Page MenuHomeVyOS Platform

n.fort (Nicolas Fort)
User

Projects

User Details

User Since
Jun 9 2021, 3:23 PM (157 w, 6 d)

Recent Activity

Fri, Jun 14

n.fort changed the status of T6488: Firewall op mode output incomplete from Open to Confirmed.
Fri, Jun 14, 7:08 PM · VyOS 1.5 Circinus
n.fort created T6488: Firewall op mode output incomplete.
Fri, Jun 14, 7:08 PM · VyOS 1.5 Circinus
n.fort closed T6394: Migrate conntrack timeout sysctl parameter to firewall as Resolved.
Fri, Jun 14, 7:04 PM · VyOS 1.5 Circinus
n.fort closed T3900: Add support for raw tables to firewall as Resolved.
Fri, Jun 14, 7:04 PM · VyOS 1.5 Circinus

Thu, Jun 6

n.fort changed the status of T3900: Add support for raw tables to firewall from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/3578

Thu, Jun 6, 3:25 PM · VyOS 1.5 Circinus
n.fort changed the status of T6394: Migrate conntrack timeout sysctl parameter to firewall from In progress to Needs testing.

PR: https://github.com/vyos/vyos-1x/pull/3578

Thu, Jun 6, 3:25 PM · VyOS 1.5 Circinus

Wed, Jun 5

n.fort moved T6375: Fix/Update NAT Logging from Need Triage to Finished on the VyOS 1.5 Circinus board.
Wed, Jun 5, 7:02 AM · VyOS 1.5 Circinus, VyOS 1.4 Sagitta
n.fort closed T6375: Fix/Update NAT Logging as Resolved.
Wed, Jun 5, 7:02 AM · VyOS 1.5 Circinus, VyOS 1.4 Sagitta
n.fort closed T6396: MINOR Typo: set system conntrack timeout custom ipv4 rule X as Resolved.
Wed, Jun 5, 7:02 AM · VyOS 1.4 Sagitta (1.4.0-GA), VyOS 1.5 Circinus
n.fort moved T6396: MINOR Typo: set system conntrack timeout custom ipv4 rule X from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-GA) board.
Wed, Jun 5, 7:02 AM · VyOS 1.4 Sagitta (1.4.0-GA), VyOS 1.5 Circinus

Fri, May 24

n.fort changed the status of T6394: Migrate conntrack timeout sysctl parameter to firewall from Open to In progress.
Fri, May 24, 12:34 PM · VyOS 1.5 Circinus
n.fort created T6394: Migrate conntrack timeout sysctl parameter to firewall.
Fri, May 24, 12:33 PM · VyOS 1.5 Circinus

May 17 2024

n.fort added a comment to T6344: multiple ntp listen-address commands not working.

Yeah, my bad!

May 17 2024, 3:02 PM · VyOS 1.4 Sagitta
n.fort added a comment to T6344: multiple ntp listen-address commands not working.

Maybe we should create another xml file identical to listen-address.xml.i but without multi option define in line 16.

May 17 2024, 2:19 PM · VyOS 1.4 Sagitta
n.fort added a comment to T6362: Create a conntrack/translations logger daemon.

Related to https://vyos.dev/T5471 ?

May 17 2024, 10:53 AM · VyOS 1.5 Circinus

May 14 2024

n.fort changed the status of T3900: Add support for raw tables to firewall from Open to In progress.
May 14 2024, 12:31 PM · VyOS 1.5 Circinus
n.fort placed T5497: Add ability to resequence rule numbers for firewall up for grabs.
May 14 2024, 10:56 AM · VyOS 1.4 Sagitta (1.4.0-epa1)

May 10 2024

n.fort closed T5497: Add ability to resequence rule numbers for firewall as Resolved.
May 10 2024, 2:10 PM · VyOS 1.4 Sagitta (1.4.0-epa1)
n.fort added a comment to T5497: Add ability to resequence rule numbers for firewall.

