diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i
index fcb24abe2..3ecf124c7 100644
--- a/interface-definitions/include/version/system-version.xml.i
+++ b/interface-definitions/include/version/system-version.xml.i
@@ -1,3 +1,3 @@
<!-- include start from include/version/system-version.xml.i -->
-<syntaxVersion component='system' version='27'></syntaxVersion>
+<syntaxVersion component='system' version='28'></syntaxVersion>
<!-- include end -->
diff --git a/interface-definitions/system_option.xml.in b/interface-definitions/system_option.xml.in
index 064d9ff40..638ac1a3d 100644
--- a/interface-definitions/system_option.xml.in
+++ b/interface-definitions/system_option.xml.in
@@ -1,233 +1,246 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="system">
<children>
<node name="option" owner="${vyos_conf_scripts_dir}/system_option.py">
<properties>
<help>System Options</help>
<priority>9999</priority>
</properties>
<children>
<leafNode name="ctrl-alt-delete">
<properties>
<help>System action on Ctrl-Alt-Delete keystroke</help>
<completionHelp>
<list>ignore reboot poweroff</list>
</completionHelp>
<valueHelp>
<format>ignore</format>
<description>Ignore key sequence</description>
</valueHelp>
<valueHelp>
<format>reboot</format>
<description>Reboot system</description>
</valueHelp>
<valueHelp>
<format>poweroff</format>
<description>Poweroff system</description>
</valueHelp>
<constraint>
<regex>(ignore|reboot|poweroff)</regex>
</constraint>
<constraintErrorMessage>Must be ignore, reboot, or poweroff</constraintErrorMessage>
</properties>
</leafNode>
<node name="kernel">
<properties>
<help>Kernel boot parameters</help>
</properties>
<children>
<leafNode name="disable-mitigations">
<properties>
<help>Disable all optional CPU mitigations</help>
<valueless/>
</properties>
</leafNode>
<leafNode name="disable-power-saving">
<properties>
<help>Disable CPU power saving mechanisms also known as C states</help>
<valueless/>
</properties>
</leafNode>
<leafNode name="amd-pstate-driver">
<properties>
<help>Enables and configures pstate driver for AMD Ryzen and Epyc CPUs</help>
<completionHelp>
<list>active passive guided</list>
</completionHelp>
<valueHelp>
<format>active</format>
<description>The firmware controls performance states and the system governor has no effect</description>
</valueHelp>
<valueHelp>
<format>passive</format>
<description>Allow the system governor to manage performance states</description>
</valueHelp>
<valueHelp>
<format>guided</format>
<description>The firmware controls performance states guided by the system governor</description>
</valueHelp>
</properties>
</leafNode>
<node name="debug">
<properties>
<help>Dynamic debugging for kernel module</help>
</properties>
<children>
<leafNode name="wireguard">
<properties>
<help>Dynamic debugging for Wireguard module</help>
<valueless/>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
<leafNode name="keyboard-layout">
<properties>
<help>System keyboard layout, type ISO2</help>
<completionHelp>
<list>us uk fr de es fi it jp106 no dk se-latin1 dvorak</list>
</completionHelp>
<valueHelp>
<format>us</format>
<description>United States</description>
</valueHelp>
<valueHelp>
<format>uk</format>
<description>United Kingdom</description>
</valueHelp>
<valueHelp>
<format>fr</format>
<description>France</description>
</valueHelp>
<valueHelp>
<format>de</format>
<description>Germany</description>
</valueHelp>
<valueHelp>
<format>es</format>
<description>Spain</description>
</valueHelp>
<valueHelp>
<format>fi</format>
<description>Finland</description>
</valueHelp>
<valueHelp>
<format>it</format>
<description>Italy</description>
</valueHelp>
<valueHelp>
<format>jp106</format>
<description>Japan</description>
</valueHelp>
<valueHelp>
<format>no</format>
<description>Norway</description>
</valueHelp>
<valueHelp>
<format>dk</format>
<description>Denmark</description>
</valueHelp>
<valueHelp>
<format>se-latin1</format>
<description>Sweden</description>
</valueHelp>
<valueHelp>
<format>dvorak</format>
<description>Dvorak</description>
</valueHelp>
<constraint>
<regex>(us|uk|fr|de|es|fi|it|jp106|no|dk|se-latin1|dvorak)</regex>
</constraint>
<constraintErrorMessage>Invalid keyboard layout</constraintErrorMessage>
</properties>
<defaultValue>us</defaultValue>
</leafNode>
<leafNode name="performance">
<properties>
<help>Tune system performance</help>
<completionHelp>
- <list>throughput latency</list>
+ <list>network-throughput network-latency power-save virtual-host virtual-guest</list>
</completionHelp>
<valueHelp>
- <format>throughput</format>
+ <format>network-throughput</format>
<description>Tune for maximum network throughput</description>
</valueHelp>
<valueHelp>
- <format>latency</format>
+ <format>network-latency</format>
<description>Tune for low network latency</description>
</valueHelp>
+ <valueHelp>
+ <format>power-save</format>
+ <description>Tune for low power consumption</description>
+ </valueHelp>
+ <valueHelp>
+ <format>virtual-guest</format>
+ <description>Tune for running inside a virtual machine</description>
+ </valueHelp>
+ <valueHelp>
+ <format>virtual-host</format>
+ <description>Tune for running guest virtual machines</description>
+ </valueHelp>
<constraint>
- <regex>(throughput|latency)</regex>
+ <regex>(network-throughput|network-latency|power-save|virtual-guest|virtual-host)</regex>
</constraint>
+ <multi/>
</properties>
</leafNode>
<node name="http-client">
<properties>
<help>Global options used for HTTP client</help>
</properties>
<children>
#include <include/source-interface.xml.i>
#include <include/source-address-ipv4-ipv6.xml.i>
</children>
</node>
<leafNode name="reboot-on-panic">
<properties>
<help>Reboot system on kernel panic</help>
<valueless/>
</properties>
</leafNode>
<node name="ssh-client">
<properties>
<help>Global options used for SSH client</help>
</properties>
<children>
#include <include/source-address-ipv4-ipv6.xml.i>
#include <include/source-interface.xml.i>
</children>
</node>
<leafNode name="startup-beep">
<properties>
<help>plays sound via system speaker when you can login</help>
<valueless/>
</properties>
</leafNode>
<leafNode name="root-partition-auto-resize">
<properties>
<help>Enable root partition auto-extention on system boot</help>
<valueless/>
</properties>
</leafNode>
<leafNode name="time-format">
<properties>
<help>System time-format</help>
<completionHelp>
<list>12-hour 24-hour</list>
</completionHelp>
<valueHelp>
<format>12-hour</format>
<description>12 hour time format</description>
</valueHelp>
<valueHelp>
<format>24-hour</format>
<description>24 hour time format</description>
</valueHelp>
<constraint>
<regex>(12-hour|24-hour)</regex>
</constraint>
</properties>
<defaultValue>12-hour</defaultValue>
</leafNode>
<leafNode name="disable-usb-autosuspend">
<properties>
<help>Disable autosuspend for all USB devices</help>
<valueless/>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</interfaceDefinition>
diff --git a/smoketest/config-tests/dialup-router-wireguard-ipv6 b/smoketest/config-tests/dialup-router-wireguard-ipv6
index ff4bf89c2..c2cf2e9d8 100644
--- a/smoketest/config-tests/dialup-router-wireguard-ipv6
+++ b/smoketest/config-tests/dialup-router-wireguard-ipv6
@@ -1,697 +1,697 @@
set firewall global-options all-ping 'enable'
set firewall global-options broadcast-ping 'disable'
set firewall global-options ip-src-route 'disable'
set firewall global-options ipv6-receive-redirects 'disable'
set firewall global-options ipv6-src-route 'disable'
set firewall global-options log-martians 'enable'
set firewall global-options receive-redirects 'disable'
set firewall global-options send-redirects 'enable'
set firewall global-options source-validation 'disable'
set firewall global-options syn-cookies 'enable'
set firewall global-options timeout icmp '30'
set firewall global-options timeout other '600'
set firewall global-options timeout udp other '300'
set firewall global-options timeout udp stream '300'
set firewall global-options twa-hazards-protection 'disable'
set firewall group address-group DMZ-RDP-SERVER address '172.16.33.40'
set firewall group address-group DMZ-RDP-SERVER description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall group address-group DMZ-WEBSERVER address '172.16.36.10'
set firewall group address-group DMZ-WEBSERVER address '172.16.36.40'
set firewall group address-group DMZ-WEBSERVER address '172.16.36.20'
set firewall group address-group DMZ-WEBSERVER description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall group address-group DOMAIN-CONTROLLER address '172.16.100.10'
set firewall group address-group DOMAIN-CONTROLLER address '172.16.100.20'
set firewall group address-group DOMAIN-CONTROLLER address '172.16.110.30'
set firewall group address-group VIDEO address '172.16.33.211'
set firewall group address-group VIDEO address '172.16.33.212'
set firewall group address-group VIDEO address '172.16.33.213'
set firewall group address-group VIDEO address '172.16.33.214'
set firewall group ipv6-network-group LOCAL-ADDRESSES network 'ff02::/64'
set firewall group ipv6-network-group LOCAL-ADDRESSES network 'fe80::/10'
set firewall group network-group SSH-IN-ALLOW network '100.65.150.0/23'
set firewall group network-group SSH-IN-ALLOW network '100.64.69.205/32'
set firewall group network-group SSH-IN-ALLOW network '100.64.8.67/32'
set firewall group network-group SSH-IN-ALLOW network '100.64.55.1/32'
set firewall ipv4 name DMZ-GUEST default-action 'drop'
set firewall ipv4 name DMZ-GUEST default-log
set firewall ipv4 name DMZ-GUEST rule 1 action 'return'
