Page MenuHomePhabricator

rps (Ray Soucy)
User

Projects

User Details

User Since
May 30 2016, 11:24 PM (132 w, 4 d)

Recent Activity

Wed, Dec 5

rps added a comment to T970: Hostname Support.

I agree this is becoming increasingly necessary as vendors turn to AWS for hosting services and IP addressing becomes less static for services.

Wed, Dec 5, 2:40 AM · VyOS 1.3.x
rps added a comment to T1067: VXLAN support improvements.

Juniper and Cisco use a global configuration of "vxlan port" or "vxlan udp port". A per-interface configuration is more flexible and likely makes sense.

Wed, Dec 5, 1:48 AM · VyOS 1.3.x

Fri, Nov 30

rps created T1067: VXLAN support improvements.
Fri, Nov 30, 5:13 PM · VyOS 1.3.x

Oct 23 2018

rps added a comment to T860: VyOS 1.1.x Unicast ARP to VRRP virtual MAC is ignored (RFC3768 mode).

The functionality is fixed in 1.2-rcX for ARP, I haven't verified other services such as DNS.

Oct 23 2018, 1:03 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)

Oct 5 2018

rps added a comment to T874: Support for Two Factor Authentication for CLI access via Google Authenticator.

May be duplicate of T483

Oct 5 2018, 4:29 AM · VyOS 1.3.x
rps created T874: Support for Two Factor Authentication for CLI access via Google Authenticator.
Oct 5 2018, 4:23 AM · VyOS 1.3.x

Sep 26 2018

rps added a comment to T508: ISC DHCP incorrect UDP checksum generation.

1.2 rolling has ISC dhcrelay 4.3.1 from the Debian isc-dhcp-relay 4.3.1-6+deb8u3 package.

Sep 26 2018, 1:51 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11), vyatta-dhcp3

Sep 25 2018

rps added a comment to T573: Update IPv6 firewall rules to support matching of hop-limit.

Will this make it into 1.2 before the freeze?

Sep 25 2018, 10:18 PM · VyOS 1.2.x (VyOS 1.2.0-rc8)
rps added a comment to T860: VyOS 1.1.x Unicast ARP to VRRP virtual MAC is ignored (RFC3768 mode).

Quick note that the work-around above breaks the local DNS resolver if pointing to a virtual IP. Still keeping an eye out for other issues.

Sep 25 2018, 10:07 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)
rps added a comment to T840: VRRP V3 backup router sending ND RA.

I do agree that there should be a pre-canned way to do this.

Sep 25 2018, 8:15 AM · VyOS 1.3.x

Sep 24 2018

rps added a comment to T840: VRRP V3 backup router sending ND RA.

So I'm not sure this is a bug as much as a feature request. You CAN in fact accomplish what you're trying to do in VyOS 1.2 albeit manually using a transition script.

Sep 24 2018, 9:03 PM · VyOS 1.3.x
rps closed T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x as Resolved.

It looks like the commit has fixed this issue.

Sep 24 2018, 7:54 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T860: VyOS 1.1.x Unicast ARP to VRRP virtual MAC is ignored (RFC3768 mode).

Expanding on this more, I've updated the fix above to suggest a workaround of bridge mode for macvlan interfaces.

Sep 24 2018, 7:53 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)
rps updated the task description for T860: VyOS 1.1.x Unicast ARP to VRRP virtual MAC is ignored (RFC3768 mode).
Sep 24 2018, 1:56 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)

Sep 23 2018

rps changed the visibility for T860: VyOS 1.1.x Unicast ARP to VRRP virtual MAC is ignored (RFC3768 mode).
Sep 23 2018, 7:01 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)
rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

In the vyos-build repository /data/live-build-config/hooks/08-sysconf.chroot needs to be updated to remove:

Sep 23 2018, 12:45 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T840: VRRP V3 backup router sending ND RA.
In T840#19823, @c-po wrote:
Sep 23 2018, 12:29 PM · VyOS 1.3.x
rps added a comment to T840: VRRP V3 backup router sending ND RA.

This will need to be implemented using transition scripts in keepalived to enable and disable radvd for the prefix.

Sep 23 2018, 12:28 AM · VyOS 1.3.x

Sep 22 2018

rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

So I took a step back and started wondering why we have /proc/sys/net/ipv4/conf/default/arp_filter set to 1 to begin with.

Sep 22 2018, 11:40 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Sep 19 2018

rps added a comment to T852: Router responding to arp requests for all addresses, breaks Windows networking!.