I'm closing this task a solution was included. I'm not in favor of introducing similar command in configuration mode.

May 10 2024, 2:10 PM · VyOS 1.4 Sagitta (1.4.0-epa1)
n.fort added a comment to T5794: Flowtable with Bond Race.

Maybe we should change firewall priority, and make sure all interfaces are defined in the system before loading firewall?

May 10 2024, 1:58 PM · VyOS 1.5 Circinus
n.fort added a comment to T6329: Firewall - Error while printing groups.

PR: https://github.com/vyos/vyos-1x/pull/3442

May 10 2024, 1:39 PM · VyOS 1.4 Sagitta (1.4.0-epa3), VyOS 1.5 Circinus
n.fort changed the status of T6329: Firewall - Error while printing groups from Open to In progress.
May 10 2024, 1:05 PM · VyOS 1.4 Sagitta (1.4.0-epa3), VyOS 1.5 Circinus
n.fort created T6329: Firewall - Error while printing groups.
May 10 2024, 1:05 PM · VyOS 1.4 Sagitta (1.4.0-epa3), VyOS 1.5 Circinus

May 8 2024

n.fort added a comment to T5177: Make the chain policy configurable.

Behavior change for this issue was fix some month ago in migration scripts, in order to remain action "return" when upgrading from older versions to new syntax.

May 8 2024, 4:32 PM · VyOS 1.5 Circinus
n.fort closed T6269: Polixy route "set table" option is not working correctly as Resolved.
May 8 2024, 4:20 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6305: IPoE interface wildcard validation error in firewall rules as Resolved.
May 8 2024, 4:19 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

May 7 2024

n.fort closed T6265: Firewall flowtable should allow ethernet only interfaces as Invalid.

Further tests in lab shows that non-ehternet interfaces are needed in order to offload traffic as expected. An example is when using wireguard interface: in order to offload traffic, it's necessary to add interface wgX to the flowtable.
Otherwise, it won't work as expected

May 7 2024, 4:52 PM · VyOS 1.5 Circinus
n.fort added a comment to T6305: IPoE interface wildcard validation error in firewall rules.

PR: https://github.com/vyos/vyos-1x/pull/3424

May 7 2024, 3:25 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6305: IPoE interface wildcard validation error in firewall rules from Open to In progress.
May 7 2024, 3:06 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

May 6 2024

n.fort claimed T6305: IPoE interface wildcard validation error in firewall rules.
May 6 2024, 7:14 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6265: Firewall flowtable should allow ethernet only interfaces.

And similar example, using same interfaces and host, but instead of GRE tunnel, using a Wireguard site to site tunnel:

May 6 2024, 5:13 PM · VyOS 1.5 Circinus
n.fort added a comment to T6265: Firewall flowtable should allow ethernet only interfaces.

Example of using flowtables on mater interfaces, and communication between a local host that is on a VLAN (vlan eth2.22 and host 10.22.22.222), and a remote host that is reachable through a GRE tunnel (tunnel established using interface eth0):

May 6 2024, 5:12 PM · VyOS 1.5 Circinus
n.fort changed the status of T6265: Firewall flowtable should allow ethernet only interfaces from Open to In progress.
May 6 2024, 3:28 PM · VyOS 1.5 Circinus
n.fort added a comment to T6265: Firewall flowtable should allow ethernet only interfaces.

PR: https://github.com/vyos/vyos-1x/pull/3414

May 6 2024, 3:28 PM · VyOS 1.5 Circinus
n.fort added a comment to T6288: policy route ipv4 rule order behaviour.

Can you try with newver version?
New fixes were applied.
You can check this tasks:
https://vyos.dev/T6269
https://vyos.dev/T6191

May 6 2024, 11:31 AM · VyOS 1.5 Circinus

Apr 26 2024

n.fort added a comment to T6269: Polixy route "set table" option is not working correctly.