set firewall ipv4 name DMZ-GUEST rule 1 state 'established'
set firewall ipv4 name DMZ-GUEST rule 1 state 'related'
set firewall ipv4 name DMZ-GUEST rule 2 action 'drop'
set firewall ipv4 name DMZ-GUEST rule 2 log
set firewall ipv4 name DMZ-GUEST rule 2 state 'invalid'
set firewall ipv4 name DMZ-LAN default-action 'drop'
set firewall ipv4 name DMZ-LAN default-log
set firewall ipv4 name DMZ-LAN description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LAN rule 1 action 'return'
set firewall ipv4 name DMZ-LAN rule 1 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LAN rule 1 state 'established'
set firewall ipv4 name DMZ-LAN rule 1 state 'related'
set firewall ipv4 name DMZ-LAN rule 2 action 'drop'
set firewall ipv4 name DMZ-LAN rule 2 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LAN rule 2 log
set firewall ipv4 name DMZ-LAN rule 2 state 'invalid'
set firewall ipv4 name DMZ-LAN rule 100 action 'return'
set firewall ipv4 name DMZ-LAN rule 100 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LAN rule 100 destination group address-group 'DOMAIN-CONTROLLER'
set firewall ipv4 name DMZ-LAN rule 100 destination port '123,389,636'
set firewall ipv4 name DMZ-LAN rule 100 protocol 'tcp_udp'
set firewall ipv4 name DMZ-LAN rule 300 action 'return'
set firewall ipv4 name DMZ-LAN rule 300 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LAN rule 300 destination group address-group 'DMZ-RDP-SERVER'
set firewall ipv4 name DMZ-LAN rule 300 destination port '3389'
set firewall ipv4 name DMZ-LAN rule 300 protocol 'tcp_udp'
set firewall ipv4 name DMZ-LAN rule 300 source address '172.16.36.20'
set firewall ipv4 name DMZ-LOCAL default-action 'drop'
set firewall ipv4 name DMZ-LOCAL default-log
set firewall ipv4 name DMZ-LOCAL description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LOCAL rule 1 action 'return'
set firewall ipv4 name DMZ-LOCAL rule 1 state 'established'
set firewall ipv4 name DMZ-LOCAL rule 1 state 'related'
set firewall ipv4 name DMZ-LOCAL rule 2 action 'drop'
set firewall ipv4 name DMZ-LOCAL rule 2 log
set firewall ipv4 name DMZ-LOCAL rule 2 state 'invalid'
set firewall ipv4 name DMZ-LOCAL rule 50 action 'return'
set firewall ipv4 name DMZ-LOCAL rule 50 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name DMZ-LOCAL rule 50 destination address '172.16.254.30'
set firewall ipv4 name DMZ-LOCAL rule 50 destination port '53'
set firewall ipv4 name DMZ-LOCAL rule 50 protocol 'tcp_udp'
set firewall ipv4 name DMZ-LOCAL rule 123 action 'return'
set firewall ipv4 name DMZ-LOCAL rule 123 destination port '123'
set firewall ipv4 name DMZ-LOCAL rule 123 protocol 'udp'
set firewall ipv4 name DMZ-WAN default-action 'return'
set firewall ipv4 name DMZ-WAN description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name GUEST-DMZ default-action 'drop'
set firewall ipv4 name GUEST-DMZ default-log
set firewall ipv4 name GUEST-DMZ rule 1 action 'return'
set firewall ipv4 name GUEST-DMZ rule 1 state 'established'
set firewall ipv4 name GUEST-DMZ rule 1 state 'related'
set firewall ipv4 name GUEST-DMZ rule 2 action 'drop'
set firewall ipv4 name GUEST-DMZ rule 2 log
set firewall ipv4 name GUEST-DMZ rule 2 state 'invalid'
set firewall ipv4 name GUEST-LAN default-action 'drop'
set firewall ipv4 name GUEST-LAN default-log
set firewall ipv4 name GUEST-LAN rule 1 action 'return'
set firewall ipv4 name GUEST-LAN rule 1 state 'established'
set firewall ipv4 name GUEST-LAN rule 1 state 'related'
set firewall ipv4 name GUEST-LAN rule 2 action 'drop'
set firewall ipv4 name GUEST-LAN rule 2 log
set firewall ipv4 name GUEST-LAN rule 2 state 'invalid'
set firewall ipv4 name GUEST-LOCAL default-action 'drop'
set firewall ipv4 name GUEST-LOCAL default-log
set firewall ipv4 name GUEST-LOCAL rule 1 action 'return'
set firewall ipv4 name GUEST-LOCAL rule 1 state 'established'
set firewall ipv4 name GUEST-LOCAL rule 1 state 'related'
set firewall ipv4 name GUEST-LOCAL rule 2 action 'drop'
set firewall ipv4 name GUEST-LOCAL rule 2 log
set firewall ipv4 name GUEST-LOCAL rule 2 state 'invalid'
set firewall ipv4 name GUEST-LOCAL rule 10 action 'return'
set firewall ipv4 name GUEST-LOCAL rule 10 destination address '172.31.0.254'
set firewall ipv4 name GUEST-LOCAL rule 10 destination port '53'
set firewall ipv4 name GUEST-LOCAL rule 10 protocol 'tcp_udp'
set firewall ipv4 name GUEST-LOCAL rule 11 action 'return'
set firewall ipv4 name GUEST-LOCAL rule 11 destination port '67'
set firewall ipv4 name GUEST-LOCAL rule 11 protocol 'udp'
set firewall ipv4 name GUEST-LOCAL rule 15 action 'return'
set firewall ipv4 name GUEST-LOCAL rule 15 destination address '172.31.0.254'
set firewall ipv4 name GUEST-LOCAL rule 15 protocol 'icmp'
set firewall ipv4 name GUEST-LOCAL rule 100 action 'return'
set firewall ipv4 name GUEST-LOCAL rule 100 destination address '172.31.0.254'
set firewall ipv4 name GUEST-LOCAL rule 100 destination port '80,443'
set firewall ipv4 name GUEST-LOCAL rule 100 protocol 'tcp'
set firewall ipv4 name GUEST-WAN default-action 'drop'
set firewall ipv4 name GUEST-WAN default-log
set firewall ipv4 name GUEST-WAN rule 1 action 'return'
set firewall ipv4 name GUEST-WAN rule 1 state 'established'
set firewall ipv4 name GUEST-WAN rule 1 state 'related'
set firewall ipv4 name GUEST-WAN rule 2 action 'drop'
set firewall ipv4 name GUEST-WAN rule 2 log
set firewall ipv4 name GUEST-WAN rule 2 state 'invalid'
set firewall ipv4 name GUEST-WAN rule 25 action 'return'
set firewall ipv4 name GUEST-WAN rule 25 destination port '25,587'
set firewall ipv4 name GUEST-WAN rule 25 protocol 'tcp'
set firewall ipv4 name GUEST-WAN rule 53 action 'return'
set firewall ipv4 name GUEST-WAN rule 53 destination port '53'
set firewall ipv4 name GUEST-WAN rule 53 protocol 'tcp_udp'
set firewall ipv4 name GUEST-WAN rule 60 action 'return'
set firewall ipv4 name GUEST-WAN rule 60 source address '172.31.0.200'
set firewall ipv4 name GUEST-WAN rule 80 action 'return'
set firewall ipv4 name GUEST-WAN rule 80 source address '172.31.0.200'
set firewall ipv4 name GUEST-WAN rule 100 action 'return'
set firewall ipv4 name GUEST-WAN rule 100 protocol 'icmp'
set firewall ipv4 name GUEST-WAN rule 110 action 'return'
set firewall ipv4 name GUEST-WAN rule 110 destination port '110,995'
set firewall ipv4 name GUEST-WAN rule 110 protocol 'tcp'
set firewall ipv4 name GUEST-WAN rule 123 action 'return'
set firewall ipv4 name GUEST-WAN rule 123 destination port '123'
set firewall ipv4 name GUEST-WAN rule 123 protocol 'udp'
set firewall ipv4 name GUEST-WAN rule 143 action 'return'
set firewall ipv4 name GUEST-WAN rule 143 destination port '143,993'
set firewall ipv4 name GUEST-WAN rule 143 protocol 'tcp'
set firewall ipv4 name GUEST-WAN rule 200 action 'return'
set firewall ipv4 name GUEST-WAN rule 200 destination port '80,443'
set firewall ipv4 name GUEST-WAN rule 200 protocol 'tcp'
set firewall ipv4 name GUEST-WAN rule 500 action 'return'
set firewall ipv4 name GUEST-WAN rule 500 destination port '500,4500'
set firewall ipv4 name GUEST-WAN rule 500 protocol 'udp'
set firewall ipv4 name GUEST-WAN rule 600 action 'return'
set firewall ipv4 name GUEST-WAN rule 600 destination port '5222-5224'
set firewall ipv4 name GUEST-WAN rule 600 protocol 'tcp'
set firewall ipv4 name GUEST-WAN rule 601 action 'return'
set firewall ipv4 name GUEST-WAN rule 601 destination port '3478-3497,4500,16384-16387,16393-16402'
set firewall ipv4 name GUEST-WAN rule 601 protocol 'udp'
set firewall ipv4 name GUEST-WAN rule 1000 action 'return'
set firewall ipv4 name GUEST-WAN rule 1000 source address '172.31.0.184'
set firewall ipv4 name LAN-DMZ default-action 'drop'
set firewall ipv4 name LAN-DMZ default-log
set firewall ipv4 name LAN-DMZ rule 1 action 'return'
set firewall ipv4 name LAN-DMZ rule 1 state 'established'
set firewall ipv4 name LAN-DMZ rule 1 state 'related'
set firewall ipv4 name LAN-DMZ rule 2 action 'drop'
set firewall ipv4 name LAN-DMZ rule 2 log
set firewall ipv4 name LAN-DMZ rule 2 state 'invalid'
set firewall ipv4 name LAN-DMZ rule 22 action 'return'
set firewall ipv4 name LAN-DMZ rule 22 destination port '22'
set firewall ipv4 name LAN-DMZ rule 22 protocol 'tcp'
set firewall ipv4 name LAN-DMZ rule 100 action 'return'
set firewall ipv4 name LAN-DMZ rule 100 destination group address-group 'DMZ-WEBSERVER'
set firewall ipv4 name LAN-DMZ rule 100 destination port '22'
set firewall ipv4 name LAN-DMZ rule 100 protocol 'tcp'
set firewall ipv4 name LAN-GUEST default-action 'drop'
set firewall ipv4 name LAN-GUEST default-log
set firewall ipv4 name LAN-GUEST rule 1 action 'return'
set firewall ipv4 name LAN-GUEST rule 1 state 'established'
set firewall ipv4 name LAN-GUEST rule 1 state 'related'
set firewall ipv4 name LAN-GUEST rule 2 action 'drop'
set firewall ipv4 name LAN-GUEST rule 2 log
set firewall ipv4 name LAN-GUEST rule 2 state 'invalid'
set firewall ipv4 name LAN-LOCAL default-action 'return'
set firewall ipv4 name LAN-WAN default-action 'return'
set firewall ipv4 name LAN-WAN rule 90 action 'return'
set firewall ipv4 name LAN-WAN rule 90 destination address '100.65.150.0/23'
set firewall ipv4 name LAN-WAN rule 90 destination port '25'
set firewall ipv4 name LAN-WAN rule 90 protocol 'tcp_udp'
set firewall ipv4 name LAN-WAN rule 90 source group address-group 'VIDEO'
set firewall ipv4 name LAN-WAN rule 100 action 'drop'
set firewall ipv4 name LAN-WAN rule 100 source group address-group 'VIDEO'
set firewall ipv4 name LOCAL-DMZ default-action 'drop'
set firewall ipv4 name LOCAL-DMZ default-log
