Page MenuHomeVyOS Platform

Deleting all firewall zones failed and locked out box
Closed, ResolvedPublicBUG

Description

I was having a strange issue with some firewall rules earlier today, so on this box I just wanted to remove all firewalling until I could figure out what was going on.

So:

$ show configuration commands | grep zone
set system time-zone 'UTC'
set zone-policy zone DMZ default-action 'drop'
set zone-policy zone DMZ from LAN firewall name 'LAN-LOCAL'
set zone-policy zone DMZ interface 'eth0.6'
set zone-policy zone LAN default-action 'drop'
set zone-policy zone LAN from DMZ firewall name 'DMZ-LAN'
set zone-policy zone LAN from LOCAL firewall ipv6-name 'LOCAL-LAN-6'
set zone-policy zone LAN from LOCAL firewall name 'LOCAL-LAN'
set zone-policy zone LAN from WAN firewall ipv6-name 'WAN-LAN-6'
set zone-policy zone LAN from WAN firewall name 'WAN-LAN'
set zone-policy zone LAN interface 'eth0.2'
set zone-policy zone LAN interface 'eth0.10'
set zone-policy zone LAN interface 'eth0.50'
set zone-policy zone LAN interface 'eth0'
set zone-policy zone LAN interface 'l2tp+'
set zone-policy zone LAN interface 'eth1'
set zone-policy zone LAN interface 'wg0'
set zone-policy zone LAN interface 'wg3'
set zone-policy zone LOCAL default-action 'drop'
set zone-policy zone LOCAL from LAN firewall ipv6-name 'LAN-LOCAL-6'
set zone-policy zone LOCAL from LAN firewall name 'LAN-LOCAL'
set zone-policy zone LOCAL from WAN firewall ipv6-name 'WAN-LOCAL-6'
set zone-policy zone LOCAL from WAN firewall name 'WAN-LOCAL'
set zone-policy zone LOCAL local-zone
set zone-policy zone WAN default-action 'drop'
set zone-policy zone WAN from DMZ firewall name 'LAN-WAN'
set zone-policy zone WAN from LAN firewall ipv6-name 'LAN-WAN-6'
set zone-policy zone WAN from LAN firewall name 'LAN-WAN'
set zone-policy zone WAN from LOCAL firewall ipv6-name 'LOCAL-WAN-6'
set zone-policy zone WAN from LOCAL firewall name 'LOCAL-WAN'
set zone-policy zone WAN interface 'eth0.7'
set zone-policy zone WAN interface 'tun1'
set zone-policy zone WAN interface 'vtun1'
set zone-policy zone WAN interface 'wg1'
set zone-policy zone WAN interface 'wg2'

admin@edge:~$ conf
[edit]
admin@edge# delete zone-policy
[edit]
admin@edge# commit
save
[ zone-policy zone LAN interface wg3 ]
ip6tables: Bad rule (does a matching rule exist in that chain?).
Error: call to delete interface wg3 from zone-chain
VZONE_LAN with failed [256]

delete [ zone-policy ] failed
Commit failed
client_loop: send disconnect: Broken pipe

This resulted a zone-policy where all the interfaces still existed, but all the from ... were deleted as such:

set system time-zone 'UTC'
set zone-policy zone DMZ default-action 'drop'
set zone-policy zone DMZ interface 'eth0.6'
set zone-policy zone LAN default-action 'drop'
set zone-policy zone LAN interface 'eth0.2'
set zone-policy zone LAN interface 'eth0.10'
set zone-policy zone LAN interface 'eth0.50'
set zone-policy zone LAN interface 'eth0'
set zone-policy zone LAN interface 'l2tp+'
set zone-policy zone LAN interface 'eth1'
set zone-policy zone LAN interface 'wg0'
set zone-policy zone LAN interface 'wg3'
set zone-policy zone LOCAL default-action 'drop'
set zone-policy zone LOCAL local-zone
set zone-policy zone WAN default-action 'drop'
set zone-policy zone WAN interface 'eth0.7'
set zone-policy zone WAN interface 'tun1'
set zone-policy zone WAN interface 'vtun1'
set zone-policy zone WAN interface 'wg1'
set zone-policy zone WAN interface 'wg2'

Which essentially killed the networking on the server.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.2
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

kroy updated the task description. (Show Details)
syncer changed the task status from Open to Needs testing.Nov 16 2019, 11:42 PM
syncer assigned this task to zsdc.
syncer triaged this task as Low priority.
syncer edited projects, added VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
Viacheslav added a subscriber: Viacheslav.

Not reproducible, tested on "1.3-beta-202108151336"

vyos@r4-1.3# run show conf com | match zone-policy
set zone-policy zone DMZ default-action 'drop'
set zone-policy zone DMZ from LAN firewall name 'LAN-LOCAL'
set zone-policy zone DMZ interface 'eth0.6'
set zone-policy zone LAN default-action 'drop'
set zone-policy zone LAN from DMZ firewall name 'DMZ-LAN'
set zone-policy zone LAN from LOCAL firewall ipv6-name 'LOCAL-LAN-6'
set zone-policy zone LAN from LOCAL firewall name 'LOCAL-LAN'
set zone-policy zone LAN from WAN firewall ipv6-name 'WAN-LAN-6'
set zone-policy zone LAN from WAN firewall name 'WAN-LAN'
set zone-policy zone LAN interface 'eth0.2'
set zone-policy zone LAN interface 'eth0.10'
set zone-policy zone LAN interface 'eth0.50'
set zone-policy zone LAN interface 'eth0'
set zone-policy zone LAN interface 'l2tp+'
set zone-policy zone LAN interface 'eth1'
set zone-policy zone LAN interface 'wg0'
set zone-policy zone LAN interface 'wg3'
set zone-policy zone LOCAL default-action 'drop'
set zone-policy zone LOCAL from LAN firewall ipv6-name 'LAN-LOCAL-6'
set zone-policy zone LOCAL from LAN firewall name 'LAN-LOCAL'
set zone-policy zone LOCAL from WAN firewall ipv6-name 'WAN-LOCAL-6'
set zone-policy zone LOCAL from WAN firewall name 'WAN-LOCAL'
set zone-policy zone LOCAL local-zone
set zone-policy zone WAN default-action 'drop'
set zone-policy zone WAN from DMZ firewall name 'LAN-WAN'
set zone-policy zone WAN from LAN firewall ipv6-name 'LAN-WAN-6'
set zone-policy zone WAN from LAN firewall name 'LAN-WAN'
set zone-policy zone WAN from LOCAL firewall ipv6-name 'LOCAL-WAN-6'
set zone-policy zone WAN from LOCAL firewall name 'LOCAL-WAN'
set zone-policy zone WAN interface 'eth0.7'
set zone-policy zone WAN interface 'tun1'
set zone-policy zone WAN interface 'vtun1'
set zone-policy zone WAN interface 'wg1'
set zone-policy zone WAN interface 'wg2'
[edit]
vyos@r4-1.3#

vyos@r4-1.3# delete zone-policy 
[edit]
vyos@r4-1.3# commit
vyos@r4-1.3# sudo iptables-save | grep -i zone
[edit]
vyos@r4-1.3#

All zones were deleted without any issues. Perhaps it requires other options (adding/deleting other parts of configuration), which are not described.
I close the task, re-open it if necessary, with steps on how to reproduce it.

erkin set Issue type to Bug (incorrect behavior).Aug 31 2021, 6:50 PM