PR: https://github.com/vyos/vyos-1x/pull/3367

Apr 26 2024, 2:21 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6269: Polixy route "set table" option is not working correctly from Open to In progress.
Apr 26 2024, 12:43 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort created T6269: Polixy route "set table" option is not working correctly.
Apr 26 2024, 12:43 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 22 2024

n.fort created T6257: Add op mode commands for dynamic firewall address groups.
Apr 22 2024, 3:08 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort raised the priority of T4853: OpenVPN: unable to commit changes when the interface is down/unknown state from Normal to High.

Any news about this issue @SrividyaA and @c-po ?

Apr 22 2024, 2:53 PM · VyOS 1.3 Equuleus (1.3.8)

Apr 21 2024

n.fort moved T5535: Move disable-directed-broadcast to firewall global-options from Need Triage to Finished on the VyOS 1.5 Circinus board.
Apr 21 2024, 6:55 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort moved T5535: Move disable-directed-broadcast to firewall global-options from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
Apr 21 2024, 6:55 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T5535: Move disable-directed-broadcast to firewall global-options as Resolved.
Apr 21 2024, 6:54 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort moved T6191: Policy route set-mss option is not working correctly from Need Triage to Finished on the VyOS 1.5 Circinus board.
Apr 21 2024, 6:54 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6191: Policy route set-mss option is not working correctly as Resolved.
Apr 21 2024, 6:54 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 19 2024

n.fort added a project to T5153: OpenConnect route restriction via iptables is ignored: VyOS 1.3 Equuleus (1.3.7).
Apr 19 2024, 9:46 AM · VyOS 1.3 Equuleus (1.3.8), VyOS 1.5 Circinus
n.fort added a comment to T5153: OpenConnect route restriction via iptables is ignored.

And do you have similar setup and situation in newer version?

Apr 19 2024, 9:46 AM · VyOS 1.3 Equuleus (1.3.8), VyOS 1.5 Circinus

Apr 18 2024

n.fort added a comment to T5153: OpenConnect route restriction via iptables is ignored.

Output seems to be for VyOS 1.3, rather than 1.5
Can you show VyOS version @PeppyH ?

Apr 18 2024, 5:21 PM · VyOS 1.3 Equuleus (1.3.8), VyOS 1.5 Circinus

Apr 17 2024

n.fort added a comment to T6247: Add CGN "full cone" EIF support per RFC6888 REQ-7.

I saw such repository more than once, but it seems that it has been abandoned. Last commit is dated two years ago.

Apr 17 2024, 7:01 PM
n.fort changed the status of T5535: Move disable-directed-broadcast to firewall global-options from Confirmed to Needs testing.
Apr 17 2024, 8:57 AM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6191: Policy route set-mss option is not working correctly from Confirmed to Needs testing.
Apr 17 2024, 8:56 AM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 16 2024

n.fort added a comment to T6191: Policy route set-mss option is not working correctly.

PR: https://github.com/vyos/vyos-1x/pull/3320

Apr 16 2024, 5:51 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed Version from 1.4.0-epa2 to 1.4.0-epa2, 1.5-rolling-202404141045 on T6191: Policy route set-mss option is not working correctly.
Apr 16 2024, 4:57 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6191: Policy route set-mss option is not working correctly from Open to Confirmed.
Apr 16 2024, 4:57 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 15 2024

n.fort added a comment to T5535: Move disable-directed-broadcast to firewall global-options.

