The new firewall implementation makes this no longer relevant.

In T1019#26665, @runar wrote:

Hmm, please enligthen me. Google BBR is a new way to handle congesition instead of the traditional way tcp deals with it. This functionallity needs to be enabled in the end host systems starting the tcp session to have any impact on troughput and congestion control.. as vyos is a router and are not responsible to start tcp sessions on behalf of any end system, what is the benefit of adding this functionallity?

This bug has been raised for 2 years and has not been closed yet. Is it because it has not been resolved?

Just my thoughts - there are situations where rp_filter is not sufficient, and it was not clear to me how to do this cleanly with the zone firewall, so I ended up hacking a few iptables commands in rc.local instead.

I need to modify the file(/etc/swanctl/swanctl.conf) manually, from emote_ts = dynamic[gre] to remote_ts = 0.0.0.0/0[gre].

I test that issue on 1.2.5. but not work

You can consider submitting a PR request in a rolling branch that has requested a merge.

I'm still seeing this in VyOS 1.3-rolling-202004170117

Pull Request: https://github.com/vyos/ppp-upstream/pull/2

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8597

I send a pull request to fix it:

We took other steps that allows us to take the image back to a manageable size, and this task lost its immediate relevance.

I think we can close this task.
Nothing like that has happened in the last few months.