Filtering tested on version 1.4-rolling-202201060842
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Jan 9 2022
Jan 9 2022
Viacheslav updated subscribers of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases .
Viacheslav changed the subtype of T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases from "Task" to "Bug".
I revisited this in: https://github.com/vyos/vyos-1x/pull/1147
johannrichard updated the task description for T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases .
aha added a comment to T4110: [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0.
@Viacheslav Yes, You're right.
in.tftpd got started (but only a few seconds).
Scenario proposed by @NikolayP gives next content in table ip filter:
A simple check works fine:
Set 20% quota for snmpd
And check it with script:
#!/usr/bin/env bashViacheslav changed the status of T3774: atop logs are not limited in size from In progress to Needs testing.
Viacheslav closed T3822: OpenVPN processes do not have permission to read key files generated with `run generate openvpn key` as Resolved.
It was fixed in above commits, wrong testing form my site.
Viacheslav added a comment to T4110: [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0.
@aha As I see tftp can't bind ipv6 link local address:
Viacheslav edited projects for T3299: Allow the web proxy service to listen on all IP addresses, added: VyOS 1.3 Equuleus ( 1.3.1); removed VyOS 1.3 Equuleus (1.3.0).
Cherry-pick PR https://github.com/vyos/vyos-1x/pull/1146
It requires checking for 1.3 as it was changed and it uses the old backend on Perl (links above).
vyos@vyos# run show config comm | grep fire set firewall name FOO default-action 'accept' set firewall name FOO rule 10 action 'accept' set firewall name FOO rule 10 source address '198.51.100.0/24' set firewall name FOO rule 999997 action 'drop' set firewall name FOO rule 999997 source address '203.0.113.0/24' [edit]
It seems -V option:
Viacheslav moved T4142: Input ifbX interfaces not displayed in op-mode from Need Triage to Finished on the VyOS 1.3 Equuleus ( 1.3.1) board.
PR for 1.3 https://github.com/vyos/vyos-nhrp/pull/7
PR for 1.4 https://github.com/vyos/vyos-1x/pull/1145
Viacheslav changed the status of T4152: NHRP shortcut-target holding-time does not work from Open to In progress.
Check a real generated firewall iptables/nftables config
As 10000 it is the latest default rule, so your rules can be applied after default action with seq 10000
Viacheslav changed the status of T4087: IPsec IKE-group proposals limit of 10 pieces from Open to Needs testing.
Viacheslav added a project to T4087: IPsec IKE-group proposals limit of 10 pieces : VyOS 1.4 Sagitta.
Could you also create a pr for 1.4?
Or 1.4 doesn’t have such limits?
Does it work with vlan bridges T3115?
Some notes:
- The old syntax is quite terrible. It breaks if an image is named disk-install or running or any remote protocol. There needs to be a cleaner syntax for it, such as copy file from image My-Image/usr/local/foo to path /tmp/foo or show file in remote ftp://ftp.example.net/foo.
- 'Image tools' isn't exactly a descriptive name for it. It does four operations:
- show: List files in a directory, or spit information about a file followed by its contents (hexdump if it's binary).
- copy: Copy a file or directory from one place to another (it can merge directories).
- delete: Deletes a file or directory (doesn't work remotely).
- update and updateone: Updates an image's config directory with rsync (the only part directly related to image manipulation). This is actually called clone in the CLI.
- show, copy and delete should probably be moved to a separate (new) module related to file operations (and coupled with vyos.remote) whilst update needs to become its own thing (a helper script, perhaps).
Unknown Object (User) added a comment to T4100: Firewall increase maximum number of rules.
Tested in VyOS 1.3-rolling-202201030317 & 1.4-rolling-202201070726
Jan 8 2022
Jan 8 2022
@NikolayP Could you test if all works fine?
Check the real generated firewal rules.
Is it an actual task? If yes, can someone explain which configuration you expect from keepalived.conf or radvd.conf?
As I see PR 9aad6f was merged.
Viacheslav moved T4100: Firewall increase maximum number of rules from Need Triage to Finished on the VyOS 1.3 Equuleus ( 1.3.1) board.
Viacheslav added a comment to T1972: Allow setting interface name for virtual_ipaddress in VRRP VRID.
Viacheslav changed the subtype of T4150: VRRP with conntrack-sync does not work from "Task" to "Bug".
Viacheslav changed the status of T4150: VRRP with conntrack-sync does not work from Open to In progress.
Viacheslav edited projects for T4151: IPV6 local PBR Support, added: VyOS 1.4 Sagitta; removed VyOS 1.1.x.