set firewall ipv4 name LOCAL-DMZ rule 1 action 'return'
set firewall ipv4 name LOCAL-DMZ rule 1 state 'established'
set firewall ipv4 name LOCAL-DMZ rule 1 state 'related'
set firewall ipv4 name LOCAL-DMZ rule 2 action 'drop'
set firewall ipv4 name LOCAL-DMZ rule 2 log
set firewall ipv4 name LOCAL-DMZ rule 2 state 'invalid'
set firewall ipv4 name LOCAL-DMZ rule 100 action 'return'
set firewall ipv4 name LOCAL-DMZ rule 100 destination address '172.16.36.40'
set firewall ipv4 name LOCAL-DMZ rule 100 destination port '80,443'
set firewall ipv4 name LOCAL-DMZ rule 100 protocol 'tcp'
set firewall ipv4 name LOCAL-GUEST default-action 'drop'
set firewall ipv4 name LOCAL-GUEST default-log
set firewall ipv4 name LOCAL-GUEST rule 1 action 'return'
set firewall ipv4 name LOCAL-GUEST rule 1 state 'established'
set firewall ipv4 name LOCAL-GUEST rule 1 state 'related'
set firewall ipv4 name LOCAL-GUEST rule 2 action 'drop'
set firewall ipv4 name LOCAL-GUEST rule 2 log
set firewall ipv4 name LOCAL-GUEST rule 2 state 'invalid'
set firewall ipv4 name LOCAL-GUEST rule 5 action 'return'
set firewall ipv4 name LOCAL-GUEST rule 5 protocol 'icmp'
set firewall ipv4 name LOCAL-GUEST rule 300 action 'return'
set firewall ipv4 name LOCAL-GUEST rule 300 destination port '1900'
set firewall ipv4 name LOCAL-GUEST rule 300 protocol 'udp'
set firewall ipv4 name LOCAL-LAN default-action 'return'
set firewall ipv4 name LOCAL-WAN default-action 'drop'
set firewall ipv4 name LOCAL-WAN default-log
set firewall ipv4 name LOCAL-WAN rule 1 action 'return'
set firewall ipv4 name LOCAL-WAN rule 1 state 'established'
set firewall ipv4 name LOCAL-WAN rule 1 state 'related'
set firewall ipv4 name LOCAL-WAN rule 2 action 'drop'
set firewall ipv4 name LOCAL-WAN rule 2 log
set firewall ipv4 name LOCAL-WAN rule 2 state 'invalid'
set firewall ipv4 name LOCAL-WAN rule 10 action 'return'
set firewall ipv4 name LOCAL-WAN rule 10 protocol 'icmp'
set firewall ipv4 name LOCAL-WAN rule 50 action 'return'
set firewall ipv4 name LOCAL-WAN rule 50 destination port '53'
set firewall ipv4 name LOCAL-WAN rule 50 protocol 'tcp_udp'
set firewall ipv4 name LOCAL-WAN rule 80 action 'return'
set firewall ipv4 name LOCAL-WAN rule 80 destination port '80,443'
set firewall ipv4 name LOCAL-WAN rule 80 protocol 'tcp'
set firewall ipv4 name LOCAL-WAN rule 123 action 'return'
set firewall ipv4 name LOCAL-WAN rule 123 destination port '123'
set firewall ipv4 name LOCAL-WAN rule 123 protocol 'udp'
set firewall ipv4 name LOCAL-WAN rule 800 action 'return'
set firewall ipv4 name LOCAL-WAN rule 800 destination address '100.65.151.213'
set firewall ipv4 name LOCAL-WAN rule 800 protocol 'udp'
set firewall ipv4 name LOCAL-WAN rule 805 action 'return'
set firewall ipv4 name LOCAL-WAN rule 805 destination address '100.65.151.2'
set firewall ipv4 name LOCAL-WAN rule 805 protocol 'all'
set firewall ipv4 name LOCAL-WAN rule 1010 action 'return'
set firewall ipv4 name LOCAL-WAN rule 1010 destination address '100.64.69.205'
set firewall ipv4 name LOCAL-WAN rule 1010 destination port '7705'
set firewall ipv4 name LOCAL-WAN rule 1010 protocol 'udp'
set firewall ipv4 name LOCAL-WAN rule 1010 source port '7705'
set firewall ipv4 name LOCAL-WAN rule 1990 action 'return'
set firewall ipv4 name LOCAL-WAN rule 1990 destination address '100.64.55.1'
set firewall ipv4 name LOCAL-WAN rule 1990 destination port '10666'
set firewall ipv4 name LOCAL-WAN rule 1990 protocol 'udp'
set firewall ipv4 name LOCAL-WAN rule 2000 action 'return'
set firewall ipv4 name LOCAL-WAN rule 2000 destination address '100.64.39.249'
set firewall ipv4 name LOCAL-WAN rule 10200 action 'return'
set firewall ipv4 name LOCAL-WAN rule 10200 destination address '100.64.89.98'
set firewall ipv4 name LOCAL-WAN rule 10200 destination port '10200'
set firewall ipv4 name LOCAL-WAN rule 10200 protocol 'udp'
set firewall ipv4 name LOCAL-WAN rule 10200 source port '10200'
set firewall ipv4 name WAN-DMZ default-action 'drop'
set firewall ipv4 name WAN-DMZ default-log
set firewall ipv4 name WAN-DMZ rule 1 action 'return'
set firewall ipv4 name WAN-DMZ rule 1 state 'established'
set firewall ipv4 name WAN-DMZ rule 1 state 'related'
set firewall ipv4 name WAN-DMZ rule 2 action 'drop'
set firewall ipv4 name WAN-DMZ rule 2 log
set firewall ipv4 name WAN-DMZ rule 2 state 'invalid'
set firewall ipv4 name WAN-DMZ rule 100 action 'return'
set firewall ipv4 name WAN-DMZ rule 100 destination address '172.16.36.10'
set firewall ipv4 name WAN-DMZ rule 100 destination port '80,443'
set firewall ipv4 name WAN-DMZ rule 100 protocol 'tcp'
set firewall ipv4 name WAN-GUEST default-action 'drop'
set firewall ipv4 name WAN-GUEST default-log
set firewall ipv4 name WAN-GUEST rule 1 action 'return'
set firewall ipv4 name WAN-GUEST rule 1 state 'established'
set firewall ipv4 name WAN-GUEST rule 1 state 'related'
set firewall ipv4 name WAN-GUEST rule 2 action 'drop'
set firewall ipv4 name WAN-GUEST rule 2 log
set firewall ipv4 name WAN-GUEST rule 2 state 'invalid'
set firewall ipv4 name WAN-GUEST rule 1000 action 'return'
set firewall ipv4 name WAN-GUEST rule 1000 destination address '172.31.0.184'
set firewall ipv4 name WAN-GUEST rule 8000 action 'return'
set firewall ipv4 name WAN-GUEST rule 8000 destination address '172.31.0.200'
set firewall ipv4 name WAN-GUEST rule 8000 destination port '10000'
set firewall ipv4 name WAN-GUEST rule 8000 protocol 'udp'
set firewall ipv4 name WAN-LAN default-action 'drop'
set firewall ipv4 name WAN-LAN default-log
set firewall ipv4 name WAN-LAN description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name WAN-LAN rule 1 action 'return'
set firewall ipv4 name WAN-LAN rule 1 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv4 name WAN-LAN rule 1 state 'established'
set firewall ipv4 name WAN-LAN rule 1 state 'related'
set firewall ipv4 name WAN-LAN rule 2 action 'drop'
set firewall ipv4 name WAN-LAN rule 2 log
set firewall ipv4 name WAN-LAN rule 2 state 'invalid'
set firewall ipv4 name WAN-LAN rule 1000 action 'return'
set firewall ipv4 name WAN-LAN rule 1000 destination address '172.16.33.40'
set firewall ipv4 name WAN-LAN rule 1000 destination port '3389'
set firewall ipv4 name WAN-LAN rule 1000 protocol 'tcp'
set firewall ipv4 name WAN-LAN rule 1000 source group network-group 'SSH-IN-ALLOW'
set firewall ipv4 name WAN-LOCAL default-action 'drop'
set firewall ipv4 name WAN-LOCAL rule 1 action 'return'
set firewall ipv4 name WAN-LOCAL rule 1 state 'established'
set firewall ipv4 name WAN-LOCAL rule 1 state 'related'
set firewall ipv4 name WAN-LOCAL rule 2 action 'drop'
set firewall ipv4 name WAN-LOCAL rule 2 log
set firewall ipv4 name WAN-LOCAL rule 2 state 'invalid'
set firewall ipv4 name WAN-LOCAL rule 22 action 'return'
set firewall ipv4 name WAN-LOCAL rule 22 destination port '22'
set firewall ipv4 name WAN-LOCAL rule 22 protocol 'tcp'
set firewall ipv4 name WAN-LOCAL rule 22 source group network-group 'SSH-IN-ALLOW'
set firewall ipv4 name WAN-LOCAL rule 1990 action 'return'
set firewall ipv4 name WAN-LOCAL rule 1990 destination port '10666'
set firewall ipv4 name WAN-LOCAL rule 1990 protocol 'udp'
set firewall ipv4 name WAN-LOCAL rule 1990 source address '100.64.55.1'
set firewall ipv4 name WAN-LOCAL rule 10000 action 'return'
set firewall ipv4 name WAN-LOCAL rule 10000 destination port '80,443'
set firewall ipv4 name WAN-LOCAL rule 10000 protocol 'tcp'
set firewall ipv4 name WAN-LOCAL rule 10100 action 'return'
set firewall ipv4 name WAN-LOCAL rule 10100 destination port '10100'
set firewall ipv4 name WAN-LOCAL rule 10100 protocol 'udp'
set firewall ipv4 name WAN-LOCAL rule 10100 source port '10100'
set firewall ipv4 name WAN-LOCAL rule 10200 action 'return'
set firewall ipv4 name WAN-LOCAL rule 10200 destination port '10200'
set firewall ipv4 name WAN-LOCAL rule 10200 protocol 'udp'
set firewall ipv4 name WAN-LOCAL rule 10200 source address '100.64.89.98'
set firewall ipv4 name WAN-LOCAL rule 10200 source port '10200'
set firewall ipv6 name ALLOW-ALL-6 default-action 'return'
set firewall ipv6 name ALLOW-ALL-6 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv6 name ALLOW-BASIC-6 default-action 'drop'
set firewall ipv6 name ALLOW-BASIC-6 default-log
set firewall ipv6 name ALLOW-BASIC-6 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv6 name ALLOW-BASIC-6 rule 1 action 'return'
set firewall ipv6 name ALLOW-BASIC-6 rule 1 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv6 name ALLOW-BASIC-6 rule 1 state 'established'
set firewall ipv6 name ALLOW-BASIC-6 rule 1 state 'related'
set firewall ipv6 name ALLOW-BASIC-6 rule 2 action 'drop'
set firewall ipv6 name ALLOW-BASIC-6 rule 2 description 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata'
set firewall ipv6 name ALLOW-BASIC-6 rule 2 state 'invalid'
set firewall ipv6 name ALLOW-BASIC-6 rule 10 action 'return'
set firewall ipv6 name ALLOW-BASIC-6 rule 10 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 default-action 'drop'
set firewall ipv6 name ALLOW-ESTABLISHED-6 default-log
