On VyOS 1.2-rolling-201910180117, setting ip source-validation loose seems to have the same outcome as setting it to disable, i.e. results in rp_filter = 0.
Also related, setting firewall source-validation should perhaps configure net.ipv4.conf.default.rp_filter as opposed to net.ipv4.conf.all.rp_filter, because if one wants to disable reverse path validation only for a certain interface, but default to strict for others, at the moment it is not possible.
On VyOS 1.2-rolling-201910180117, setting ip source-validation loose seems to have the same outcome as setting it to disable, i.e. results in rp_filter = 0.
What do you expect to see here?
By default:
[email protected]# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.eth2.rp_filter = 0 net.ipv4.conf.lo.rp_filter = 0 net.ipv4.conf.vtun10.rp_filter = 0
Set value for the interface eth2 value "loose"
[email protected]# set interfaces ethernet eth2 ip source-validation 'loose' [edit] [email protected]# commit [email protected]# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.eth2.rp_filter = 2 net.ipv4.conf.lo.rp_filter = 0 net.ipv4.conf.vtun10.rp_filter = 0
Set global parameter "strict":
[email protected]# set firewall source-validation 'strict' [edit] [email protected]# commit [edit] [email protected]# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 1 net.ipv4.conf.eth2.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.vtun10.rp_filter = 1 [edit]
As I understand Interface parameters must override default values, but in that case default value overwrite interface value.
[email protected]# run show conf com | match valid set firewall source-validation 'strict' set interfaces ethernet eth2 ip source-validation 'loose'
Expected all values 0 except eth2 interface, as it has configuration set interfaces ethernet eth2 ip source-validation 'loose'
[email protected]# delete firewall [edit] [email protected]# commit [edit] [email protected]# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 1 net.ipv4.conf.eth2.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.vtun10.rp_filter = 1 [edit]
@Viacheslav Sorry for the long delay in replying.
Looking at my initial bug I think there were two separate issues:
Looking in my own configuration, I have the following:
Looking with sysctl I get the following values:
So I think there are multiple issues that might manifest in my case.
(I am still using 1.2-rolling-201910180117.)
1.3.0:
Still generating the same config
olof@o6-80003# run show conf com | grep validation set firewall source-validation 'strict' [edit] olof@o6-80003# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.dum0.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 net.ipv4.conf.eth0/42.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.eth1/1728.rp_filter = 0 net.ipv4.conf.eth1/1805.rp_filter = 0 net.ipv4.conf.eth1/1806.rp_filter = 0 net.ipv4.conf.eth2.rp_filter = 0 net.ipv4.conf.ifb042.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.wg0.rp_filter = 1
But it does seem to block martian traffic on vlan interface anyways (I spoof source-address on host behind eth1.1805) and it is logged and blocked as a martian.
Mar 3 15:19:14 o6-80003 kernel: [1298463.199335] IPv4: martian source 1.1.1.1 from 192.168.97.2, on dev eth1.1805 Mar 3 15:19:14 o6-80003 kernel: [1298463.199355] ll header: 00000000: xx xx Mar 3 15:19:15 o6-80003 kernel: [1298464.223279] IPv4: martian source 1.1.1.1 from 192.168.97.2, on dev eth1.1805 Mar 3 15:19:15 o6-80003 kernel: [1298464.223303] ll header: 00000000: xx xx
Then after I enable strict explicity on eth1.1805, I get the rp_filter configuration in sysctl, and a warning from vyos.
olof@o6-80003# set interfaces ethernet eth1 vif 1805 ip source-validation strict [edit] olof@o6-80003# commit WARNING: Global source-validation is set to "strict "this overrides per interface setting! WARNING: Global source-validation is set to "strict "this overrides per interface setting! WARNING: Global source-validation is set to "strict "this overrides per interface setting! [edit] olof@o6-80003# sudo sysctl -a | grep "\.rp_filter" net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.dum0.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 net.ipv4.conf.eth0/42.rp_filter = 1 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.eth1/1728.rp_filter = 0 net.ipv4.conf.eth1/1805.rp_filter = 1 net.ipv4.conf.eth1/1806.rp_filter = 0 net.ipv4.conf.eth2.rp_filter = 0 net.ipv4.conf.ifb042.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 net.ipv4.conf.wg0.rp_filter = 1
And obviously it still blocks martian traffic.