♟ n.fort

I'm closing this one. No news in the last year, and the tests I've done last month were ok.

Are you using vrf? Maybe it's an issue and router can't resolve dns for ntp servers

Adding geo-ip and fqnd too:
https://github.com/vyos/vyos-1x/pull/2188

Fixed on this op-mode commands were introduced on PR https://github.com/vyos/vyos-1x/pull/2186

Corrections and improvements were applied. Please check on next rolling release

Closing this task because better way to match multiple interfaces in firewall rules would be using interface groups.

Missing vrrp cli version in last line in config.boot file:

This delay is not only present in latest version. Huge firewall (and not only firewall) config leads to more processing while committing changes.
Bare in mind that for every firewall config command, python scripts are invoked for sanity checks and for config generation.
If direct nft commands are used, then all this scripts are not called.

There's request for fib matcher: https://vyos.dev/T5119
It would be useful if you could propose cli design for this feature in that task, so we can discuss about it and then work on adding it

2.1:
Suggestion that established/related merges to a single rule such as:

Some internal test where done, using integration between:

Traffic shaper. Currently supported in vyos cli
Bridge firewall. Currently not supported in vyos cli.

Not only affects, smoketest.. nat66 got broken

Thanks for testing and submitting PR

Can you check changing

Re opening this task. Migration script needs to be added.

vyos@nat-lb-july# run show config comm | grep nat
set nat destination rule 10 destination port '443'
set nat destination rule 10 inbound-interface 'eth3'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation load-balance mode 'round-robin'
set nat destination rule 10 translation load-balance translation-address 1.1.1.1 hash-value '0'
set nat destination rule 10 translation load-balance translation-address 2.2.2.2 hash-value '1'
set nat destination rule 10 translation load-balance translation-address 3.3.3.3 hash-value '2'
set nat destination rule 10 translation load-balance upper-limit '3'
set nat destination rule 20 destination port '53'
set nat destination rule 20 inbound-interface 'eth3'
set nat destination rule 20 protocol 'udp'
set nat destination rule 20 translation load-balance mode 'random'
set nat destination rule 20 translation load-balance translation-address 1.1.1.1 hash-value '0-24'
set nat destination rule 20 translation load-balance translation-address 2.2.2.2 hash-value '25-49'
set nat destination rule 20 translation load-balance translation-address 3.3.3.3 hash-value '50-99'
set nat destination rule 20 translation load-balance upper-limit '100'
set system host-name 'nat-lb-july'
[edit]

n.fort (Nicolas Fort)
User

Projects

User Details

Recent Activity
View All

Wed, Sep 27

Tue, Sep 26

Thu, Sep 21

Tue, Sep 19

Mon, Sep 18

Thu, Sep 14

Wed, Sep 13

Tue, Sep 12

Mon, Sep 11

Fri, Sep 8

Thu, Sep 7

Wed, Sep 6

Tue, Sep 5

Wed, Aug 30

Aug 25 2023

Aug 23 2023

Aug 22 2023

Aug 15 2023

Aug 14 2023

Aug 11 2023

Aug 10 2023

Aug 9 2023

Aug 8 2023

Aug 7 2023

Aug 3 2023

Jul 31 2023

Jul 27 2023

Jul 26 2023

Jul 25 2023

Jul 24 2023

Jul 21 2023

Jul 20 2023

n.fort (Nicolas Fort)User