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 1 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 1 state 'established'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 1 state 'related'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 2 action 'drop'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 2 state 'invalid'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 10 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 10 destination group network-group 'LOCAL-ADDRESSES'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 10 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 10 source address 'fe80::/10'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 20 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 20 icmpv6 type-name 'echo-request'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 20 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 21 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 21 icmpv6 type-name 'destination-unreachable'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 21 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 22 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 22 icmpv6 type-name 'packet-too-big'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 22 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 23 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 23 icmpv6 type-name 'time-exceeded'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 23 protocol 'ipv6-icmp'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 24 action 'return'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 24 icmpv6 type-name 'parameter-problem'
set firewall ipv6 name ALLOW-ESTABLISHED-6 rule 24 protocol 'ipv6-icmp'
set firewall ipv6 name WAN-LOCAL-6 default-action 'drop'
set firewall ipv6 name WAN-LOCAL-6 default-log
set firewall ipv6 name WAN-LOCAL-6 rule 1 action 'return'
set firewall ipv6 name WAN-LOCAL-6 rule 1 state 'established'
set firewall ipv6 name WAN-LOCAL-6 rule 1 state 'related'
set firewall ipv6 name WAN-LOCAL-6 rule 2 action 'drop'
set firewall ipv6 name WAN-LOCAL-6 rule 2 state 'invalid'
set firewall ipv6 name WAN-LOCAL-6 rule 10 action 'return'
set firewall ipv6 name WAN-LOCAL-6 rule 10 destination address 'ff02::/64'
set firewall ipv6 name WAN-LOCAL-6 rule 10 protocol 'ipv6-icmp'
set firewall ipv6 name WAN-LOCAL-6 rule 10 source address 'fe80::/10'
set firewall ipv6 name WAN-LOCAL-6 rule 50 action 'return'
set firewall ipv6 name WAN-LOCAL-6 rule 50 destination address 'fe80::/10'
set firewall ipv6 name WAN-LOCAL-6 rule 50 destination port '546'
set firewall ipv6 name WAN-LOCAL-6 rule 50 protocol 'udp'
set firewall ipv6 name WAN-LOCAL-6 rule 50 source address 'fe80::/10'
set firewall ipv6 name WAN-LOCAL-6 rule 50 source port '547'
set firewall zone DMZ default-action 'drop'
set firewall zone DMZ from GUEST firewall name 'GUEST-DMZ'
set firewall zone DMZ from LAN firewall name 'LAN-DMZ'
set firewall zone DMZ from LOCAL firewall name 'LOCAL-DMZ'
set firewall zone DMZ from WAN firewall name 'WAN-DMZ'
set firewall zone DMZ interface 'eth0.50'
set firewall zone GUEST default-action 'drop'
set firewall zone GUEST from DMZ firewall name 'DMZ-GUEST'
set firewall zone GUEST from LAN firewall name 'LAN-GUEST'
set firewall zone GUEST from LOCAL firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone GUEST from LOCAL firewall name 'LOCAL-GUEST'
set firewall zone GUEST from WAN firewall ipv6-name 'ALLOW-ESTABLISHED-6'
set firewall zone GUEST from WAN firewall name 'WAN-GUEST'
set firewall zone GUEST interface 'eth1.20'
set firewall zone LAN default-action 'drop'
set firewall zone LAN from DMZ firewall name 'DMZ-LAN'
set firewall zone LAN from GUEST firewall name 'GUEST-LAN'
set firewall zone LAN from LOCAL firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone LAN from LOCAL firewall name 'LOCAL-LAN'
set firewall zone LAN from WAN firewall ipv6-name 'ALLOW-ESTABLISHED-6'
set firewall zone LAN from WAN firewall name 'WAN-LAN'
set firewall zone LAN interface 'eth0.5'
set firewall zone LAN interface 'eth0.10'
set firewall zone LAN interface 'wg100'
set firewall zone LAN interface 'wg200'
set firewall zone LOCAL default-action 'drop'
set firewall zone LOCAL from DMZ firewall name 'DMZ-LOCAL'
set firewall zone LOCAL from GUEST firewall ipv6-name 'ALLOW-ESTABLISHED-6'
set firewall zone LOCAL from GUEST firewall name 'GUEST-LOCAL'
set firewall zone LOCAL from LAN firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone LOCAL from LAN firewall name 'LAN-LOCAL'
set firewall zone LOCAL from WAN firewall ipv6-name 'WAN-LOCAL-6'
set firewall zone LOCAL from WAN firewall name 'WAN-LOCAL'
set firewall zone LOCAL local-zone
set firewall zone WAN default-action 'drop'
set firewall zone WAN from DMZ firewall name 'DMZ-WAN'
set firewall zone WAN from GUEST firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone WAN from GUEST firewall name 'GUEST-WAN'
set firewall zone WAN from LAN firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone WAN from LAN firewall name 'LAN-WAN'
set firewall zone WAN from LOCAL firewall ipv6-name 'ALLOW-ALL-6'
set firewall zone WAN from LOCAL firewall name 'LOCAL-WAN'
set firewall zone WAN interface 'pppoe0'
set firewall zone WAN interface 'wg666'
set interfaces dummy dum0 address '172.16.254.30/32'
set interfaces ethernet eth0 duplex 'auto'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 ring-buffer rx '256'
set interfaces ethernet eth0 ring-buffer tx '256'
set interfaces ethernet eth0 speed 'auto'
set interfaces ethernet eth0 vif 5 address '172.16.37.254/24'
set interfaces ethernet eth0 vif 10 address '172.16.33.254/24'
set interfaces ethernet eth0 vif 10 address '172.16.40.254/24'
set interfaces ethernet eth0 vif 50 address '172.16.36.254/24'
set interfaces ethernet eth1 duplex 'auto'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 speed 'auto'
set interfaces ethernet eth1 vif 20 address '172.31.0.254/24'
set interfaces ethernet eth2 disable
set interfaces ethernet eth2 duplex 'auto'
set interfaces ethernet eth2 offload gro
set interfaces ethernet eth2 speed 'auto'
set interfaces ethernet eth3 duplex 'auto'
set interfaces ethernet eth3 offload gro
set interfaces ethernet eth3 ring-buffer rx '256'
set interfaces ethernet eth3 ring-buffer tx '256'
set interfaces ethernet eth3 speed 'auto'
set interfaces ethernet eth3 vif 7
set interfaces loopback lo address '172.16.254.30/32'
set interfaces pppoe pppoe0 authentication password 'vyos'
set interfaces pppoe pppoe0 authentication username 'vyos'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth0.10 address '1'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth0.10 sla-id '10'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1.20 address '1'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1.20 sla-id '20'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 length '56'
set interfaces pppoe pppoe0 ip adjust-mss '1452'
set interfaces pppoe pppoe0 ipv6 address autoconf
set interfaces pppoe pppoe0 ipv6 adjust-mss '1432'
set interfaces pppoe pppoe0 no-peer-dns
set interfaces pppoe pppoe0 source-interface 'eth3.7'
set interfaces wireguard wg100 address '172.16.252.128/31'
set interfaces wireguard wg100 mtu '1500'
set interfaces wireguard wg100 peer HR6 address '100.65.151.213'
set interfaces wireguard wg100 peer HR6 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg100 peer HR6 port '10100'
set interfaces wireguard wg100 peer HR6 public-key 'yLpi+UZuI019bmWH2h5fX3gStbpPPPLgEoYMyrdkOnQ='
set interfaces wireguard wg100 port '10100'
set interfaces wireguard wg100 private-key 'aGx+fvW916Ej7QRnBbW3QMoldhNv1u95/WHz45zDmF0='
set interfaces wireguard wg200 address '172.16.252.130/31'
set interfaces wireguard wg200 mtu '1500'
set interfaces wireguard wg200 peer WH56 address '80.151.69.205'
set interfaces wireguard wg200 peer WH56 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg200 peer WH56 port '10200'
set interfaces wireguard wg200 peer WH56 public-key 'XQbkj6vnKKBJfJQyThXysU0iGxCvEOEb31kpaZgkrD8='
set interfaces wireguard wg200 port '10200'
set interfaces wireguard wg200 private-key 'aGx+fvW916Ej7QRnBbW3QMoldhNv1u95/WHz45zDmF0='
set interfaces wireguard wg666 address '172.29.0.1/31'
set interfaces wireguard wg666 mtu '1500'
set interfaces wireguard wg666 peer WH34 address '100.65.55.1'
set interfaces wireguard wg666 peer WH34 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg666 peer WH34 port '10666'
set interfaces wireguard wg666 peer WH34 public-key 'yaTN4+xAafKM04D+Baeg5GWfbdaw35TE9HQivwRgAk0='
set interfaces wireguard wg666 port '10666'
set interfaces wireguard wg666 private-key 'aGx+fvW916Ej7QRnBbW3QMoldhNv1u95/WHz45zDmF0='
set nat destination rule 8000 destination port '10000'
set nat destination rule 8000 inbound-interface name 'pppoe0'
set nat destination rule 8000 protocol 'udp'
set nat destination rule 8000 translation address '172.31.0.200'
set nat source rule 50 outbound-interface name 'pppoe0'
set nat source rule 50 source address '100.64.0.0/24'
set nat source rule 50 translation address 'masquerade'
set nat source rule 100 outbound-interface name 'pppoe0'
set nat source rule 100 source address '172.16.32.0/21'
set nat source rule 100 translation address 'masquerade'
set nat source rule 200 outbound-interface name 'pppoe0'
set nat source rule 200 source address '172.16.100.0/24'
set nat source rule 200 translation address 'masquerade'
set nat source rule 300 outbound-interface name 'pppoe0'
set nat source rule 300 source address '172.31.0.0/24'
set nat source rule 300 translation address 'masquerade'
set nat source rule 400 outbound-interface name 'pppoe0'
set nat source rule 400 source address '172.18.200.0/21'
set nat source rule 400 translation address 'masquerade'
set nat source rule 1000 destination address '192.168.189.0/24'
set nat source rule 1000 outbound-interface name 'wg666'
set nat source rule 1000 source address '172.16.32.0/21'
set nat source rule 1000 translation address '172.29.0.1'
set nat source rule 1001 destination address '192.168.189.0/24'
