Page MenuHomeVyOS Platform

Firewall going OOM, possible related to nftables migration
Open, Requires assessmentPublicBUG

Description

With the following config, withing minutes of adding rules 55 and 65, VyOS ground to a halt and ran OOM.

Deleting rule 45 brought it immediately back to life.

set firewall name WAN-LAN rule 45 action 'accept'
set firewall name WAN-LAN rule 45 description 'KF2'
set firewall name WAN-LAN rule 45 destination address '172.21.1.60'
set firewall name WAN-LAN rule 45 destination group port-group 'KF2'
set firewall name WAN-LAN rule 45 protocol 'udp'
set firewall name WAN-LAN rule 45 state new 'enable'
set firewall name WAN-LAN rule 55 action 'accept'
set firewall name WAN-LAN rule 55 description 'Factorio'
set firewall name WAN-LAN rule 55 destination address '172.21.1.61'
set firewall name WAN-LAN rule 55 destination port '27015'
set firewall name WAN-LAN rule 55 protocol 'tcp'
set firewall name WAN-LAN rule 55 state new 'enable'
set firewall name WAN-LAN rule 65 action 'accept'
set firewall name WAN-LAN rule 65 description 'Factorio'
set firewall name WAN-LAN rule 65 destination address '172.21.1.61'
set firewall name WAN-LAN rule 65 destination port '27015'
set firewall name WAN-LAN rule 65 protocol 'udp'
set firewall name WAN-LAN rule 65 state new 'enable'
set firewall group port-group KF2 port '7777'
set firewall group port-group KF2 port '27015'
set firewall group port-group KF2 port '20560'
set firewall group port-group KF2 port '123'

Associated NAT rules:

set nat destination rule 40 description 'KF2'
set nat destination rule 40 destination port '123,7777,20560,27015'
set nat destination rule 40 inbound-interface 'eth0'
set nat destination rule 40 protocol 'udp'
set nat destination rule 40 translation address '172.21.1.60'
set nat destination rule 50 description 'Factorio'
set nat destination rule 50 destination port '27105,34197'
set nat destination rule 50 inbound-interface 'eth0'
set nat destination rule 50 protocol 'udp'
set nat destination rule 50 translation address '172.21.1.61'
set nat destination rule 60 description 'Factorio'
set nat destination rule 60 destination port '27105'
set nat destination rule 60 inbound-interface 'eth0'
set nat destination rule 60 protocol 'tcp'
set nat destination rule 60 translation address '172.21.1.61'

Details

Difficulty level
Unknown (require assessment)
Version
1.3
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Event Timeline

kroy added a subscriber: c-po.

@c-po It was thought that possibly the nftables migration was doing something funny here because of the potential overlaps.

Possible reason - ipset should be converted to nft list set

ipset

vyos@r4-roll:~$ sudo ipset -L
Name: KF2
Type: bitmap:port
Revision: 3
Header: range 1-65535
Size in memory: 8264
References: 1
Number of entries: 4
Members:
123
7777
20560
27015
vyos@r4-roll:~$

ipset show

vyos@r4-roll:~$ sudo ipset save
create KF2 bitmap:port range 1-65535
add KF2 123
add KF2 7777
add KF2 20560
add KF2 27015
vyos@r4-roll:~$

nft sets

vyos@r4-roll:~$ sudo nft list sets
table ip raw {
}
table ip filter {
}
table ip6 raw {
}
table ip6 filter {
}
table ip6 mangle {
}
table ip6 nat {
}
table ip nat {
}
vyos@r4-roll:~$
erkin set Issue type to Feature (new functionality).Sun, Aug 29, 12:16 PM
erkin removed a subscriber: Active contributors.

@kroy Did you get it with any other rc versions?