PR https://github.com/vyos/vyos-1x/pull/1383

Also add IPv6 link local address support to auto generate a link-local address as on any other type of interface.

With recent versions of strongSwan and XFRM interface in VyOS 1.4 this is now possible.

PR https://github.com/vyos/vyos-1x/pull/1382

There is no dict if exists only one record in the https://github.com/vyos/vyos-1x/blob/cefc7ce9bfcf7750700e73edbc21864fe8ab0bee/src/op_mode/show_nat_translations.py#L103-L110
So it can't parse correctly

Cherry-pick for 1.3 https://github.com/vyos/vyos-1x/pull/1381

@Viacheslav There is already a set interfaces bridge brN igmp node. If the default option is enabled, I think set interfaces bridge brN igmp disable-snooping would sound better.
I prefer to have IGMP snooping disabled as the default option, since improper IGMP snooping causes issues while disabling IGMP snooping doesn't.

PR: https://github.com/vyos/vyos-1x/pull/1380

Implemented as: set service router-advert interface eth0 name-server-lifetime <value> which will be option A

PR https://github.com/vyos/vyos-1x/pull/1379 (without completion help)

Because with a rule like that I accept everything coming from nl from wan to lan, or I would need to add the source nl to every rule. That's why I did it with a deny not coming from nl on top, and then specific rules for the traffic that I want to accept.

If the default option is enabled or 1
Maybe it makes sense to create disable option like:

set interfaces bridge br0 ip disable-multicast-snooping

PR to add the option: https://github.com/vyos/vyos-1x/pull/1378

PR:
https://github.com/vyos/vyos1x-config/pull/9

Did you try dns forwarding domain?

set service dns forwarding domain abc.local server 192.0.2.5

PR https://github.com/vyos/vyos-1x/pull/1377

Task for rewriting wan-loadbalancing to XML/Python T4470

@Viacheslav thanks

PR https://github.com/vyos/vyos-1x/pull/1376

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1375

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1374

Will be fixed in the next rolling release

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1372

PR https://github.com/vyos/vyos-1x/pull/1371

Why don't use action accept for nl and drop all others?

PR https://github.com/vyos/vyos-1x/pull/1370

It seems a wrong priority
Mpls configuration applied before creation tunnel
As a result sysctl parameter for the tunnel interface doesn't exist yet
To reproduce it in one commit:

set interfaces dummy dum1 address '10.5.4.8/24'
set interfaces tunnel tun0 address '10.255.0.2/30'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 remote '192.0.2.254'
set interfaces tunnel tun0 source-address '192.0.2.1'
set protocols mpls interface 'dum1'
set protocols mpls interface 'tun0'
set protocols mpls ldp discovery transport-ipv4-address '192.0.2.1'
set protocols mpls ldp interface 'dum1'
set protocols mpls ldp interface 'tun0'
set protocols mpls ldp router-id '192.0.2.1'

Hi,
I think this is a BUG, not a feature.
If I enable mpls on an interface, then the proper sysctl flags must be applied and be persistent.

it's a common behavior when you want to set sysctl variable and bash-cli is used ( vyos-cli by default when restart the vm set this value in 0 ) . however , it's possible to configure it with this command :

I just tested it on VyOS 1.4-rolling-202206260217, everything seems to work so far!
It would be nice to also have the negate option, something like:

Thank you!

PR: https://github.com/vyos/vyos-1x/pull/1368

@Viacheslav As for your other concern, you can filter the actual inbound interface (eth4 in this my case) in mangle-PREROUTING. Maybe you could try packet marking in mangle-PREROUTING, then filter them later in VYOS_FW_FORWARD/VYOS_FW_LOCAL in the filter table?
Something like this:

@Viacheslav I tested your fix in my environment. The inbound filtering worked as expected after the fix. However it did not work correctly for the case we where we want both inbound and outbound firewalls on a single vrf member interface (or any case that has more than 2 directions on the same interface).