I can see the fix, but now trying invert selection on tcp flags doesn't work
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Jan 16 2022
Jan 16 2022
n.fort added a comment to T4160: Firewall - Error in rules that matches everything except something.
Testing this feature in VyOS 1.4-rolling-202201100317 I'm getting some unexpected behavior.
Config:
GitHub <[email protected]> committed rVYOSONEX56255941e584: Merge pull request #1172 from sever-sever/T4184-equ (authored by c-po).
For full support we need this added to FRR: https://github.com/FRRouting/frr/pull/9204
Jan 15 2022
Jan 15 2022
Viacheslav moved T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses from Open to Finished on the VyOS 1.4 Sagitta board.
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1172
GitHub <[email protected]> committed rVYOSONEX618db51b3b4c: Merge pull request #1171 from sever-sever/T4184 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX31a27136a499: Merge pull request #1170 from sever-sever/T4183-equ (authored by c-po).
Viacheslav renamed T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses from NTP allow-clients address doesn't work to NTP allow-clients address doesn't work it allows to use ntp server for all addresses.
Viacheslav changed the subtype of T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses from "Task" to "Bug".
Viacheslav changed the status of T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses from Open to In progress.
Viacheslav added a comment to T4110: [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0.
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1170
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1170
Viacheslav reopened T4110: [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0 as "In progress".
Viacheslav moved T4150: VRRP with conntrack-sync does not work from Open to Finished on the VyOS 1.4 Sagitta board.
GitHub <[email protected]> committed rVYOSONEX3b4ece7dde02: Merge pull request #1169 from sever-sever/T4183 (authored by c-po).
Re-tested in VyOS 1.4-rolling-202201140317
Now it works, thank you!
Jan 14 2022
Jan 14 2022
fernando renamed T4185: [VPN-IPSEC] not boot config after reboot from [VPN-IPSEC] no boot config after reboot to [VPN-IPSEC] not boot config after reboot.
Viacheslav changed the status of T4172: Patch ndppd to not read route table if there are no auto prefixes from Open to In progress.
Viacheslav changed the status of T4183: IPv6 link-local address not accepted as wireguard peer from Open to In progress.
@NikolayP Could you re-test it?
Viacheslav closed T1972: Allow setting interface name for virtual_ipaddress in VRRP VRID as Resolved.
Viacheslav edited projects for T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses, added: VyOS 1.3 Equuleus ( 1.3.1); removed VyOS 1.3 Equuleus (1.3.0).
GitHub <[email protected]> committed rVYOSONEX6e8a8934a7d4: Merge pull request #1164 from sever-sever/T4179 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX9aa8e51de06b: Merge pull request #1167 from sarthurdev/firewall (authored by c-po).
Viacheslav added a comment to T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses.
Some detail here T1280
@sdev: in your original commit for this task, recent rules are somehow semi-discarded (the time/counter condition will not be written out; however, the action will be written out) because of an apparent problem with nftables in this area.
Unknown Object (User) updated the task description for T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses.
Unknown Object (User) renamed T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses from NTP allow-clients address requires a reboot to NTP allow-clients address doesn't work.
Unknown Object (User) updated the task description for T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses.
Unknown Object (User) created T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses.
Thanks; I just tested commenting out line 5 of that file, and it successfully works around the issue, allowing me to set a link-local IPv6 address as my endpoint. The wireguard connection itself also works, and I can pass traffic.
@odhnera Try to comment or delete the validation string and restart vyos-configd service
Jan 13 2022
Jan 13 2022
Getting link-local addresses to work would probably be very low-priority, but I did run into an extremely niche case where I wanted to do that. It's not the type of situation that would happen in a production environment, but I was running VyOS on a computer tethered via ethernet to an Android-based phone, and I wanted to connect to a wireguard peer running on the phone. Modern version of Android randomize the IPv4 address of their tethered interface on each reboot, but their link-local IPv6 address remains the same, making it more convenient to use it.
Link-local addresses with %ethX are not accepted in any protocols/peers/etc. A few services are allowed to set them as listen like ssh/dns at the moment.
Is there a real use case why you need it on wireguard interfaces?
Viacheslav changed the subtype of T4183: IPv6 link-local address not accepted as wireguard peer from "Bug" to "Feature Request".
It generates by openvpn, maybe something new in the new OpenVPN version
So I see only one option - add mode server-bridge
Jan 13 2022, 11:02 PM · Bugs, VyOS 1.5 Circinus, VyOS 1.4 Sagitta (1.4.1), Restricted Project, openvpn
GitHub <[email protected]> committed rVYOSONEX97472739b443: Merge pull request #1166 from sever-sever/T4182 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEXb3fc933da9b9: Merge pull request #1168 from fett0/T4181 (authored by c-po).
sarthurdev changed the status of T4178: policy based routing tcp flags issue from In progress to Needs testing.
Viacheslav closed T4109: Extend high-availability/keepalived for support virtual-server lb as Resolved.
Viacheslav changed the status of T4182: Show vrrp if vrrp not configured bug from Open to In progress.
@hensur I'm glad you reimplemented this feature. Come on
GitHub <[email protected]> committed rVYOSONEXe91d15b58a21: Merge pull request #1163 from sever-sever/T4177 (authored by c-po).
jack9603301 changed the status of T2898: Support NDP proxy, a subtask of T2518: Add support for IPv6 NAT (NPTv6), from Open to In progress.
jack9603301 changed the status of T2898: Support NDP proxy, a subtask of T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring, from Open to In progress.
Viacheslav changed the status of T4179: Add op-mode CLI for show high-availability virtual-server from Open to In progress.
johannrichard added a comment to T4155: PBR: `set table main` fails in `firewall.py` with newer rolling releases .
See comment in T4164: is working now.
johannrichard added a comment to T4159: Empty firewall group (address, network & port) generates invalid nftables config, commit fails.
See comment in T4164: my config runs through easily now.
johannrichard added a comment to T4164: PBR: network groups (as well as address and port groups) don't resolve in `nftables_policy.conf`.
@sdev this (and the other fixes) look promising: after upgrading to the latest rolling release from 13.1.2022, both the example provided in the ticket as well as my config (a copy of my production setup with rules covering PBR, empty groups, references to "defines" in PBR rules) ran through easily. My production config created no errors when loading the config after the update.
sarthurdev changed the status of T4178: policy based routing tcp flags issue from Open to In progress.
Thanks for the report, working on the fix now.