@Viacheslav Confirmed, that is the culprit.
To be precise: I deleted ipsec-dhclient-hook and renamed 98-vyatta-dhclient-hook back to vyatta-dhclient-hook. Then I ran a renew dhcp interface eth0 and I got a correct .lease file.
Even when the IPSec script is fixed, it might be wise to prepend all scripts in /etc/dhcp/dhclient-exit-hooks.d with a number to enforce script order execution, just like in /etc/dhcp/dhclient-enter-hooks.d.

@marc_s Try to remove /etc/dhcp/dhclient-exit-hooks.d/ipsec-dhclient-hook it could be bug due to T4856

@n.fort I was too impatient to wait for a rolling build so I ran my own build of current post-merge.

PR for vyos1x-config:
https://github.com/vyos/vyos1x-config/pull/15

PR:
https://github.com/vyos/vyos1x-config/pull/15

PR https://github.com/vyos/vyos-build/pull/320
PR https://github.com/vyos/vyos-1x/pull/1891

PR: https://github.com/vyos/vyos-1x/pull/1890

I'll work on it on the next days.
I'll keep you posted!

PR:
https://github.com/vyos/vyos1x-config/pull/14

PR: https://github.com/vyos/vyos-1x/pull/1889

Will be fixed in the next rolling release

In pcap mode when sampling is set to value larger then 1 hsflowd uses kernel based sampling available on kernels starting from 3.16

I think NFLOG and TCP can be dropped for sure.

Jenkins job looks simple

git clone https://github.com/sflow/host-sflow
make deb FEATURES="NFLOG PCAP TCP DBUS SYSTEMD"

Hello! We have plans to add official ARM64 builds in near future.

PR https://github.com/vyos/vyos-1x/pull/1888

set policy route-map RMAP6 rule 10 action 'deny'
set policy route-map RMAP6 rule 10 match ip address prefix-len '0'
set protocols ospfv3 route-map 'RMAP6'

Just adding my +1 for this feature, would be very useful.
If I get time in the coming weeks/months I will try and pick up on the analysis where @njh left off.

@n.fort A quick test of this against latest rolling looks like it's working as expected for general firewall rules:

I agree that the Keepalivd SMTP implementation is lacking authentication.

@Viacheslav I may be on to something. It's related to the order of execution of the DHCP client exit hook scripts in /etc/dhcp/dhclient-exit-hooks.d.

PR for 1.4 https://github.com/vyos/vyos-1x/pull/1886

vyos@91800359325b# set interfaces ethernet eth0 address 192.0.2.5/24
[edit]
vyos@91800359325b# commit
[ interfaces ethernet eth0 ]
sudo: unable to resolve host 91800359325b: System error

Also see https://forum.vyos.io/t/1-4-rolling-route-table-for-wan-load-balancing-not-created/.

Actually only multihop BGP peers go down. Others are up, but the routes received from them does not go to kernel, so the connectivity drops.
Latest techsupport: https://oc.cpm.ru/index.php/s/Fg9FfoOatihBOrQ
The system was alive more than 12 hours, but crashed the same way as before.

I don't think this ever worked as intended: see T3275#103228, vyos-build PR 185, and T3821.

after an internal discussion we came to the conslusion that keepalived SMTP implementation is incomplete (e.g. it lacks authentication). In order to still support your request we think we should enable support of 3rd party configurations placed in e.g. /etc/keepalived/conf.d.

@sdev just for clarification do you mean "deleted" as in only existing entries but new ones will work or completely deleted?
Im asking because I do use keas global, subnet, pool and class option-data support extensively outside of vyos.
If this would stay/become a part of vyos that would be great!

PR https://github.com/vyos/vyos-1x/pull/1884

>>> range_to_regex(['10-20', '22-35', '50'])
'(1\\d|20|2[2-9]|3[0-5]|50)'
>>>

Will be fixed in the next rolling release

Wanted to have the ticketid to write the right commit message right away. Diff is here: https://github.com/vyos/vyos-1x/compare/current...ichdasich:vyos-1x:filtered_routes

If we add vlan to range we get error

set service ipoe-server authentication mode 'noauth'
set service ipoe-server client-ip-pool name POOL1 gateway-address '192.0.2.1'
set service ipoe-server client-ip-pool name POOL1 subnet '192.0.2.0/24'
set service ipoe-server interface eth1 vlan '2000-3000'
commit
set service ipoe-server interface eth1 vlan '50'
commit

The second commit:

PR https://github.com/vyos/vyos-1x/pull/1883

@n.fort @Viacheslav
Here is an example of what I am after for DNAT rule, specifically, using meta pkttype:

QoS Policy Limiter now works correctly.
But the shaper classes for tagged traffic don't work.

I was able to get it to work as expected by reducing the lease below 4294967295 and removing the /config/dhcpd.leases file. It should work per the instruction to make the lease effectively static. It had worked in the past so at some point the check that the resultant lease end day is numeric.

Example configuration:

PR: https://github.com/vyos/vyos-1x/pull/1881

My bad

Seems to be the same task -> https://vyos.dev/T5018

Just put this on a live system, and it behaves as intended (so far). Special meaning of _ would certainly have to be added to the check, i guess, but that needs further delving into bgp-regex syntax.