squeeby (Chris Rigby)
User

Projects

User does not belong to any projects.

Today

  • Clear sailing ahead.

Tomorrow

  • Clear sailing ahead.

Thursday

  • Clear sailing ahead.

User Details

User Since
Jun 2 2016, 12:52 PM (84 w, 5 d)
Availability
Available

Recent Activity

Sun, Jan 7

squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

I'm using ntop-ng + nprobe.

Sun, Jan 7, 1:28 PM · VyOS 1.2.x

Fri, Jan 5

squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

Looks good!

Fri, Jan 5, 3:20 PM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

This appears to operate as expected.

Fri, Jan 5, 2:58 PM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

So by reverting, the file /opt/vyatta/sbin/vyatta-netflow.pl contains:

328 sub acct_add_nflog_target {
329     my ($intf) = @_;
330
331     my ($table_chain) = acct_get_table_chain();
332     while (my ($chain, $table) = each(%$table_chain)) {
333         my $cmd = "iptables -t $table -I $chain 1 -i $intf -j NFLOG" ." --nflog-group 2";
334         if (defined $nflog_range) {
335             $cmd .= " --nflog-range $nflog_range";
336         }
337         if (defined $nflog_threshold) {
338             $cmd .= " --nflog-threshold $nflog_threshold";
339         }
340         my $ret = system($cmd);
341         if ($ret >> 8) {
342             die "Error: [$cmd] failed - $?\n";
343         }
344     }
345 }
Fri, Jan 5, 2:18 PM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

Do you know how I can restore the previous version so I can see if it was this package that changed it?

Fri, Jan 5, 1:59 PM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

I applied your patch but now iptables has reverted to using the ULOG target instead of NFLOG:

squeeb@gw1# commit
[ system flow-accounting interface eth2 ]
iptables: No chain/target/match by that name.
Error: [iptables -t raw -I VYATTA_CT_PREROUTING_HOOK 1 -i eth2 -j ULOG --ulog-nlgroup 2 --ulog-cprange 64 --ulog-qthreshold 10] failed - 256
Fri, Jan 5, 7:50 AM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.

Changing the following lines to the excerpt below in /opt/vyatta/sbin/vyatta-netflow.pl seems to work:

Fri, Jan 5, 1:51 AM · VyOS 1.2.x
squeeby added a comment to T296: Enabling NetFlow fails, iptables chain VYATTA_CT_PREROUTING_HOOK unknown.
# show system flow-accounting
 interface pppoe0
 interface eth2.2
 interface eth2.3
 sflow {
     agent-address 192.168.64.1
     sampling-rate 10
     server 192.168.64.10 {
         port 2055
     }
 }
Fri, Jan 5, 1:38 AM · VyOS 1.2.x

Nov 16 2017

squeeby added a comment to T456: lldpd is broken on 1.1.8.

Another workaround is the following:

Nov 16 2017, 11:10 PM · VyOS 1.1.x (1.1.9)