Can you provide the output of tcpdump -eni <sub-interface> 'arp' (e.g. eth1.2001) from a root shell on VyOS when this is happening? I would like to see the capture with MAC addresses included for the specific sub-interface involved (text rather than screenshot please).

Sep 19 2018, 11:52 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc2)
rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

Just to add a quick note:

Sep 19 2018, 11:45 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T852: Router responding to arp requests for all addresses, breaks Windows networking!.

I haven't tested this to verify but some initial thoughts:

Sep 19 2018, 7:59 AM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc2)

Jul 24 2018

rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

Just adding a note to confirm that RFC-compliant VRRP does work correctly provided the arp_filter settings are fixed. I am able to forward traffic through the routing using its virtual MAC as the next-hop and firewall policy remains correctly applied.

Jul 24 2018, 9:53 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Jul 22 2018

rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

I have never attempted the non-RFC-compliant implementation but will test it Monday.

Jul 22 2018, 1:48 AM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Jul 21 2018

rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

This is for rfc3768-compatibility enabled

Jul 21 2018, 2:02 AM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Jul 20 2018

rps updated subscribers of T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

In case you don't see the updates:

Jul 20 2018, 9:03 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

On a side note the reason I'm digging into this in 1.2 is that 1.1.8 currently has a bug where unicast ARP directed to a VRRP virtual IP is not responded to (while ARP sent to broadcast works fine).

Jul 20 2018, 8:56 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x.

Quick update that using the transition-script method does not work (I think because the script isn't run as root).

Jul 20 2018, 8:11 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps raised the priority of T500: arp_filter blocks ARPs for VRRP virtual addresses in 1.2.x from Normal to Unbreak Now!.

Moving this to critical because a router that won't respond to ARP is not very useful :-)

Jul 20 2018, 6:28 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Mar 13 2018

rps added a comment to T579: Better DHCPv6 relay-agent desired.

Opened a feature request with ISC:

Mar 13 2018, 3:25 PM · VyOS 1.3.x

Mar 12 2018

rps triaged T579: Better DHCPv6 relay-agent desired as Wishlist priority.
Mar 12 2018, 8:31 PM · VyOS 1.3.x
rps added a comment to T577: Unconfigured Ethernet interface discovery partial failure on boot.

A bit more information on this.

Mar 12 2018, 7:47 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)
rps added a comment to T35: Add IPv6 firewall network groups.

Thank you very very much. I will pull down the next nightly and test.

Mar 12 2018, 2:01 PM · VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T105: VRRPv3 support (VRRP for IPv6).

Pretty much agree but don't think we need to worry about supporting a use case that is likely to create other problems until someone actually requests it as a feature.

Mar 12 2018, 2:00 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)

Mar 9 2018

rps added a comment to T576: DNS forwarding service or nat forwarding bug.

P.S. This is really starting to get more into the territory of support than bug reporting, have you considered purchasing support?

Mar 9 2018, 2:30 PM · Rejected
rps added a comment to T576: DNS forwarding service or nat forwarding bug.

At first glance it looks like the name servers you are using are not reliable, and the lack of response is because the forwarder is also not getting a response.

Mar 9 2018, 2:26 PM · Rejected

Mar 8 2018

rps added a comment to T105: VRRPv3 support (VRRP for IPv6).

It sounds like we can give the upgrade to keepalived 1.3 a try provided we go back to virtual-address support IPv4 only (like in 1.1) and remove the native_ipv6 statement from the configuration script as step 1.

Mar 8 2018, 4:19 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T576: DNS forwarding service or nat forwarding bug.

We'll need some more information.

Mar 8 2018, 4:09 PM · Rejected

Mar 7 2018

rps created T577: Unconfigured Ethernet interface discovery partial failure on boot.
Mar 7 2018, 10:29 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11)
rps added a comment to T576: DNS forwarding service or nat forwarding bug.

By default the DNS forwarder will cache recent responses. Have you disabled DNS caching on the forwarding service with the following configuration?

Mar 7 2018, 10:20 PM · Rejected
rps updated subscribers of T105: VRRPv3 support (VRRP for IPv6).

Just checking on this. The nightly build for 1.2 has keepalived 1.2.19 and transition support for virtual IPv6 addresses using VRRPv2 appears to be functional at first glance.

Mar 7 2018, 2:57 PM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T575: SNAT with static port not working.