set nat source rule 1001 outbound-interface name 'wg666'
set nat source rule 1001 source address '172.16.100.0/24'
set nat source rule 1001 translation address '172.29.0.1'
set policy route-map MAP-OSPF-CONNECTED rule 1 action 'deny'
set policy route-map MAP-OSPF-CONNECTED rule 1 match interface 'eth1.20'
set policy route-map MAP-OSPF-CONNECTED rule 20 action 'permit'
set policy route-map MAP-OSPF-CONNECTED rule 20 match interface 'eth0.10'
set policy route-map MAP-OSPF-CONNECTED rule 40 action 'permit'
set policy route-map MAP-OSPF-CONNECTED rule 40 match interface 'eth0.50'
set protocols bfd peer 172.16.252.129
set protocols bfd peer 172.16.252.131
set protocols bfd peer 172.18.254.201
set protocols bgp address-family ipv4-unicast network 172.16.32.0/21
set protocols bgp address-family ipv4-unicast network 172.16.100.0/24
set protocols bgp address-family ipv4-unicast network 172.16.252.128/31
set protocols bgp address-family ipv4-unicast network 172.16.252.130/31
set protocols bgp address-family ipv4-unicast network 172.16.254.30/32
set protocols bgp address-family ipv4-unicast network 172.18.0.0/16
set protocols bgp neighbor 172.16.252.129 peer-group 'WIREGUARD'
set protocols bgp neighbor 172.16.252.131 peer-group 'WIREGUARD'
set protocols bgp neighbor 172.18.254.201 address-family ipv4-unicast nexthop-self
set protocols bgp neighbor 172.18.254.201 bfd
set protocols bgp neighbor 172.18.254.201 remote-as '64503'
set protocols bgp neighbor 172.18.254.201 update-source 'dum0'
set protocols bgp parameters log-neighbor-changes
set protocols bgp peer-group WIREGUARD address-family ipv4-unicast soft-reconfiguration inbound
set protocols bgp peer-group WIREGUARD bfd
set protocols bgp peer-group WIREGUARD remote-as 'external'
set protocols bgp system-as '64503'
set protocols bgp timers holdtime '30'
set protocols bgp timers keepalive '10'
set protocols ospf area 0 network '172.16.254.30/32'
set protocols ospf area 0 network '172.16.37.0/24'
set protocols ospf area 0 network '172.18.201.0/24'
set protocols ospf area 0 network '172.18.202.0/24'
set protocols ospf area 0 network '172.18.203.0/24'
set protocols ospf area 0 network '172.18.204.0/24'
set protocols ospf default-information originate always
set protocols ospf default-information originate metric-type '2'
set protocols ospf interface eth0.5 authentication md5 key-id 10 md5-key 'ospf'
set protocols ospf interface eth0.5 dead-interval '40'
set protocols ospf interface eth0.5 hello-interval '10'
set protocols ospf interface eth0.5 passive disable
set protocols ospf interface eth0.5 priority '1'
set protocols ospf interface eth0.5 retransmit-interval '5'
set protocols ospf interface eth0.5 transmit-delay '1'
set protocols ospf log-adjacency-changes detail
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '172.16.254.30'
set protocols ospf passive-interface 'default'
set protocols ospf redistribute connected metric-type '2'
set protocols ospf redistribute connected route-map 'MAP-OSPF-CONNECTED'
set protocols static route 10.0.0.0/8 blackhole distance '254'
set protocols static route 169.254.0.0/16 blackhole distance '254'
set protocols static route 172.16.0.0/12 blackhole distance '254'
set protocols static route 172.16.32.0/21 blackhole
set protocols static route 172.18.0.0/16 blackhole
set protocols static route 172.29.0.2/31 next-hop 172.29.0.0
set protocols static route 192.168.0.0/16 blackhole distance '254'
set protocols static route 192.168.189.0/24 next-hop 172.29.0.0
set protocols static route6 2000::/3 interface pppoe0
set qos policy shaper QoS bandwidth '50mbit'
set qos policy shaper QoS default bandwidth '100%'
set qos policy shaper QoS default burst '15k'
set qos policy shaper QoS default queue-limit '1000'
set qos policy shaper QoS default queue-type 'fq-codel'
set service dhcp-server shared-network-name BACKBONE authoritative
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 lease '86400'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 option default-router '172.16.37.254'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 option domain-name 'vyos.net'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 option domain-search 'vyos.net'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 option name-server '172.16.254.30'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 option ntp-server '172.16.254.30'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 range 0 start '172.16.37.120'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 range 0 stop '172.16.37.149'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP1 ip-address '172.16.37.231'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP1 mac '02:00:00:00:ee:18'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP2 ip-address '172.16.37.232'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP2 mac '02:00:00:00:52:84'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP3 ip-address '172.16.37.233'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP3 mac '02:00:00:00:51:c0'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP4 ip-address '172.16.37.234'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP4 mac '02:00:00:00:e6:fc'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP5 ip-address '172.16.37.235'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 static-mapping AP5 mac '02:00:00:00:c3:50'
set service dhcp-server shared-network-name BACKBONE subnet 172.16.37.0/24 subnet-id '1'
set service dhcp-server shared-network-name GUEST authoritative
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 lease '86400'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 option default-router '172.31.0.254'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 option domain-name 'vyos.net'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 option domain-search 'vyos.net'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 option name-server '172.31.0.254'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 range 0 start '172.31.0.101'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 range 0 stop '172.31.0.199'
set service dhcp-server shared-network-name GUEST subnet 172.31.0.0/24 subnet-id '2'
set service dhcp-server shared-network-name LAN authoritative
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 option default-router '172.16.33.254'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 option domain-name 'vyos.net'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 option domain-search 'vyos.net'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 option name-server '172.16.254.30'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 option ntp-server '172.16.254.30'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 range 0 start '172.16.33.100'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 range 0 stop '172.16.33.189'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping four ip-address '172.16.33.214'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping four mac '02:00:00:00:c4:33'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping one ip-address '172.16.33.221'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping one mac '02:00:00:00:eb:a6'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping three ip-address '172.16.33.212'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping three mac '02:00:00:00:12:c7'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping two ip-address '172.16.33.211'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 static-mapping two mac '02:00:00:00:58:90'
set service dhcp-server shared-network-name LAN subnet 172.16.33.0/24 subnet-id '3'
set service dns dynamic name service-vyos-pppoe0 address interface 'pppoe0'
set service dns dynamic name service-vyos-pppoe0 host-name 'r1.vyos.net'
set service dns dynamic name service-vyos-pppoe0 password 'vyos'
set service dns dynamic name service-vyos-pppoe0 protocol 'dyndns2'
set service dns dynamic name service-vyos-pppoe0 server 'dyndns.vyos.io'
set service dns dynamic name service-vyos-pppoe0 username 'vyos-vyos'
set service dns forwarding allow-from '172.16.0.0/12'
set service dns forwarding domain 16.172.in-addr.arpa addnta
set service dns forwarding domain 16.172.in-addr.arpa name-server 172.16.100.10
set service dns forwarding domain 16.172.in-addr.arpa name-server 172.16.100.20
set service dns forwarding domain 16.172.in-addr.arpa recursion-desired
set service dns forwarding domain 18.172.in-addr.arpa addnta
set service dns forwarding domain 18.172.in-addr.arpa name-server 172.16.100.10
set service dns forwarding domain 18.172.in-addr.arpa name-server 172.16.100.20
set service dns forwarding domain 18.172.in-addr.arpa recursion-desired
set service dns forwarding domain vyos.net addnta
set service dns forwarding domain vyos.net name-server 172.16.100.10
set service dns forwarding domain vyos.net name-server 172.16.100.20
set service dns forwarding domain vyos.net recursion-desired
set service dns forwarding ignore-hosts-file
set service dns forwarding listen-address '172.16.254.30'
set service dns forwarding listen-address '172.31.0.254'
set service dns forwarding negative-ttl '60'
set service lldp legacy-protocols cdp
set service lldp legacy-protocols edp
set service lldp legacy-protocols fdp
set service lldp legacy-protocols sonmp
set service lldp snmp
set service ntp allow-client address '172.16.0.0/12'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service router-advert interface eth0.10 prefix ::/64 preferred-lifetime '2700'
set service router-advert interface eth0.10 prefix ::/64 valid-lifetime '5400'