It requires option -6
For example:
sudo ip -6 rule add prio 10 from de:de::1 lookup 5
Show v6 rules:
vyos@r11-roll# sudo ip -6 rule show 0: from all lookup local 10: from de:de::1 lookup 5 32766: from all lookup main [edit] vyos@r11-roll#
Unknown Object (User) added a comment to T4150: VRRP with conntrack-sync does not work.
The situation has not changed in VyOS 1.4-rolling-202201070726
Jan 7 2022
Jan 7 2022
Viacheslav moved T3924: VRRP stops working with VRF from Need Triage to Finished on the VyOS 1.4 Sagitta board.
Unknown Object (User) created T4150: VRRP with conntrack-sync does not work.
Tested in VyOS 1.4-rolling-202201060842
Works
Jan 6 2022
Jan 6 2022
@rps this did not make it into 1.3.0, but was discussed recently and will be addressed; it is, as you point out, a regrettable omission in functionality
c-po edited projects for T4141: Set high-availability vrrp sync-group without members error, added: VyOS 1.3 Equuleus ( 1.3.1); removed VyOS 1.3 Equuleus.
Viacheslav changed the status of T4109: Extend high-availability/keepalived for support virtual-server lb from In progress to Needs testing.
Do we know if this made it into the 1.3.0 release or is this now a 1.4 issue?
sarthurdev moved T4133: Firewall network group error with zone-based firewall rules from Need Triage to In Progress on the VyOS 1.4 Sagitta board.
sarthurdev moved T4145: Conntrack table not showing after firewall rewriting from Need Triage to In Progress on the VyOS 1.4 Sagitta board.
Viacheslav changed the status of T4145: Conntrack table not showing after firewall rewriting from Open to Needs testing.
Updates the vyatta-conntrack package to work without legacy firewall and fixes the op-mode commands. Should also fix some conntrack functionality (untested).
jestabro changed the status of T4146: Nginx should not listen on port 80 from Open to Backport candidate.
jestabro moved T3785: Add unicode support to configtree backend from Need Triage to Finished on the VyOS 1.4 Sagitta board.
jestabro changed the status of T3785: Add unicode support to configtree backend, a subtask of T2941: Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py, from Open to Backport candidate.
jestabro changed the status of T3785: Add unicode support to configtree backend from Open to Backport candidate.
Viacheslav renamed T4145: Conntrack table not showing after firewall rewriting from Conntrack table not showing after firewall after firewall rewriting to Conntrack table not showing after firewall rewriting.
Fixed for 1.4 in T4128 with update "keepalived".
In 1.3 we don't update this pkg and it still has this bug.
Unknown Object (User) created T4143: Wrong section for Cloud-init User-Data for OVA images.
Jan 5 2022
Jan 5 2022
relaxes the condition to escape non-ascii bytes. Updating the commit id in the Dockerfile and relaxing the ascii restriction in configsource.py will allow unicode chars in config.
sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from In progress to Needs testing.
Viacheslav moved T4142: Input ifbX interfaces not displayed in op-mode from Need Triage to Backport Candidates on the VyOS 1.4 Sagitta board.
PR https://github.com/vyos/vyos-1x/pull/1138
vyos@r11-roll:~$ show interfaces input Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address S/L Description --------- ---------- --- ----------- ifb0 - u/u FOO ifb1 - u/u FOO1 vyos@r11-roll:~$
Viacheslav added a project to T4142: Input ifbX interfaces not displayed in op-mode: VyOS 1.3 Equuleus ( 1.3.1).
Viacheslav changed the status of T4142: Input ifbX interfaces not displayed in op-mode from Open to In progress.
erkin changed the status of T4038: Rewrite `vyatta-image-tools.pl` in Python, a subtask of T3355: Remove all remaining legacy Vyatta code, from Open to In progress.
erkin changed the status of T4038: Rewrite `vyatta-image-tools.pl` in Python from Open to In progress.
sarthurdev changed the status of T4133: Firewall network group error with zone-based firewall rules from Open to In progress.
sarthurdev changed the status of T3635: Add ability to use mDNS repeater with VRRP from In progress to Needs testing.
Viacheslav updated the task description for T4141: Set high-availability vrrp sync-group without members error.
Viacheslav changed the status of T4141: Set high-availability vrrp sync-group without members error from Open to Confirmed.
Viacheslav added a project to T4141: Set high-availability vrrp sync-group without members error: VyOS 1.4 Sagitta.
sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from In progress to Needs testing.
sarthurdev changed the status of T4135: Declare zone policy firewall without local zone errors from Open to In progress.
Jan 4 2022
Jan 4 2022