PR: https://github.com/vyos/vyos-1x/pull/3309

Apr 15 2024, 2:25 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T5535: Move disable-directed-broadcast to firewall global-options from Open to Confirmed.
Apr 15 2024, 10:12 AM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 12 2024

n.fort closed T6214: Error when using some constraints as Resolved.
Apr 12 2024, 5:29 PM · VyOS 1.4 Sagitta (1.4.0-epa2)
n.fort moved T6213: Validations in firewall groups mistakenly reject correct configurations from Need Triage to Finished on the VyOS 1.4 Sagitta board.
Apr 12 2024, 5:28 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort moved T6213: Validations in firewall groups mistakenly reject correct configurations from Need Triage to Finished on the VyOS 1.5 Circinus board.
Apr 12 2024, 5:28 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6213: Validations in firewall groups mistakenly reject correct configurations as Resolved.
Apr 12 2024, 5:28 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 10 2024

n.fort claimed T6216: Firewall group names that contain the '+' character break the config.
Apr 10 2024, 2:34 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6216: Firewall group names that contain the '+' character break the config, a subtask of T5938: Migration fail root task for 1.4-rc, from Confirmed to In progress.
Apr 10 2024, 2:01 PM · VyOS 1.4 Sagitta (1.4.0-GA)
n.fort changed the status of T6216: Firewall group names that contain the '+' character break the config from Confirmed to In progress.
Apr 10 2024, 2:01 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6216: Firewall group names that contain the '+' character break the config.

PR: https://github.com/vyos/vyos-1x/pull/3290

Apr 10 2024, 2:01 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 9 2024

n.fort added a subtask for T5938: Migration fail root task for 1.4-rc: T6216: Firewall group names that contain the '+' character break the config.
Apr 9 2024, 12:20 PM · VyOS 1.4 Sagitta (1.4.0-GA)
n.fort added a parent task for T6216: Firewall group names that contain the '+' character break the config: T5938: Migration fail root task for 1.4-rc.
Apr 9 2024, 12:20 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6216: Firewall group names that contain the '+' character break the config from Open to Confirmed.
Apr 9 2024, 12:11 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort created T6216: Firewall group names that contain the '+' character break the config.
Apr 9 2024, 12:11 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6213: Validations in firewall groups mistakenly reject correct configurations.

PR: https://github.com/vyos/vyos-1x/pull/3281

Apr 9 2024, 11:13 AM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6214: Error when using some constraints.

PR: https://github.com/vyos/vyos-1x/pull/3281

Apr 9 2024, 11:13 AM · VyOS 1.4 Sagitta (1.4.0-epa2)
n.fort renamed T6214: Error when using some constraints from Error when using some contraints to Error when using some constraints.
Apr 9 2024, 9:45 AM · VyOS 1.4 Sagitta (1.4.0-epa2)
n.fort created T6214: Error when using some constraints.
Apr 9 2024, 9:44 AM · VyOS 1.4 Sagitta (1.4.0-epa2)

Apr 8 2024

n.fort moved T6068: Support active-active and active-passive high availability modes in DHCP server from Need Triage to Finished on the VyOS 1.5 Circinus board.
Apr 8 2024, 12:04 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort moved T6068: Support active-active and active-passive high availability modes in DHCP server from Need Triage to Finished on the VyOS 1.4 Sagitta board.
Apr 8 2024, 12:03 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6068: Support active-active and active-passive high availability modes in DHCP server as Resolved.
Apr 8 2024, 12:03 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6213: Validations in firewall groups mistakenly reject correct configurations from Open to In progress.
Apr 8 2024, 11:12 AM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort created T6213: Validations in firewall groups mistakenly reject correct configurations.
Apr 8 2024, 11:11 AM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 5 2024

n.fort changed the status of T6205: ipoe: error in migration script logic while renaming mac-address to mac, a subtask of T5938: Migration fail root task for 1.4-rc, from Open to Confirmed.
Apr 5 2024, 2:59 PM · VyOS 1.4 Sagitta (1.4.0-GA)
n.fort changed the status of T6205: ipoe: error in migration script logic while renaming mac-address to mac from Open to Confirmed.
Apr 5 2024, 2:59 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Apr 3 2024

n.fort added a comment to T6171: Rename the DHCP server "failover" command to "high-availability mode".