set service router-advert interface eth1.20 prefix ::/64 preferred-lifetime '2700'
set service router-advert interface eth1.20 prefix ::/64 valid-lifetime '5400'
set service snmp community ro-community authorization 'ro'
set service snmp community ro-community network '172.16.100.0/24'
set service snmp contact 'VyOS'
set service snmp listen-address 172.16.254.30 port '161'
set service snmp location 'CLOUD'
set service ssh disable-host-validation
set service ssh port '22'
set system config-management commit-revisions '200'
set system conntrack expect-table-size '2048'
set system conntrack hash-size '32768'
set system conntrack modules ftp
set system conntrack modules h323
set system conntrack modules nfs
set system conntrack modules pptp
set system conntrack modules sqlnet
set system conntrack modules tftp
set system conntrack table-size '262144'
set system conntrack timeout
set system console device ttyS0 speed '115200'
set system domain-name 'vyos.net'
set system host-name 'r1'
set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
set system login user vyos authentication plaintext-password ''
set system name-server '172.16.254.30'
set system option ctrl-alt-delete 'ignore'
-set system option performance 'latency'
+set system option performance 'network-latency'
set system option reboot-on-panic
set system option startup-beep
set system syslog global facility all level 'debug'
set system syslog global facility local7 level 'debug'
set system syslog host 172.16.100.1 facility all level 'warning'
set system time-zone 'Europe/Berlin'
diff --git a/smoketest/configs/dialup-router-wireguard-ipv6 b/smoketest/configs/dialup-router-wireguard-ipv6
index 058582148..767606341 100644
--- a/smoketest/configs/dialup-router-wireguard-ipv6
+++ b/smoketest/configs/dialup-router-wireguard-ipv6
@@ -1,1645 +1,1645 @@
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
group {
address-group DMZ-WEBSERVER {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
address 172.16.36.10
address 172.16.36.40
address 172.16.36.20
}
address-group DMZ-RDP-SERVER {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
address 172.16.33.40
}
address-group DOMAIN-CONTROLLER {
address 172.16.100.10
address 172.16.100.20
address 172.16.110.30
}
address-group VIDEO {
address 172.16.33.211
address 172.16.33.212
address 172.16.33.213
address 172.16.33.214
}
ipv6-network-group LOCAL-ADDRESSES {
network ff02::/64
network fe80::/10
}
network-group SSH-IN-ALLOW {
network 100.65.150.0/23
network 100.64.69.205/32
network 100.64.8.67/32
network 100.64.55.1/32
}
}
ipv6-name ALLOW-ALL-6 {
default-action accept
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
}
ipv6-name ALLOW-BASIC-6 {
default-action drop
enable-default-log
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
rule 1 {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
action accept
state {
established enable
related enable
}
}
rule 2 {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
action drop
state {
invalid enable
}
}
rule 10 {
action accept
protocol icmpv6
}
}
ipv6-name ALLOW-ESTABLISHED-6 {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 10 {
action accept
destination {
group {
network-group LOCAL-ADDRESSES
}
}
protocol icmpv6
source {
address fe80::/10
}
}
rule 20 {
action accept
icmpv6 {
type echo-request
}
protocol icmpv6
}
rule 21 {
action accept
icmpv6 {
type destination-unreachable
}
protocol icmpv6
}
rule 22 {
action accept
icmpv6 {
type packet-too-big
}
protocol icmpv6
}
rule 23 {
action accept
icmpv6 {
type time-exceeded
}
protocol icmpv6
}
rule 24 {
action accept
icmpv6 {
type parameter-problem
}
protocol icmpv6
}
}
ipv6-name WAN-LOCAL-6 {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 10 {
action accept
destination {
address ff02::/64
}
protocol icmpv6
source {
address fe80::/10
}
}
rule 50 {
action accept
destination {
address fe80::/10
port 546
}
protocol udp
source {
address fe80::/10
port 547
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name DMZ-GUEST {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
}
name DMZ-LAN {
default-action drop
enable-default-log
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
rule 1 {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
log enable
state {
invalid enable
}
}
rule 100 {
action accept
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
destination {
group {
address-group DOMAIN-CONTROLLER
}
port 123,389,636
}
protocol tcp_udp
}
rule 300 {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
action accept
destination {
group {
address-group DMZ-RDP-SERVER
}
port 3389
}
protocol tcp_udp
source {
address 172.16.36.20
}
}
}
name DMZ-LOCAL {
default-action drop
enable-default-log
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 50 {
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
action accept
destination {
address 172.16.254.30
port 53
}
protocol tcp_udp
}
rule 123 {
action accept
destination {
port 123
}
protocol udp
}
}
name DMZ-WAN {
default-action accept
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
}
name GUEST-DMZ {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
}
name GUEST-LAN {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
}
name GUEST-LOCAL {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 10 {
action accept
destination {
address 172.31.0.254
port 53
}
protocol tcp_udp
}
rule 11 {
action accept
destination {
port 67
}
protocol udp
}
rule 15 {
action accept
destination {
address 172.31.0.254
}
protocol icmp
}
rule 100 {
action accept
destination {
address 172.31.0.254
port 80,443
}
protocol tcp
}
}
name GUEST-WAN {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 25 {
action accept
destination {
port 25,587
}
protocol tcp
}
rule 53 {
action accept
destination {
port 53
}
protocol tcp_udp
}
rule 60 {
action accept
source {
address 172.31.0.200
}
}
rule 80 {
action accept
source {
address 172.31.0.200
}
}
rule 100 {
action accept
protocol icmp
}
rule 110 {
action accept
destination {
port 110,995
}
protocol tcp
}
rule 123 {
action accept
destination {
port 123
}
protocol udp
}
rule 143 {
action accept
destination {
port 143,993
}
protocol tcp
}
rule 200 {
action accept
destination {
port 80,443
}
protocol tcp
}
rule 500 {
action accept
destination {
port 500,4500
}
protocol udp
}
rule 600 {
action accept
destination {
port 5222-5224
}
protocol tcp
}
rule 601 {
action accept
destination {
port 3478-3497,4500,16384-16387,16393-16402
}
protocol udp
}
rule 1000 {
action accept
source {
address 172.31.0.184
}
}
}
name LAN-DMZ {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 22 {
action accept
destination {
port 22
}
protocol tcp
}
rule 100 {
action accept
destination {
group {
address-group DMZ-WEBSERVER
}
port 22
}
protocol tcp
}
}
name LAN-GUEST {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
}
name LAN-LOCAL {
default-action accept
}
name LAN-WAN {
default-action accept
rule 90 {
action accept
destination {
address 100.65.150.0/23
port 25
}
protocol tcp_udp
source {
group {
address-group VIDEO
}
}
}
rule 100 {
action drop
source {
group {
address-group VIDEO
}
}
}
}
name LOCAL-DMZ {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 100 {
action accept
destination {
address 172.16.36.40
port 80,443
}
protocol tcp
}
}
name LOCAL-GUEST {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 5 {
action accept
protocol icmp
}
rule 300 {
action accept
destination {
port 1900
}
protocol udp
}
}
name LOCAL-LAN {
default-action accept
}
name LOCAL-WAN {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 10 {
action accept
protocol icmp
}
rule 50 {
action accept
destination {
port 53
}
protocol tcp_udp
}
rule 80 {
action accept
destination {
port 80,443
}
protocol tcp
}
rule 123 {
action accept
destination {
port 123
}
protocol udp
}
rule 800 {
action accept
destination {
address 100.65.151.213
}
protocol udp
}
rule 805 {
action accept
destination {
address 100.65.151.2
}
protocol all
}
rule 1010 {
action accept
destination {
address 100.64.69.205
port 7705
}
protocol udp
source {
port 7705
}
}
rule 1990 {
action accept
destination {
address 100.64.55.1
port 10666
}
protocol udp
}
rule 2000 {
action accept
destination {
address 100.64.39.249
}
}
rule 10200 {
action accept
destination {
address 100.64.89.98
port 10200
}
protocol udp
source {
port 10200
}
}
}
name WAN-DMZ {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 100 {
action accept
destination {
address 172.16.36.10
port 80,443
}
protocol tcp
}
}
name WAN-GUEST {
default-action drop
enable-default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 1000 {
action accept
destination {
address 172.31.0.184
}
}
rule 8000 {
action accept
destination {
address 172.31.0.200
port 10000
}
protocol udp
}
}
name WAN-LAN {
default-action drop
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
enable-default-log
rule 1 {
action accept
description "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua."
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 1000 {
action accept
destination {
address 172.16.33.40
port 3389
}
protocol tcp
source {
group {
network-group SSH-IN-ALLOW
}
}
}
}
name WAN-LOCAL {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
rule 22 {
action accept
destination {
port 22
}
protocol tcp
source {
group {
network-group SSH-IN-ALLOW
}
}
}
rule 1990 {
action accept
destination {
port 10666
}
protocol udp
source {
address 100.64.55.1
}
}
rule 10000 {
action accept
destination {
port 80,443
}
protocol tcp
}
rule 10100 {
action accept
destination {
port 10100
}
protocol udp
source {
port 10100
}
}
