Change Details

Hi! In firewall exist [[ https://manpages.debian.org/stretch/iptables/iptables-extensions.8.en.html | `recent` ]] option, that allow to use dynamic lists for matching packets. But, one very important part of this extension is missed - there is no `--name` parameter in generated rules. So, all firewall rules with `recent` will use the same table `DEFAULT` for matching packets. This can cause to unwanted behaviour, when will be more than one such rules in system exist. We must add `--name` option or generate unique name for every rule to avoid problems.

Hi! In firewall exist [[ https://manpages.debian.org/stretch/iptables/iptables-extensions.8.en.html | `recent` ]] option, that allow to use dynamic lists for matching packets. But, one very important part of this extension is missed - there is no `--name` parameter in [[ https://github.com/vyos/vyatta-cfg-firewall/blob/current/lib/Vyatta/IpTables/Rule.pm#L562 | generated rules ]]. So, all firewall rules with `recent` will use the same table `DEFAULT` for matching packets. This can cause to unwanted behaviour, when will be more than one such rules in system exist. We must add `--name` option or generate unique name for every rule to avoid problems.

Hi! In firewall exist [[ https://manpages.debian.org/stretch/iptables/iptables-extensions.8.en.html | `recent` ]] option, that allow to use dynamic lists for matching packets. But, one very important part of this extension is missed - there is no `--name` parameter in [[ https://github.com/vyos/vyatta-cfg-firewall/blob/current/lib/Vyatta/IpTables/Rule.pm#L562 | generated rules ]]. So, all firewall rules with `recent` will use the same table `DEFAULT` for matching packets. This can cause to unwanted behaviour, when will be more than one such rules in system exist. We must add `--name` option or generate unique name for every rule to avoid problems.