PR for Sagitta: https://github.com/vyos/vyos-1x/pull/3239

Apr 3 2024, 6:09 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6068: Support active-active and active-passive high availability modes in DHCP server.

PR for Sagitta: https://github.com/vyos/vyos-1x/pull/3239

Apr 3 2024, 6:09 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6200: Error on adding a wildcard interface.

Try with:

Apr 3 2024, 6:08 PM · VyOS 1.4 Sagitta

Mar 25 2024

n.fort added a comment to T6171: Rename the DHCP server "failover" command to "high-availability mode".

PR for current: https://github.com/vyos/vyos-1x/pull/3188

Mar 25 2024, 6:40 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6171: Rename the DHCP server "failover" command to "high-availability mode" from Open to In progress.
Mar 25 2024, 2:42 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort created T6171: Rename the DHCP server "failover" command to "high-availability mode".
Mar 25 2024, 2:41 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Mar 22 2024

n.fort closed T6110: Insufficient validation of range option with failover in DHCP server as Resolved.
Mar 22 2024, 3:07 PM · VyOS 1.3 Equuleus (1.3.7)
n.fort moved T6136: Configuring a dynamic address group, config script did not check whether the group was created from Need Triage to Finished on the VyOS 1.5 Circinus board.
Mar 22 2024, 3:05 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6136: Configuring a dynamic address group, config script did not check whether the group was created as Resolved.
Mar 22 2024, 3:05 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort moved T6090: Migration of "policy route" configs fails due to TCP flag case sensitivity from Need Triage to Finished on the VyOS 1.5 Circinus board.
Mar 22 2024, 3:04 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort closed T6090: Migration of "policy route" configs fails due to TCP flag case sensitivity, a subtask of T5938: Migration fail root task for 1.4-rc, as Resolved.
Mar 22 2024, 3:04 PM · VyOS 1.4 Sagitta (1.4.0-GA)
n.fort closed T6090: Migration of "policy route" configs fails due to TCP flag case sensitivity as Resolved.
Mar 22 2024, 3:04 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6068: Support active-active and active-passive high availability modes in DHCP server.
Mar 22 2024, 2:40 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6068: Support active-active and active-passive high availability modes in DHCP server from Open to In progress.
Mar 22 2024, 10:59 AM · VyOS 1.4 Sagitta (1.4.0-epa3)

Mar 20 2024

n.fort added a project to T6147: Conntrack not working as expected with global state-policy: VyOS 1.5 Circinus.
Mar 20 2024, 6:56 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort changed the status of T6147: Conntrack not working as expected with global state-policy from Open to Confirmed.
Mar 20 2024, 6:52 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort created T6147: Conntrack not working as expected with global state-policy.
Mar 20 2024, 6:51 PM · VyOS 1.4 Sagitta (1.4.0-epa3)

Mar 19 2024

n.fort changed the status of T6136: Configuring a dynamic address group, config script did not check whether the group was created from In progress to Needs testing.
Mar 19 2024, 8:36 AM · VyOS 1.4 Sagitta (1.4.0-epa3)

Mar 18 2024

n.fort changed the status of T6136: Configuring a dynamic address group, config script did not check whether the group was created from Confirmed to In progress.
Mar 18 2024, 3:01 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6136: Configuring a dynamic address group, config script did not check whether the group was created.

And a simple note for your usage @wenzk
Change
set firewall ipv4 name WAN_IN rule 30 icmp
to this:
set firewall ipv4 name WAN_IN rule 30 protocol icmp

Mar 18 2024, 3:00 PM · VyOS 1.4 Sagitta (1.4.0-epa3)
n.fort added a comment to T6136: Configuring a dynamic address group, config script did not check whether the group was created.

PR: https://github.com/vyos/vyos-1x/pull/3146

Mar 18 2024, 2:57 PM · VyOS 1.4 Sagitta (1.4.0-epa3)