rule 10200 {
action accept
destination {
port 10200
}
protocol udp
source {
address 100.64.89.98
port 10200
}
}
}
options {
interface pppoe0 {
adjust-mss 1452
adjust-mss6 1432
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
dummy dum0 {
address 172.16.254.30/32
}
ethernet eth0 {
duplex auto
offload {
gro
gso
sg
tso
}
ring-buffer {
rx 256
tx 256
}
speed auto
vif 5 {
address 172.16.37.254/24
ip {
ospf {
authentication {
md5 {
key-id 10 {
md5-key ospf
}
}
}
dead-interval 40
hello-interval 10
priority 1
retransmit-interval 5
transmit-delay 1
}
}
}
vif 10 {
address 172.16.33.254/24
address 172.16.40.254/24
}
vif 50 {
address 172.16.36.254/24
}
}
ethernet eth1 {
duplex auto
offload {
gro
gso
sg
tso
}
speed auto
vif 20 {
address 172.31.0.254/24
}
}
ethernet eth2 {
disable
duplex auto
offload {
gro
gso
sg
tso
}
speed auto
}
ethernet eth3 {
duplex auto
offload {
gro
gso
sg
tso
}
ring-buffer {
rx 256
tx 256
}
speed auto
vif 7 {
}
}
loopback lo {
address 172.16.254.30/32
}
pppoe pppoe0 {
authentication {
password vyos
user vyos
}
default-route force
dhcpv6-options {
pd 0 {
interface eth0.10 {
address 1
sla-id 10
}
interface eth1.20 {
address 1
sla-id 20
}
length 56
}
}
ipv6 {
address {
autoconf
}
}
no-peer-dns
source-interface eth3.7
}
wireguard wg100 {
address 172.16.252.128/31
mtu 1500
peer HR6 {
address 100.65.151.213
allowed-ips 0.0.0.0/0
port 10100
pubkey yLpi+UZuI019bmWH2h5fX3gStbpPPPLgEoYMyrdkOnQ=
}
port 10100
}
wireguard wg200 {
address 172.16.252.130/31
mtu 1500
peer WH56 {
address 80.151.69.205
allowed-ips 0.0.0.0/0
port 10200
pubkey XQbkj6vnKKBJfJQyThXysU0iGxCvEOEb31kpaZgkrD8=
}
port 10200
}
wireguard wg666 {
address 172.29.0.1/31
mtu 1500
peer WH34 {
address 100.65.55.1
allowed-ips 0.0.0.0/0
port 10666
pubkey yaTN4+xAafKM04D+Baeg5GWfbdaw35TE9HQivwRgAk0=
}
port 10666
}
}
nat {
destination {
rule 8000 {
destination {
port 10000
}
inbound-interface pppoe0
protocol udp
translation {
address 172.31.0.200
}
}
}
source {
rule 50 {
outbound-interface pppoe0
source {
address 100.64.0.0/24
}
translation {
address masquerade
}
}
rule 100 {
outbound-interface pppoe0
source {
address 172.16.32.0/21
}
translation {
address masquerade
}
}
rule 200 {
outbound-interface pppoe0
source {
address 172.16.100.0/24
}
translation {
address masquerade
}
}
rule 300 {
outbound-interface pppoe0
source {
address 172.31.0.0/24
}
translation {
address masquerade
}
}
rule 400 {
outbound-interface pppoe0
source {
address 172.18.200.0/21
}
translation {
address masquerade
}
}
rule 1000 {
destination {
address 192.168.189.0/24
}
outbound-interface wg666
source {
address 172.16.32.0/21
}
translation {
address 172.29.0.1
}
}
rule 1001 {
destination {
address 192.168.189.0/24
}
outbound-interface wg666
source {
address 172.16.100.0/24
}
translation {
address 172.29.0.1
}
}
}
}
policy {
route-map MAP-OSPF-CONNECTED {
rule 1 {
action deny
match {
interface eth1.20
}
}
rule 20 {
action permit
match {
interface eth0.10
}
}
rule 40 {
action permit
match {
interface eth0.50
}
}
}
}
protocols {
bfd {
peer 172.16.252.129 {
}
peer 172.16.252.131 {
}
peer 172.18.254.201 {
}
}
bgp 64503 {
address-family {
ipv4-unicast {
network 172.16.32.0/21 {
}
network 172.16.100.0/24 {
}
network 172.16.252.128/31 {
}
network 172.16.252.130/31 {
}
network 172.16.254.30/32 {
}
network 172.18.0.0/16 {
}
}
}
neighbor 172.16.252.129 {
peer-group WIREGUARD
}
neighbor 172.16.252.131 {
peer-group WIREGUARD
}
neighbor 172.18.254.201 {
address-family {
ipv4-unicast {
nexthop-self {
}
}
}
bfd {
}
remote-as 64503
update-source dum0
}
parameters {
default {
no-ipv4-unicast
}
log-neighbor-changes
}
peer-group WIREGUARD {
address-family {
ipv4-unicast {
soft-reconfiguration {
inbound
}
}
}
bfd
remote-as external
}
timers {
holdtime 30
keepalive 10
}
}
ospf {
area 0 {
network 172.16.254.30/32
network 172.16.37.0/24
network 172.18.201.0/24
network 172.18.202.0/24
network 172.18.203.0/24
network 172.18.204.0/24
}
default-information {
originate {
always
metric-type 2
}
}
log-adjacency-changes {
detail
}
parameters {
abr-type cisco
router-id 172.16.254.30
}
passive-interface default
passive-interface-exclude eth0.5
redistribute {
connected {
metric-type 2
route-map MAP-OSPF-CONNECTED
}
}
}
static {
interface-route6 2000::/3 {
next-hop-interface pppoe0 {
}
}
route 10.0.0.0/8 {
blackhole {
distance 254
}
}
route 169.254.0.0/16 {
blackhole {
distance 254
}
}
route 172.16.0.0/12 {
blackhole {
distance 254
}
}
route 172.16.32.0/21 {
blackhole {
}
}
route 172.18.0.0/16 {
blackhole {
}
}
route 172.29.0.2/31 {
next-hop 172.29.0.0 {
}
}
route 192.168.0.0/16 {
blackhole {
distance 254
}
}
route 192.168.189.0/24 {
next-hop 172.29.0.0 {
}
}
}
}
service {
dhcp-server {
shared-network-name BACKBONE {
authoritative
subnet 172.16.37.0/24 {
default-router 172.16.37.254
domain-name vyos.net
domain-search vyos.net
lease 86400
name-server 172.16.254.30
ntp-server 172.16.254.30
range 0 {
start 172.16.37.120
stop 172.16.37.149
}
static-mapping AP1 {
ip-address 172.16.37.231
mac-address 02:00:00:00:ee:18
}
static-mapping AP2 {
ip-address 172.16.37.232
mac-address 02:00:00:00:52:84
}
static-mapping AP3 {
ip-address 172.16.37.233
mac-address 02:00:00:00:51:c0
}
static-mapping AP4 {
ip-address 172.16.37.234
mac-address 02:00:00:00:e6:fc
}
static-mapping AP5 {
ip-address 172.16.37.235
mac-address 02:00:00:00:c3:50
}
}
}
shared-network-name GUEST {
authoritative
subnet 172.31.0.0/24 {
default-router 172.31.0.254
domain-name vyos.net
domain-search vyos.net
lease 86400
name-server 172.31.0.254
range 0 {
start 172.31.0.101
stop 172.31.0.199
}
}
}
shared-network-name LAN {
authoritative
subnet 172.16.33.0/24 {
default-router 172.16.33.254
domain-name vyos.net
domain-search vyos.net
lease 86400
name-server 172.16.254.30
ntp-server 172.16.254.30
range 0 {
start 172.16.33.100
stop 172.16.33.189
}
static-mapping one {
ip-address 172.16.33.221
mac-address 02:00:00:00:eb:a6
}
static-mapping two {
ip-address 172.16.33.211
mac-address 02:00:00:00:58:90
}
static-mapping three {
ip-address 172.16.33.212
mac-address 02:00:00:00:12:c7
}
static-mapping four {
ip-address 172.16.33.214
mac-address 02:00:00:00:c4:33
}
}
}
}
dns {
dynamic {
interface pppoe0 {
service vyos {
host-name r1.vyos.net
login vyos-vyos
password vyos
protocol dyndns2
server dyndns.vyos.io
}
}
}
forwarding {
allow-from 172.16.0.0/12
domain 16.172.in-addr.arpa {
addnta
recursion-desired
server 172.16.100.10
server 172.16.100.20
}
domain 18.172.in-addr.arpa {
addnta
recursion-desired
server 172.16.100.10
server 172.16.100.20
}
domain vyos.net {
addnta
recursion-desired
server 172.16.100.20
server 172.16.100.10
}
ignore-hosts-file
listen-address 172.16.254.30
listen-address 172.31.0.254
negative-ttl 60
}
}
lldp {
legacy-protocols {
cdp
edp
fdp
sonmp
}
snmp {
enable
}
}
router-advert {
interface eth0.10 {
prefix ::/64 {
preferred-lifetime 2700
valid-lifetime 5400
}
}
interface eth1.20 {
prefix ::/64 {
preferred-lifetime 2700
valid-lifetime 5400
}
}
}
snmp {
community ro-community {
authorization ro
network 172.16.100.0/24
}
contact "VyOS"
listen-address 172.16.254.30 {
port 161
}
location "CLOUD"
}
ssh {
disable-host-validation
port 22
}
}
system {
config-management {
commit-revisions 200
}
conntrack {
expect-table-size 2048
hash-size 32768
modules {
ftp
h323
nfs
pptp
sqlnet
tftp
}
table-size 262144
timeout {
icmp 30
other 600
udp {
other 300
stream 300
}
}
}
console {
device ttyS0 {
speed 115200
}
}
domain-name vyos.net
host-name r1
login {
user vyos {
authentication {
encrypted-password $6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/
plaintext-password ""
}
}
}
name-server 172.16.254.30
ntp {
allow-clients {
address 172.16.0.0/12
}
server time1.vyos.net {
}
server time2.vyos.net {
}
}
option {
ctrl-alt-delete ignore
- performance latency
+ performance network-latency
reboot-on-panic
startup-beep
}
syslog {
global {
facility all {
level debug
}
facility protocols {
level debug
}
}
host 172.16.100.1 {
facility all {
level warning
}
}
}
time-zone Europe/Berlin
}
traffic-policy {
shaper QoS {
bandwidth 50mbit
default {
bandwidth 100%
burst 15k
queue-limit 1000
queue-type fq-codel
}
}
}
zone-policy {
zone DMZ {
default-action drop
from GUEST {
firewall {
name GUEST-DMZ
}
}
from LAN {
firewall {
name LAN-DMZ
}
}
from LOCAL {
firewall {
name LOCAL-DMZ
}
}
from WAN {
firewall {
name WAN-DMZ
}
}
interface eth0.50
}
zone GUEST {
default-action drop
from DMZ {
firewall {
name DMZ-GUEST
}
}
from LAN {
firewall {
name LAN-GUEST
}
}
from LOCAL {
firewall {
ipv6-name ALLOW-ALL-6
name LOCAL-GUEST
}
}
from WAN {
firewall {
ipv6-name ALLOW-ESTABLISHED-6
name WAN-GUEST
}
}
interface eth1.20
}
zone LAN {
default-action drop
from DMZ {
firewall {
name DMZ-LAN
}
}
from GUEST {
firewall {
name GUEST-LAN
}
}
from LOCAL {
firewall {
ipv6-name ALLOW-ALL-6
name LOCAL-LAN
}
}
from WAN {
firewall {
ipv6-name ALLOW-ESTABLISHED-6
name WAN-LAN
}
}
interface eth0.5
interface eth0.10
interface wg100
interface wg200
}
zone LOCAL {
default-action drop
from DMZ {
firewall {
name DMZ-LOCAL
}
}
from GUEST {
firewall {
ipv6-name ALLOW-ESTABLISHED-6
name GUEST-LOCAL
}
}
from LAN {
firewall {
ipv6-name ALLOW-ALL-6
name LAN-LOCAL
}
}
from WAN {
firewall {
ipv6-name WAN-LOCAL-6
name WAN-LOCAL
}
}
local-zone
}
zone WAN {
default-action drop
from DMZ {
firewall {
name DMZ-WAN
}
}
from GUEST {
firewall {
ipv6-name ALLOW-ALL-6
name GUEST-WAN
}
}
from LAN {
firewall {
ipv6-name ALLOW-ALL-6
name LAN-WAN
}
}
from LOCAL {
firewall {
ipv6-name ALLOW-ALL-6
name LOCAL-WAN
}
}
interface pppoe0
interface wg666
}
}
// Warning: Do not remove the following line.