It was likely the first scenario that I mentioned where there was traffic already established before the NAT rule was created. Also note that a reset conntrack is essentially a flush of the conntrack table and can be disruptive for established connections. Alternatively you could have cleared conntrack entries for the specific host address only as a more safe way of doing it in the future.

Mar 7 2018, 4:32 AM · VyOS 1.1.x (1.1.8), vyatta-nat
rps added a comment to Q134: In state related mode, does the OUT rules-set of an interface are the same that the IN rules-set of the others interfaces ? (and vice versa) (Answer 185).

I may have confused you. My reference to only needing a firewall rule in one direction was in respect to making a specific rule to permit return traffic as opposed to an overly broad one in the case where a stateful firewall didn't exist.

Mar 7 2018, 4:19 AM

Mar 6 2018

rps added a comment to T575: SNAT with static port not working.

I have verified that this is working on 1.1.8 so there might be a configuration or operation issue that is making you see this behavior (I actually have this working in production at scale using over 14,500 rules across 28 chains).

Mar 6 2018, 9:37 PM · VyOS 1.1.x (1.1.8), vyatta-nat

Mar 5 2018

rps added Q135: man command missing (Answer 186).
Mar 5 2018, 4:41 PM

Mar 3 2018

rps updated the answer details for Q134: In state related mode, does the OUT rules-set of an interface are the same that the IN rules-set of the others interfaces ? (and vice versa) (Answer 180).
Mar 3 2018, 12:00 AM

Mar 2 2018

rps added Q134: In state related mode, does the OUT rules-set of an interface are the same that the IN rules-set of the others interfaces ? (and vice versa) (Answer 180).
Mar 2 2018, 11:52 PM
rps added a comment to T35: Add IPv6 firewall network groups.

Just a quick bump as I'm reviewing 1.2 nightly builds for IPv6 support.

Mar 2 2018, 10:29 PM · VyOS 1.2.x (VyOS 1.2.0-rc1)
rps added a comment to T573: Update IPv6 firewall rules to support matching of hop-limit.

For reference this is the standard ruleset I use on our servers for IPv6 (limited to only what is necessary for DHCPv6 and ICMPv6):

Mar 2 2018, 9:09 PM · VyOS 1.2.x (VyOS 1.2.0-rc8)
rps updated subscribers of T573: Update IPv6 firewall rules to support matching of hop-limit.

P.S. @dmbaturin If you can direct me to some instructions on how you would prefer suggested patches be submitted I can re-work to make it easier on you.

Mar 2 2018, 9:04 PM · VyOS 1.2.x (VyOS 1.2.0-rc8)
rps created T573: Update IPv6 firewall rules to support matching of hop-limit.
Mar 2 2018, 9:03 PM · VyOS 1.2.x (VyOS 1.2.0-rc8)

Jan 2 2018

rps created T508: ISC DHCP incorrect UDP checksum generation.
Jan 2 2018, 12:50 PM · VyOS 1.2.x ( VyOS 1.2.0-rc11), vyatta-dhcp3

Jan 8 2017

rps added a comment to V3: Tag node syntax for VyOS 2.0.

With respect to the concerns I mentioned above, I've voted no.

Jan 8 2017, 6:46 PM · VyOS 2.0.x, VyConf
rps added a comment to V3: Tag node syntax for VyOS 2.0.

I keep coming back to a sense that dramatic syntax changes are very damaging and disruptive to users. My fear is that we'll be spending years explaining to people that they're looking at old documentation or examples and that they don't have their curly braces in the right place. Or that we'll alienate a segment of our user base that is averse to change.

Jan 8 2017, 3:08 PM · VyOS 2.0.x, VyConf

Jan 5 2017

rps added a comment to V3: Tag node syntax for VyOS 2.0.

I haven't voted yet because I haven't decided ... It's a big change.

Jan 5 2017, 2:44 PM · VyOS 2.0.x, VyConf
rps added a comment to V3: Tag node syntax for VyOS 2.0.

From a parsing perspective the only challenge tag nodes present is that you can't easily distinguish between "key value" and "key tag" without context. "key" and "key tag value" are fine. Using a ":" you get "key: value" vs "key tag" which removes the ambiguity.

Jan 5 2017, 1:45 PM · VyOS 2.0.x, VyConf
rps added a comment to V3: Tag node syntax for VyOS 2.0.

The XORP configuration syntax (which Vyatta initially built upon) solves the parsing issue with the simple introduction of a ":" as a delimiter between keys and values.

