sorry for the late reply.You don't need any special commands. The only thing you have to set is the proxy and the commit archive.

https://github.com/vyos/vyos-build/pull/624

@thannaske it would be very nice if you could re-check now this with VyOS 1.5. It should be fixed by https://github.com/vyos/vyos-cloud-init/commit/70304ff90d931265cb736ace692967242c9b9729

PR: https://github.com/vyos/vyos-1x/pull/3458

This was a worthwhile investigation, with the goal of using Cython as a method of easily wrapping the standard netlink headers. Although workable, it appeared more trouble than it's worth, as one still has to cheat to navigate e.g. pass by reference (1), and limitations of Cython at the time (2). A much better approach would be a standard Python extension module ... set to 'on hold' for reference and until we have a plan for development, as has been recently discussed.

Is there any movement on implementing this? As per T2760 this is the only way to resolve IPsec on dynamic ip's

seems rather useless now :)

I'm just using this for my home lab :) - that's a great suggestion @Rain I shall use that!

Since the --vyos-mirror string is copied directly, you can simply prepend it with [trusted=yes]; a new flag isn't really necessary:

https://github.com/net-snmp/net-snmp/issues/786

Implementation never worked

In T5835#187967, @dmbaturin wrote:

If you are really that curious, I can attach a screenshot.

If someone wants, I can probably unearth my patches to 1.4 and miniupnpd to make it all work. It was technically functional and worked as expected. I just don't have the time or patience to deal with getting it merged/integrated back into the project.

Out of curiosity, will the details of the poll be public or the results being shared transparently?

In T5835#187963, @dylanneild wrote:

A bunch to unpack here.
[...]

In T5835#187938, @syncer wrote:

Created a poll for maintainers on this topic, and we will go with the decision made.

A bunch to unpack here.

In T5835#187937, @syncer wrote:

go learn how cheap cameras open firewalls via UPnP and make them available on the internet without people being aware of that

or how malware exfiltrates data via port 443 because enterprises can't reliably block outbound traffic on that port.

In T5835#187935, @Viacheslav wrote:

If you know how to test it will be great to test it. If no one needs it even for tests, what are we talking about?

Created a poll for maintainers on this topic, and we will go with the decision made.

In T5835#187936, @simplysoft wrote:

Yes, that is exactly the point. Glad you did not suggest to remove the NAT capability of vyos because it could be used to bypass security or is not appropriate for an "enterprise"

In T5835#187934, @syncer wrote:

In T5835#187933, @simplysoft wrote:

A firewall is doing exactly this all the time when using NAT, autonomously opening ports via call from internal networks (aka internal originated traffic) to allow responses to reach the originator. Enterprises might have some strict outbound rules. For UPnP is exactly the same, an enterprise would have strict rules which services are allowed to open ports.

Not if it's not configured to do so.

In T5835#187933, @simplysoft wrote:

I'm not sure if that summary from you @Viacheslav is fully reflecting the current state.
I'm also not sure if the original implementation never worked, might very well have been broken while refactoring some vyos internals how the firewall is structured, but I guess you should have a better understanding of (the history of) your product. Otherwise I would be very surprised if a broken feature got into your product without every working / being tested.

In T5835#187933, @simplysoft wrote:

A firewall is doing exactly this all the time when using NAT, autonomously opening ports via call from internal networks (aka internal originated traffic) to allow responses to reach the originator. Enterprises might have some strict outbound rules. For UPnP is exactly the same, an enterprise would have strict rules which services are allowed to open ports.

Not if it's not configured to do so.

I'm not sure if that summary from you @Viacheslav is fully reflecting the current state.
I'm also not sure if the original implementation never worked, might very well have been broken while refactoring some vyos internals how the firewall is structured, but I guess you should have a better understanding of (the history of) your product. Otherwise I would be very surprised if a broken feature got into your product without every working / being tested.

I fail to comprehend how a firewall that autonomously opens ports via calls from internal networks is appropriate for an enterprise.
Indeed there are some use cases but this functionality can be used by malicious code and allow bypass security configuration that is enforced otherwise

In summary, it works with custom scripts and patches, but it still does not work from CLI (not fully integrated)
The scripts that should be involved are in the repo https://github.com/miniupnp/miniupnp/tree/miniupnpd_2_3_3/miniupnpd/netfilter_nft/scripts
Until we do not have them and they do not communicate with the firewall, the feature does not work.
A patch is attached in several posts above https://vyos.dev/T5835#174066

In T5835#187919, @syncer wrote:

Does it work now?

Does it work now?

One reasons it is rarely seen is as most are not aware of it being used undercover and when not being present, nothing necessarily brakes (due to fallback to other mechanisms). For some home routers we saw this was an undocumented "feature" that you did not have any control over, more recent & reasonable implementation we have seen allow you to enable or disable it (but nothing much more like fine grained permissions)

I have rarely seen UPnP in enterprise environments and rarely at home even if the main purpose is to use it at home and let applications backdoor your firewall (which often is a bad thing in enterprise evironments).