// vyos-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@22:ipoe-server@1:ipsec@5:isis@1:l2tp@3:lldp@1:mdns@1:nat@5:ntp@1:pppoe-server@5:pptp@2:qos@1:quagga@8:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@21:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1"
// Release version: 1.3.4
diff --git a/smoketest/scripts/cli/test_system_option.py b/smoketest/scripts/cli/test_system_option.py
index ed0280628..f3112cf0b 100755
--- a/smoketest/scripts/cli/test_system_option.py
+++ b/smoketest/scripts/cli/test_system_option.py
@@ -1,99 +1,101 @@
#!/usr/bin/env python3
#
# Copyright (C) 2024 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
import unittest
from base_vyostest_shim import VyOSUnitTestSHIM
from vyos.utils.file import read_file
from vyos.utils.process import is_systemd_service_active
from vyos.utils.system import sysctl_read
base_path = ['system', 'option']
+
class TestSystemOption(VyOSUnitTestSHIM.TestCase):
def tearDown(self):
self.cli_delete(base_path)
self.cli_commit()
def test_ctrl_alt_delete(self):
self.cli_set(base_path + ['ctrl-alt-delete', 'reboot'])
self.cli_commit()
tmp = os.readlink('/lib/systemd/system/ctrl-alt-del.target')
self.assertEqual(tmp, '/lib/systemd/system/reboot.target')
self.cli_set(base_path + ['ctrl-alt-delete', 'poweroff'])
self.cli_commit()
tmp = os.readlink('/lib/systemd/system/ctrl-alt-del.target')
self.assertEqual(tmp, '/lib/systemd/system/poweroff.target')
self.cli_delete(base_path + ['ctrl-alt-delete', 'poweroff'])
self.cli_commit()
self.assertFalse(os.path.exists('/lib/systemd/system/ctrl-alt-del.target'))
def test_reboot_on_panic(self):
panic_file = '/proc/sys/kernel/panic'
tmp = read_file(panic_file)
self.assertEqual(tmp, '0')
self.cli_set(base_path + ['reboot-on-panic'])
self.cli_commit()
tmp = read_file(panic_file)
self.assertEqual(tmp, '60')
def test_performance(self):
tuned_service = 'tuned.service'
+ path = ['system', 'sysctl', 'parameter']
self.assertFalse(is_systemd_service_active(tuned_service))
# T3204 sysctl options must not be overwritten by tuned
gc_thresh1 = '131072'
gc_thresh2 = '262000'
gc_thresh3 = '524000'
- self.cli_set(['system', 'sysctl', 'parameter', 'net.ipv4.neigh.default.gc_thresh1', 'value', gc_thresh1])
- self.cli_set(['system', 'sysctl', 'parameter', 'net.ipv4.neigh.default.gc_thresh2', 'value', gc_thresh2])
- self.cli_set(['system', 'sysctl', 'parameter', 'net.ipv4.neigh.default.gc_thresh3', 'value', gc_thresh3])
+ self.cli_set(path + ['net.ipv4.neigh.default.gc_thresh1', 'value', gc_thresh1])
+ self.cli_set(path + ['net.ipv4.neigh.default.gc_thresh2', 'value', gc_thresh2])
+ self.cli_set(path + ['net.ipv4.neigh.default.gc_thresh3', 'value', gc_thresh3])
- self.cli_set(base_path + ['performance', 'throughput'])
+ self.cli_set(base_path + ['performance', 'network-throughput'])
self.cli_commit()
self.assertTrue(is_systemd_service_active(tuned_service))
self.assertEqual(sysctl_read('net.ipv4.neigh.default.gc_thresh1'), gc_thresh1)
self.assertEqual(sysctl_read('net.ipv4.neigh.default.gc_thresh2'), gc_thresh2)
self.assertEqual(sysctl_read('net.ipv4.neigh.default.gc_thresh3'), gc_thresh3)
def test_ssh_client_options(self):
loopback = 'lo'
ssh_client_opt_file = '/etc/ssh/ssh_config.d/91-vyos-ssh-client-options.conf'
self.cli_set(['system', 'option', 'ssh-client', 'source-interface', loopback])
self.cli_commit()
tmp = read_file(ssh_client_opt_file)
self.assertEqual(tmp, f'BindInterface {loopback}')
self.cli_delete(['system', 'option'])
self.cli_commit()
self.assertFalse(os.path.exists(ssh_client_opt_file))
if __name__ == '__main__':
unittest.main(verbosity=2)
diff --git a/src/conf_mode/system_option.py b/src/conf_mode/system_option.py
index a84572f83..e2832cde6 100755
--- a/src/conf_mode/system_option.py
+++ b/src/conf_mode/system_option.py
@@ -1,218 +1,228 @@
#!/usr/bin/env python3
#
# Copyright (C) 2019-2024 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
from sys import exit
from time import sleep
from vyos.config import Config
from vyos.configverify import verify_source_interface
from vyos.configverify import verify_interface_exists
from vyos.system import grub_util
from vyos.template import render
from vyos.utils.cpu import get_cpus
from vyos.utils.dict import dict_search
from vyos.utils.file import write_file
from vyos.utils.kernel import check_kmod
from vyos.utils.process import cmd
from vyos.utils.process import is_systemd_service_running
from vyos.utils.network import is_addr_assigned
from vyos.utils.network import is_intf_addr_assigned
from vyos.configdep import set_dependents
from vyos.configdep import call_dependents
from vyos import ConfigError
from vyos import airbag
airbag.enable()
curlrc_config = r'/etc/curlrc'
ssh_config = r'/etc/ssh/ssh_config.d/91-vyos-ssh-client-options.conf'
systemd_action_file = '/lib/systemd/system/ctrl-alt-del.target'
usb_autosuspend = r'/etc/udev/rules.d/40-usb-autosuspend.rules'
kernel_dynamic_debug = r'/sys/kernel/debug/dynamic_debug/control'
time_format_to_locale = {'12-hour': 'en_US.UTF-8', '24-hour': 'en_GB.UTF-8'}
+tuned_profiles = {
+ 'power-save': 'powersave',
+ 'network-latency': 'network-latency',
+ 'network-throughput': 'network-throughput',
+ 'virtual-guest': 'virtual-guest',
+ 'virtual-host': 'virtual-host',
+}
def get_config(config=None):
if config:
conf = config
else:
conf = Config()
base = ['system', 'option']
options = conf.get_config_dict(
base, key_mangling=('-', '_'), get_first_key=True, with_recursive_defaults=True
)
if 'performance' in options:
# Update IPv4/IPv6 and sysctl options after tuned applied it's settings
set_dependents('ip_ipv6', conf)
set_dependents('sysctl', conf)
return options
def verify(options):
if 'http_client' in options:
config = options['http_client']
if 'source_interface' in config:
verify_interface_exists(options, config['source_interface'])
if {'source_address', 'source_interface'} <= set(config):
raise ConfigError(
'Can not define both HTTP source-interface and source-address'
)
if 'source_address' in config:
if not is_addr_assigned(config['source_address']):
raise ConfigError('No interface with give address specified!')
if 'ssh_client' in options:
config = options['ssh_client']
if 'source_address' in config:
address = config['source_address']
if not is_addr_assigned(config['source_address']):
raise ConfigError('No interface with address "{address}" configured!')
if 'source_interface' in config:
# verify_source_interface reuires key 'ifname'
config['ifname'] = config['source_interface']
verify_source_interface(config)
if 'source_address' in config:
address = config['source_address']
interface = config['source_interface']
if not is_intf_addr_assigned(interface, address):
raise ConfigError(
f'Address "{address}" not assigned on interface "{interface}"!'
)
if 'kernel' in options:
cpu_vendor = get_cpus()[0]['vendor_id']
if 'amd_pstate_driver' in options['kernel'] and cpu_vendor != 'AuthenticAMD':
raise ConfigError(
f'AMD pstate driver cannot be used with "{cpu_vendor}" CPU!'
)
return None
def generate(options):
render(curlrc_config, 'system/curlrc.j2', options)
render(ssh_config, 'system/ssh_config.j2', options)
render(usb_autosuspend, 'system/40_usb_autosuspend.j2', options)
cmdline_options = []
if 'kernel' in options:
if 'disable_mitigations' in options['kernel']:
cmdline_options.append('mitigations=off')
if 'disable_power_saving' in options['kernel']:
cmdline_options.append('intel_idle.max_cstate=0 processor.max_cstate=1')
if 'amd_pstate_driver' in options['kernel']:
mode = options['kernel']['amd_pstate_driver']
cmdline_options.append(
f'initcall_blacklist=acpi_cpufreq_init amd_pstate={mode}'
)
grub_util.update_kernel_cmdline_options(' '.join(cmdline_options))
return None
def apply(options):
# System bootup beep
beep_service = 'vyos-beep.service'
if 'startup_beep' in options:
cmd(f'systemctl enable {beep_service}')
else:
cmd(f'systemctl disable {beep_service}')
# Ctrl-Alt-Delete action
if os.path.exists(systemd_action_file):
os.unlink(systemd_action_file)
if 'ctrl_alt_delete' in options:
if options['ctrl_alt_delete'] == 'reboot':
os.symlink('/lib/systemd/system/reboot.target', systemd_action_file)
elif options['ctrl_alt_delete'] == 'poweroff':
os.symlink('/lib/systemd/system/poweroff.target', systemd_action_file)
# Configure HTTP client
if 'http_client' not in options:
if os.path.exists(curlrc_config):
os.unlink(curlrc_config)
# Configure SSH client
if 'ssh_client' not in options:
if os.path.exists(ssh_config):
os.unlink(ssh_config)
# Reboot system on kernel panic
timeout = '0'
if 'reboot_on_panic' in options:
timeout = '60'
with open('/proc/sys/kernel/panic', 'w') as f:
f.write(timeout)
# tuned - performance tuning
if 'performance' in options:
cmd('systemctl restart tuned.service')
# wait until daemon has started before sending configuration
while not is_systemd_service_running('tuned.service'):
sleep(0.250)
- cmd('tuned-adm profile network-{performance}'.format(**options))
+ performance = ' '.join(
+ list(tuned_profiles[profile] for profile in options['performance'])
+ )
+ cmd(f'tuned-adm profile {performance}')
else:
cmd('systemctl stop tuned.service')
call_dependents()
# Keyboard layout - there will be always the default key inside the dict
# but we check for key existence anyway
if 'keyboard_layout' in options:
cmd('loadkeys {keyboard_layout}'.format(**options))
# Enable/diable root-partition-auto-resize SystemD service
if 'root_partition_auto_resize' in options:
cmd('systemctl enable root-partition-auto-resize.service')
else:
cmd('systemctl disable root-partition-auto-resize.service')
# Time format 12|24-hour
if 'time_format' in options:
time_format = time_format_to_locale.get(options['time_format'])
cmd(f'localectl set-locale LC_TIME={time_format}')
# Reload UDEV, required for USB auto suspend
cmd('udevadm control --reload-rules')
# Enable/disable dynamic debugging for kernel modules
modules = ['wireguard']
modules_enabled = dict_search('kernel.debug', options) or []
for module in modules:
if module in modules_enabled:
check_kmod(module)
write_file(kernel_dynamic_debug, f'module {module} +p')
else:
write_file(kernel_dynamic_debug, f'module {module} -p')
if __name__ == '__main__':
try:
c = get_config()
verify(c)
generate(c)
apply(c)
except ConfigError as e:
print(e)
exit(1)
diff --git a/src/migration-scripts/system/27-to-28 b/src/migration-scripts/system/27-to-28
new file mode 100644
index 000000000..0a5be48ab
--- /dev/null
+++ b/src/migration-scripts/system/27-to-28
@@ -0,0 +1,33 @@
+# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library. If not, see <http://www.gnu.org/licenses/>.
+
+# rename 'system option performance' leaf nodes to new names
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'option', 'performance']
+
+def migrate(config: ConfigTree) -> None:
+ if not config.exists(base):
+ return
+
+ replace = {
+ 'throughput' : 'network-throughput',
+ 'latency' : 'network-latency'
+ }
+
+ for old_name, new_name in replace.items():
+ if config.return_value(base) == old_name:
+ config.set(base, new_name)