The quickfix is to add a space for your paths so something that looks like /usr/local/bin if cloudflare blocks that you just add a space after the first / and the WAF is bypassed.

PR: https://github.com/vyos/vyos-1x/pull/2300

Ehm, that hint already exists at line 2 of that file?

This is likely also the issue causing T5376

PRs:
https://github.com/vyos/vyos-1x/pull/2298
https://github.com/vyos/vyatta-op/pull/71
https://github.com/vyos/vyos-build/pull/419

Great, Thanks!

Oops, sorry about that!

@Apachez It is not FQDN based

Should I ask this to you.

In T5601#160566, @vvinci00 wrote:

Hello,

I need to reverse proxy TCP traffic.
the traffic is not HTTP/HTTPS

PR created: https://github.com/vyos/vyos-build/pull/418

Contact our sales or ask forum

It's possible to use VyOS as reverse proxy on TCP traffic (not HTTP)?
if yes, what configuration it's necessary?
if not, do you know any solutions that can help me?

In T5601#160566, @vvinci00 wrote:

Hello,

I need to reverse proxy TCP traffic.
the traffic is not HTTP/HTTPS

I need to reverse proxy TCP traffic.
the traffic is not HTTP/HTTPS

set netns name mgmt
set interfaces virtual-ethernet veth1 address '10.0.0.0/31'
set interfaces virtual-ethernet veth1 peer-name 'veth10'
set interfaces virtual-ethernet veth10 address '10.0.0.1/31'
set interfaces virtual-ethernet veth10 netns 'mgmt'
set interfaces virtual-ethernet veth10 peer-name 'veth1'

PR https://github.com/vyos/vyos-1x/pull/2295

set system sysctl parameter net.ipv4.tcp_syncookies value '1'
set system sysctl parameter net.ipv4.tcp_timestamps value '1'

PR https://github.com/vyos/vyos-1x/pull/2294

You do not use port 80/443, so it does not have HTTP-HEADER (in theory).

service LB_port_451 {
    listen-address 10.1.1.1
    mode tcp
    port 451

Try to change to port 80 and check if it works.
You need another solution/configuration

Some highly unscientific tests (only did 3 reboots of each to rule out that any uncached data at the host would affect the result since I run this in a VM through VirtualBox 7.0) shows a difference of up to 2.1% improvment when having a config with 200 static routes.

Parent task is completed - Bugs will get their own subtask and linked to this parent if possible.

This should fix the hostname issue reported to BGP neighbors: https://github.com/vyos/vyos-1x/pull/2289

In T4502#160404, @Apachez wrote:

Perhaps a possible way to detect if the nic supports hardware flowtables or not.

Try to set sudo ethtool -K eth0 hw-tc-offload on.

If the result becomes:

Actual changes:
hw-tc-offload: off [requested on]
Could not change any device features

Then it doesnt support hardware flowtables.

Could also verify by reading the capability like so:

$ ethtool -k eth0 | grep hw-tc-offload
hw-tc-offload: off [fixed]

Perhaps a possible way to detect if the nic supports hardware flowtables or not.

Some feedback from the #netfilter channel over at libera.chat:

I got some funny results which I hope somebody else (with a faster cpu) are able to verify?