Change Details

Reverse Path Forwarding (RPF) as defined in [[ https://tools.ietf.org/html/rfc3704 | RFC 3704 ]] specifies 3 modes: 'strict' (drop traffic if the ingress interface does not have the best egress route to the source), 'feasible' (drop traffic if the ingress interface has no egress route to the source), and 'loose' (drop traffic if the entire system has no egress route to the source). VyOS currently only implements the 'strict' and 'loose' modes: ``` set firewall source-valisation 'strict' ``` and ``` set firewall source-validation 'loose' ``` I would like to see feasible mode added as a third choice, as it is a very pragmatic compromise.

Reverse Path Forwarding (RPF) as defined in [[ https://tools.ietf.org/html/rfc3704 | RFC 3704 ]] specifies 3 modes: 'strict' (drop traffic if the ingress interface does not have the best egress route to the source), 'feasible' (drop traffic if the ingress interface has no egress route to the source), and 'loose' (drop traffic if the entire system has no egress route to the source). VyOS currently only implements the 'strict' and 'loose' modes: ``` set firewall source-validation 'strict' ``` and ``` set firewall source-validation 'loose' ``` I would like to see 'feasible' mode added as a third choice, as it is a very pragmatic compromise.

Reverse Path Forwarding (RPF) as defined in [[ https://tools.ietf.org/html/rfc3704 | RFC 3704 ]] specifies 3 modes: 'strict' (drop traffic if the ingress interface does not have the best egress route to the source), 'feasible' (drop traffic if the ingress interface has no egress route to the source), and 'loose' (drop traffic if the entire system has no egress route to the source). VyOS currently only implements the 'strict' and 'loose' modes: ``` set firewall source-valisdation 'strict' ``` and ``` set firewall source-validation 'loose' ``` I would like to see 'feasible' mode added as a third choice, as it is a very pragmatic compromise.