PR https://github.com/vyos/vyos-1x/pull/1188

@sdev Thanks

Task already implemented:

PR current - https://github.com/vyos/vyos-build/pull/214
PR equuleus - https://github.com/vyos/vyos-build/pull/215

PR for 1.3:
https://github.com/vyos/vyos-1x/pull/1187

@artooro It still accepts type-name.

@n.fort I just built a fresh image and tested. The first thing I noticed is that icmpv6 now only accepts integers while previously it accepted names. I'm assuming this is a purposeful design change where users now have to set type-name instead.
The any option has been removed, which I suspect is OK as you'd simply leave it unset if you want to accept all icmp types.
Overall this should eliminate the user confusion so I think it's a good change.

Tested on VyOS 1.4-rolling-202201230317

@artooro , please try again using latest version -> vyos-1.4-rolling-202201230317-amd64.iso
Just tested, and for me, it's working as expected.
PR that solves this issue: https://github.com/vyos/vyos-1x/pull/1184

On VyOS 1.4-rolling-202201230317.
Commands:

Tested on latest VyOS 1.4-rolling-202201230317

Error still present on VyOS 1.4-rolling-202201180317

PR: https://github.com/vyos/vyos-1x/pull/1186

Wildcard + should be replaces with *, according to nft man page:

@hensur See PR, I implemented a merge script and provided three solutions.

Confirmed, I just built a new image using 1.4-rolling-202201212148 and I can no longer reproduce the issue.

PR + migration: https://github.com/vyos/vyos-1x/pull/1184

In T4199#117215, @n.fort wrote:

Loading address group described in task and then printing, works OK.

Tested on VyOS 1.4-rolling-202201180317 and working as expected.

Seems solved, Not reproducible on VyOS 1.4-rolling-202201180317

Did did work as expeced

vyos@vyos# run show config comm | grep fire
set firewall ipv6-name FOO rule 10 action 'accept'
set firewall ipv6-name FOO rule 10 icmpv6 type 'echo-request'
set firewall ipv6-name FOO rule 10 protocol 'ipv6-icmp'

Also, while matching parameters valid in nftables, such as echo-reply, commit fails too:

Should be fixed with https://github.com/vyos/vyos-1x/pull/1183

Bug related: https://phabricator.vyos.net/T4186

I can't reproduce this issue on latest rolling

I'm looking into it. From the logs it seems like for src in (pbr[rule_rm][rule]['source'] or ['']) doesn't work if 'source' doesn't exist.

@hensur Smoketest failed.

(VyOS 1.4-rolling-202201200814) - The same.

I ve testet it on (Version:VyOS 1.4-rolling-202201200814). It seems well.

I ve tested this scenario on VyOS 1.4-rolling-202201200814, as said Srividya you can choose minutes betwen 1-99.
If this is critical, you can expand the range by opening a "feature request".

Seems to have fixed it

PR:
https://github.com/vyos/vyos-1x/pull/1180/files

From ISC-DHCP manual pages:
https://kb.isc.org/docs/isc-dhcp-44-manual-pages-dhcp-options

PR : https://github.com/vyos/vyos-1x/pull/1179

In fact you find a new bug in 1.4

Seems to be working fine as far as I can see.

Hello @Viacheslav, thanks for reply, so, if you'll bridge vtun94 and eth0.94 to br94 will it work in L2 level?
Did you push this update to nightbuild?

Some details in T4193

Resolved in T3873

PR: https://github.com/vyos/vyos-1x/pull/1178

PR: https://github.com/vyos/vyos-1x/pull/1177

Okay, thanks for the update. I have found a conntrack issue in the code. Will have a fix in shortly.

Looks like I see the same issue for 1.3.0. Reproducing steps:

set interfaces ethernet eth1 address 'dhcp'
set protocols static table 1 route 0.0.0.0/0 dhcp-interface eth1

Thanks, this does fix the ICMP issue, however rule 10 which is supposed to accept packets with related/established states (say a HTTP response following a request), doesn't seem to match any packets, and the packets get dropped by the default rule.

TCP Flags seems to be working on firewall filter config.

Tested on VyOS 1.4-rolling-202201180317 and working as expected