Flowtable couldn't enable with zone-based-firewall at VyOS 1.5 rolling 2026.03.09-0026 and VyOS 2026.03(stream)
The error message differs between the first commit attempt after boot and subsequent commit attempts.
I also tried deleting and recreating the firewall rules, but the behavior is the same.
version info
・VyOS 1.5 rolling
```
vyos@vyos:~$ show version
Version: VyOS 2026.03.09-0026-rolling
Release train: current
Release flavor: generic
Built by: autobuild@vyos.net
Built on: Mon 09 Mar 2026 00:27 UTC
Build UUID: 834eecd2-208b-4429-9371-eb3d2b2a473a
Build commit ID: fbdce6466748fd
Architecture: x86_64
Boot via: installed image
System type: bare metal
Secure Boot: disabled
Hardware vendor: Dell Inc.
Hardware model: OptiPlex 3070
Hardware S/N: *******
Hardware UUID: ********-****-****-****-************
Copyright: VyOS maintainers and contributors
```
・VyOS 1.5 stream(2026.03)
```
vyos@vyos:~$ show ver
Version: VyOS 2026.03
Release train: circinus
Release flavor: generic
Built by: autobuild@vyos.net
Built on: Wed 18 Mar 2026 20:03 UTC
Build UUID: 3969e1c7-a4bb-459a-ac7f-54749c153d21
Build commit ID: 1cac4fd63750b0
Architecture: x86_64
Boot via: installed image
System type: bare metal
Hardware vendor: Dell Inc.
Hardware model: OptiPlex 3070
Hardware S/N: *******
Hardware UUID: ********-****-****-****-************
Copyright: VyOS maintainers and contributors
```
・lspci
```
vyos@vyos:~$ lspci
00:00.0 Host bridge: Intel Corporation 8th Gen Core Processor Host Bridge/DRAM Registers (rev 07)
00:01.0 PCI bridge: Intel Corporation 6th-10th Gen Core Processor PCIe Controller (x16) (rev 07)
00:02.0 VGA compatible controller: Intel Corporation CoffeeLake-S GT2 [UHD Graphics 630]
00:08.0 System peripheral: Intel Corporation Xeon E3-1200 v5/v6 / E3-1500 v5 / 6th/7th/8th Gen Core Processor Gaussian Mixture Model
00:12.0 Signal processing controller: Intel Corporation Cannon Lake PCH Thermal Controller (rev 10)
00:14.0 USB controller: Intel Corporation Cannon Lake PCH USB 3.1 xHCI Host Controller (rev 10)
00:14.2 RAM memory: Intel Corporation Cannon Lake PCH Shared SRAM (rev 10)
00:16.0 Communication controller: Intel Corporation Cannon Lake PCH HECI Controller (rev 10)
00:17.0 SATA controller: Intel Corporation Cannon Lake PCH SATA AHCI Controller (rev 10)
00:1c.0 PCI bridge: Intel Corporation Cannon Lake PCH PCI Express Root Port #5 (rev f0)
00:1f.0 ISA bridge: Intel Corporation H370 Chipset LPC/eSPI Controller (rev 10)
00:1f.3 Audio device: Intel Corporation Cannon Lake PCH cAVS (rev 10)
00:1f.4 SMBus: Intel Corporation Cannon Lake PCH SMBus Controller (rev 10)
00:1f.5 Serial bus controller: Intel Corporation Cannon Lake PCH SPI Controller (rev 10)
01:00.0 Ethernet controller: Mellanox Technologies MT27710 Family [ConnectX-4 Lx]
01:00.1 Ethernet controller: Mellanox Technologies MT27710 Family [ConnectX-4 Lx]
02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15)
vyos@vyos:~$
```
Below are the steps I followed in my configuration:
1, Configure the flowtable.
```
set firewall flowtable FT interface ‘eth0’
set firewall flowtable FT interface ‘eth1’
set firewall flowtable FT interface ‘pppoe0’
set firewall flowtable FT offload ‘software’
```
2, Define the zone-based firewall rules.
```
*At this stage, I mistakenly assumed that the offload rule should use action accept.
set firewall ipv4 name Any-WAN-v4 default-action ‘accept’
set firewall ipv4 name Any-WAN-v4 rule 10 action ‘accept’
set firewall ipv4 name Any-WAN-v4 rule 10 offload-target ‘FT’
set firewall ipv4 name Any-WAN-v4 rule 10 state ‘established’
set firewall ipv4 name Any-WAN-v4 rule 10 state ‘related’
set firewall ipv4 name Any-WAN-v4 rule 20 action ‘accept’
set firewall ipv4 name Any-WAN-v4 rule 20 state ‘established’
set firewall ipv4 name Any-WAN-v4 rule 20 state ‘related’
set firewall ipv4 name Any-WAN-v4 rule 30 action ‘drop’
set firewall ipv4 name Any-WAN-v4 rule 30 state ‘invalid’
```
3, Apply the zone-based firewall rules.
