PR: https://github.com/vyos/vyos-1x/pull/1881

My bad

Discovered a couple of problems with chrony using the existing CLI.

PR: https://github.com/vyos/vyos-1x/pull/1863

Have started work on migrating isc-dhcp v4/v6 server to Kea.

PR: https://github.com/vyos/vyos-1x/pull/1840

Builds completing. ISO worker on Jenkins should be fixed and pushing new rolling images shortly.

https://github.com/vyos/vyos-build/pull/306
https://github.com/vyos/vyos-1x/pull/1817
https://github.com/vyos/vyatta-cfg/pull/60
https://github.com/vyos/vyos-http-api-tools/pull/3

In T3871#141847, @jestabro wrote:

Before adopting the approach mentioned above, there was development of an alternative using pyudev within an 'interface-monitor' daemon; the following branches contain (a version of) the rebased code. It would need a few hours of attention to check the logic and add the is_persistent check from vyos-interface-rescan.py; it could use some refactoring as well.

https://github.com/vyos/vyos-1x/compare/current...jestabro:vyos-1x:interface-monitor
https://github.com/vyos/vyatta-cfg/compare/current...jestabro:vyatta-cfg:interface-monitor
https://github.com/vyos/vyos-build/compare/current...jestabro:vyos-build:interface-monitor

Fixed in commit: https://github.com/vyos/vyos-1x/commit/6eea12512e59cc28f5c2e5ca5ec7e9e7b21731da

Draft PR: https://github.com/vyos/vyos-1x/pull/1740

PR to fix recursion check: https://github.com/vyos/vyos-1x/pull/1691

PR: https://github.com/vyos/vyos-1x/pull/1674

PR for policy route refactor updates to vyos_mangle: https://github.com/vyos/vyos-1x/pull/1654

PR adds groups to NAT: https://github.com/vyos/vyos-1x/pull/1633

PR: https://github.com/vyos/vyos-1x/pull/1633

Adds firewall node rule N source/destination fqdn domain.com for single domains per rule and refactors resolver daemon.

Good point, I'll try and look into this and see if it can be handled everywhere the new PKI nodes are used.

PR: https://github.com/vyos/vyos-1x/pull/1628

Best suggestion seems to be introducing a script to call podman stop -t N on shutdown/reboot to reduce the timeout before SIGKILL is sent.

1.4 PR: https://github.com/vyos/vyos-1x/pull/1621

PR: https://github.com/vyos/vyos-1x/pull/1618

PR: https://github.com/vyos/vyos-1x/pull/1577

PR: https://github.com/vyos/vyos-1x/pull/1577

PR: https://github.com/vyos/vyos-1x/pull/1564

Can we see example destination NAT config with the issue?

Included a fix for this in NAT refactor: https://github.com/vyos/vyos-1x/pull/1552

PR for NAT included with refactor: https://github.com/vyos/vyos-1x/pull/1552

Refactor PR: https://github.com/vyos/vyos-1x/pull/1534

PR for filter tables: https://github.com/vyos/vyos-1x/pull/1534

In T1185#133941, @roedie wrote:

Just a suggestion, would it be a weird idea to move the firewall config from the interface section to the firewall section? A bit like the zone config. So something like:

set firewall local interface eth0 name <firewall-filter>
set firewall in interface eth0 name <firewall-filter>
set firewall out interface eth0 name <firewall-filter>
set firewall local interface bond0.10v22v6 ipv6-name <firewall-filter>

The problem is that using zone-policy firewall is a bit overkill for a pure router or even a router with async routing. In which scenario I guess only the local variant would be useful.

Not supported at the moment, but we can look into adding it for both ipv4/v6 in 1.4

While I'm for changing to prefixed tables, I think the issue of tailscale and custom apps should fall under the accepted risk of running custom scripts outside of the config.

Any config available to test against?

I think there's still a problem possible with /var/log/messages handling:

PR: https://github.com/vyos/vyos-1x/pull/1398

Confirmed issue, seems to be a problem in rsyslog/logrotate. Possibly related to T4250

PR: https://github.com/vyos/vyos-1x/pull/1394

Inverse match PR: https://github.com/vyos/vyos-1x/pull/1386

If the counters are visible and incrementing when checking with nft list table ip filter then I don't think this is an implementation issue. Wondering if its a problem with the syslog daemon.

PR: https://github.com/vyos/vyos-1x/pull/1380

PR: https://github.com/vyos/vyos-1x/pull/1368

PR: https://github.com/vyos/vyos-1x/pull/1362

PR: https://github.com/vyos/vyos-1x/pull/1361

Working on moving groups to named set as part of a refactor in some firewall code.

PR: https://github.com/vyos/vyos-1x/pull/1357

PR: https://github.com/vyos/vyos-1x/pull/1356

PR for op-mode importing existing PKI files into config: https://github.com/vyos/vyos-1x/pull/1343

In T1230#123939, @panachoi wrote:

1.4 rolling does not help me, so there must be something "wrong" with my configuration. I've attached the private config, it would be awesome if someone might find what's broken.

private.cfg127 KBDownload

@panachoi If you can share the anonymized config that works in 1.2.8 that would be useful. I'd expect migrating to 1.4 to see a decent improvement in firewall load times.

30 largest packages in 1.4 dev build:

telegraf 144 MB
linux-image-5.10.109-amd64-vyos 107 MB
libwireshark14 100 MB
vyos-linux-firmware 68.8 MB
containernetworking-plugins 51.2 MB
vyos-http-api-tools 40.4 MB
podman 37.3 MB
python3-pycryptodome 36.0 MB
libicu67 33.9 MB
vim-runtime 32.9 MB
vyos-1x 29.2 MB
libperl5.32 28.5 MB
salt-common 27.9 MB
nmap-common 21.2 MB
frr 20.2 MB
libruby2.7 17.9 MB
coreutils 17.9 MB
perl-modules-5.32 17.9 MB
grub-common 17.8 MB
systemd 16.4 MB
locales 16.4 MB
libc6 13.1 MB
pmacct 13.0 MB
ieee-data 12.3 MB
vyos-intel-qat 11.7 MB
aptitude-common 10.3 MB
gdb 10.0 MB
udev 9,184 kB
grub-efi-amd64-bin 8,831 kB
squid 8,582 kB

PR: https://github.com/vyos/vyos-1x/pull/1275

Perhaps only in-use sets can be determined and loaded?

Error implies that firewall failed to configure on boot as mangle table is missing. Any logs/config trace from boot?