Page MenuHomeVyOS Platform

Adding firewall port ranges makes commit/boot MASSIVELY slow
Open, LowPublic


As of this commit, every port is checked with an exec(ipset -T):

If there is a large port range, this can take many many minutes. A simple example would be

set firewall group port-group slowwwwww port '20000-65531'

That would run ipset -T 45,531 times.

A better idea is to get the ipset result BEFORE the check, and then iterate over the result to see if anything is missing.


Difficulty level
Unknown (require assessment)
VyOS 1.3-beta-202111232035
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Behavior change
Issue type
Improvement (missing useful functionality)