```
set firewall zone private default-action ‘drop’
set firewall zone private from vyos firewall ipv6-name ‘VYOS-Any-v6’
set firewall zone private from vyos firewall name ‘VYOS-Private-v4’
set firewall zone private from wan firewall ipv6-name ‘WAN-Any-v6’
set firewall zone private from wan firewall name ‘WAN-Any-v4’
set firewall zone private member interface ‘eth1’
set firewall zone server-local default-action ‘drop’
set firewall zone server-local from vyos firewall ipv6-name ‘VYOS-Any-v6’
set firewall zone server-local from wan firewall ipv6-name ‘WAN-Any-v6’
set firewall zone server-local from wan firewall name ‘WAN-Any-v4’
set firewall zone server-local member interface ‘eth1.10’
set firewall zone vyos default-action ‘drop’
set firewall zone vyos from private firewall ipv6-name ‘Private-Any-v6’
set firewall zone vyos from private firewall name ‘Private-Any-v4’
set firewall zone vyos from wan firewall ipv6-name ‘WAN-VYOS-v6’
set firewall zone vyos from wan firewall name ‘WAN-Any-v4’
set firewall zone vyos local-zone
set firewall zone wan default-action ‘drop’
set firewall zone wan from private firewall ipv6-name ‘Any-WAN-v6’
set firewall zone wan from private firewall name ‘Any-WAN-v4’
set firewall zone wan from server-local firewall ipv6-name ‘Any-WAN-v6’
set firewall zone wan from server-local firewall name ‘Any-WAN-v4’
set firewall zone wan from vyos firewall ipv6-name ‘Any-WAN-v6’
set firewall zone wan from vyos firewall name ‘Any-WAN-v4’
set firewall zone wan member interface ‘pppoe0’
set firewall zone wan member interface ‘eth0’
```
4, Attempted to change rule number 10 in each zone-based firewall rule from accept to offload.
```
vyos@vyos:~$ configure
[edit]
vyos@vyos# set firewall ipv4 name Any-WAN-v4 rule 10 action 'offload'
[edit]
vyos@vyos# set firewall ipv4 name Any-WAN-v4 rule 10 offload-target 'FT'
Configuration path: [firewall ipv4 name Any-WAN-v4 rule 10 offload-target FT] already exists
```
**First commit attempt in VyOS 1.5 rolling**
```
[edit]
vyos@vyos# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:139:9-64: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:140:17-35: Error: Could not process rule: Operation
not supported oifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:140:9-50: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter return ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:141:9-20: Error: Could not process rule: Operation
not supported counter drop comment "zone_vyos default-action
drop" ^^^^^^^^^^^^ /run/nftables.conf:144:17-35: Error: Could
not process rule: Operation not supported iifname {
"pppoe0","eth0" } counter return ^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:144:9-50: Error: Could not process rule: Operation
not supported iifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:145:9-55:
Error: Could not process rule: Operation not supported iifname {
"eth1" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:146:9-41: Error: Could not process rule: Operation
not supported iifname { "eth1" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:147:9-58: Error:
Could not process rule: Operation not supported iifname {
"eth1.10" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:148:9-44: Error: Could not process rule: Operation
not supported iifname { "eth1.10" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:149:9-20: Error:
Could not process rule: Operation not supported counter drop
comment "zone_wan default-action drop" ^^^^^^^^^^^^
[[firewall]] failed
Commit failed
[edit]
vyos@vyos#
```
**Second and later attemptsin VyOS 1.5 rolling**
```
[edit]
vyos@vyos# commit
[ firewall ]
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script
script.apply(c)
File "/usr/libexec/vyos/conf_mode/firewall.py", line 697, in apply
parse_firewall_error(output.decode())
File "/usr/libexec/vyos/conf_mode/firewall.py", line 685, in parse_firewall_error
error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
^^^^^
UnboundLocalError: cannot access local variable 'chain' where it is not associated with a value
[[firewall]] failed
Commit failed
[edit]
vyos@vyos#
```
**First commit attempt in VyOS 1.5 2026.03(stream)**
```
[edit]
vyos@vyos# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:137:9-64: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:138:17-35: Error: Could not process rule: Operation
not supported oifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:138:9-50: Error: Could not
process rule: Operation not supported oifname { "pppoe0","eth0"
} counter return ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:139:9-20: Error: Could not process rule: Operation
not supported counter drop comment "zone_vyos default-action
drop" ^^^^^^^^^^^^ /run/nftables.conf:142:17-35: Error: Could
not process rule: Operation not supported iifname {
"pppoe0","eth0" } counter return ^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:142:9-50: Error: Could not process rule: Operation
not supported iifname { "pppoe0","eth0" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:143:9-55:
Error: Could not process rule: Operation not supported iifname {
"eth1" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:144:9-41: Error: Could not process rule: Operation
not supported iifname { "eth1" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:145:9-58: Error:
Could not process rule: Operation not supported iifname {
"eth1.10" } counter jump NAME_Any-WAN-v4
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:146:9-44: Error: Could not process rule: Operation
not supported iifname { "eth1.10" } counter return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:147:9-20: Error:
Could not process rule: Operation not supported counter drop
comment "zone_wan default-action drop" ^^^^^^^^^^^^
[[firewall]] failed
Commit failed
```
**Second and later attemptsin VyOS 1.5 2026.03(stream)**
```
[edit]
vyos@vyos# commit
[ firewall ]
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script
script.apply(c)
File "/usr/libexec/vyos//conf_mode/firewall.py", line 640, in apply
parse_firewall_error(output.decode())
File "/usr/libexec/vyos//conf_mode/firewall.py", line 628, in parse_firewall_error
error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
^^^^^
UnboundLocalError: cannot access local variable 'chain' where it is not associated with a value
[[firewall]] failed
Commit failed
[edit]
vyos@vyos# commit
[ firewall ]
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 157, in run_script
script.apply(c)
File "/usr/libexec/vyos//conf_mode/firewall.py", line 640, in apply
parse_firewall_error(output.decode())
File "/usr/libexec/vyos//conf_mode/firewall.py", line 628, in parse_firewall_error
error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
^^^^^
UnboundLocalError: cannot access local variable 'chain' where it is not associated with a value
[[firewall]] failed
Commit failed
[edit]
vyos@vyos#
```