Jan 5 2017, 1:21 PM · VyOS 2.0.x, VyConf

Sep 23 2016

rps added a comment to Q56: nDPI integration, what is required?.

It looks interesting and I think QoS is a good application of nDPI. I'm a little nervous about what the performance and stability implications are. Not having looked into it much is it implemented as a module that could be disabled if needed?

Sep 23 2016, 12:03 AM · VyOS 1.1.x (1.1.8)

Sep 19 2016

rps added a comment to Q52: Integrate Vyos with standalone web filtering device?.

@hmkias Patch Squid for what?

Sep 19 2016, 4:31 PM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)
rps added a comment to Q50: Any hope for DPDK?.

I'll make a move here and suggest that until FOSS projects to implement DPDK support see more maturity that VyOS doesn't go down the rabbit hole of that for now; I think a side project, maybe "HP-VyOS" (for High-Performance VyOS) take on trying to build a version of VyOS that can leverage experimental code like DPDK or VPP.

Sep 19 2016, 1:57 PM · VyOS 1.2.x, VyOS 2.0.x
rps added a comment to Q52: Integrate Vyos with standalone web filtering device?.

In theory, you could have the web filter be a pair of servers using VRRP.

Sep 19 2016, 1:39 PM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)

Sep 16 2016

rps added a comment to Q50: Any hope for DPDK?.

@mickvav I think you're misunderstanding the benefit of DPDK. It's essentially fastpath for Intel-based platforms and if implimented correctly can be the difference between 10 Gbps and 100 Gbps on the same hardware. Obviously being able to scale VyOS to that level would be game-changing. It's important, just likely not in scope for VyOS at this time ...

Sep 16 2016, 10:13 PM · VyOS 1.2.x, VyOS 2.0.x
rps added a comment to Q52: Integrate Vyos with standalone web filtering device?.

@EwaldvanGeffen have you given the method I described a try on VyOS? I know it works on EdgeOS and pre- 6.4 releases of Vyatta and honestly haven't tested it on VyOS because it's not something I have a need for... so it very well could work differently/be broken on VyOS, but that would be surprising.

Sep 16 2016, 11:24 AM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)
rps added a comment to T82: packets leak un-natted.

I've added a quick note in the SNAT section of the Wiki to explain this. Feel free to edit if it seems unclear or could be worded better.

Sep 16 2016, 11:22 AM · Rejected
rps added a comment to Q50: Any hope for DPDK?.

@mickvav I think when people ask "does it support DPDK" it's because they've read that using DPDK will allow forwarding and possible filtering and NATing of traffic at 10 Gbps+ rates. VyOS offering some DPDK stuff and saying "mission accomplished" would leave a bad taste in people's mouths the same way CloudRouter is claiming DPDK support when it's only for bridged traffic.

Sep 16 2016, 11:03 AM · VyOS 1.2.x, VyOS 2.0.x

Sep 15 2016

rps added a comment to Q50: Any hope for DPDK?.

"DPDK support" involved a lot of low-level contributions to a lot of different projects. Essentially you need to re-implement major parts of Linux on a case-by-case basis which is outside of the scope for VyOS right now.

Sep 15 2016, 10:53 AM · VyOS 1.2.x, VyOS 2.0.x
rps added a comment to Q52: Integrate Vyos with standalone web filtering device?.

You can use policy routing to match HTTP and HTTPS traffic and point it at a next-hop that is an external transparent proxy.

Sep 15 2016, 10:34 AM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)
rps added a comment to T82: packets leak un-natted.

Can we move this to "wontfix". This is the normal behavior of Linux and doing any sort of global drop of invalid state traffic by default is not a realistic change.

Sep 15 2016, 10:29 AM · Rejected
rps added a comment to T35: Add IPv6 firewall network groups.

After VRRPv3 (with some intelligent way to handle radvd) this is the major blocker for using VyOS as a production IPv6 firewall in my environment.

Sep 15 2016, 10:25 AM · VyOS 1.2.x (VyOS 1.2.0-rc1)
rps awarded T35: Add IPv6 firewall network groups a Like token.
Sep 15 2016, 10:19 AM · VyOS 1.2.x (VyOS 1.2.0-rc1)
rps awarded T105: VRRPv3 support (VRRP for IPv6) a Like token.
Sep 15 2016, 10:16 AM · VyOS-1.2.0-LTS, VyOS 1.2.x (VyOS 1.2.0-rc1)