testing.
Veth is not ready to work together with netns
As Interface moves entirely to logical stack and with the next commit will be recreated and try to move to netns again. As it doesn't see veth interface which moved to another logical stack, it tryes to recreate this interface.
We should either fix it or revert the previous commit.