VyOS Can Loose Parts Of Its Config On Reboot - In Certain Situations
Open, HighPublic


Create a very basic firewall config like this http://pastebin.com/biT3iNes then delete (or rename) the TrustedHosts address group ( The CLI will give you an error like: "Error: group [TrustedHosts] still in use" but it will remove the group anyway ), commit, save, reboot.

After it reboots the entire EXTERNAL-TO-SELF firewall will not exist because a single rule failed to evaluate. This problem is amplified when you consider other parts of the config tree, you will loose zones because the single firewall no longer exists. Same with ESP/IKE groups, you will loose peers definitions.

This partiuclar issue can be fixed by making the "still in use" error fatal, maybe their is a generic way to solve this for all portions of the config tree


Difficulty level
Hard (possibly days)
syncer assigned this task to dmbaturin.Jul 25 2016, 4:15 PM
syncer triaged this task as High priority.
syncer edited projects, added VyOS 1.1.x (1.1.8); removed VyOS 1.1.x.
syncer added subscribers: VyOS 1.1.x, VyOS 1.1.x (1.1.8).
syncer removed a subscriber: VyOS 1.1.x (1.1.8).
syncer edited subscribers, added: Maintainers; removed: VyOS 1.1.x.Aug 21 2017, 2:05 AM
syncer added a subscriber: syncer.

@jhendryUK is this also affects 1.2.x ?

syncer edited projects, added VyOS 1.2.x; removed VyOS 1.1.x.Oct 11 2017, 9:40 PM

Assuming that 1.2 affected in same way,
moving it to 1.2 and suggest work on fix there

sebastianm added a subscriber: sebastianm.EditedOct 12 2017, 9:38 AM

This also happens with the DHCP server configuration if the DHCP subnet is different than the one used on the LAN interface (when it's configured with VRRP by following the VRRP tutorial on the VyOS wiki).

From the logs, it looks like the DHCP server doesn't listen on the LAN interface because the DHCP subnet (example: doesn't match the LAN interface subnet (, although the VRRP subnet is set to

Same for 1.1.7. @syncer