Is it the same task T4138 ?

PR https://github.com/vyos/vyos-1x/pull/1191

I had forgotten about the recent syntax and it was merged in a broken state (https://github.com/vyos/vyos-1x/blob/current/python/vyos/firewall.py#L164). We should try and find a remedy, or remove it from CLI.

PR https://github.com/vyos/vyos-1x/pull/1190

set policy prefix-list TST_PRF_LST rule 10 action 'permit'
set policy prefix-list TST_PRF_LST rule 10 prefix '10.5.5.0/24'
set policy prefix-list TST_PRF_LST rule 20 action 'permit'
set policy prefix-list TST_PRF_LST rule 20 prefix '10.6.6.0/24'
set policy prefix-list TST_PRF_LST rule 30 action 'permit'
set policy prefix-list TST_PRF_LST rule 30 prefix '10.6.6.0/24'

Try to dump traffic from the required interface

For first do these changes as in commit
Try policy local route, for example:

set policy local-route rule 10 set table 111
set policy local-route rule 10 source 192.0.2.0/24

The main reason:

@Rhongomiant Am I understanding correctly that you don't see the default route in table 111?

PR https://github.com/vyos/vyos-1x/pull/1188

@sdev Thanks

Task already implemented:

PR current - https://github.com/vyos/vyos-build/pull/214
PR equuleus - https://github.com/vyos/vyos-build/pull/215

PR for 1.3:
https://github.com/vyos/vyos-1x/pull/1187

@artooro It still accepts type-name.

@n.fort I just built a fresh image and tested. The first thing I noticed is that icmpv6 now only accepts integers while previously it accepted names. I'm assuming this is a purposeful design change where users now have to set type-name instead.
The any option has been removed, which I suspect is OK as you'd simply leave it unset if you want to accept all icmp types.
Overall this should eliminate the user confusion so I think it's a good change.

Tested on VyOS 1.4-rolling-202201230317

@artooro , please try again using latest version -> vyos-1.4-rolling-202201230317-amd64.iso
Just tested, and for me, it's working as expected.
PR that solves this issue: https://github.com/vyos/vyos-1x/pull/1184

On VyOS 1.4-rolling-202201230317.
Commands:

Tested on latest VyOS 1.4-rolling-202201230317

Error still present on VyOS 1.4-rolling-202201180317

PR: https://github.com/vyos/vyos-1x/pull/1186

Wildcard + should be replaces with *, according to nft man page:

@hensur See PR, I implemented a merge script and provided three solutions.

Confirmed, I just built a new image using 1.4-rolling-202201212148 and I can no longer reproduce the issue.

PR + migration: https://github.com/vyos/vyos-1x/pull/1184

In T4199#117215, @n.fort wrote:

Loading address group described in task and then printing, works OK.

Tested on VyOS 1.4-rolling-202201180317 and working as expected.

Seems solved, Not reproducible on VyOS 1.4-rolling-202201180317

Did did work as expeced

vyos@vyos# run show config comm | grep fire
set firewall ipv6-name FOO rule 10 action 'accept'
set firewall ipv6-name FOO rule 10 icmpv6 type 'echo-request'
set firewall ipv6-name FOO rule 10 protocol 'ipv6-icmp'

Also, while matching parameters valid in nftables, such as echo-reply, commit fails too:

Should be fixed with https://github.com/vyos/vyos-1x/pull/1183

Bug related: https://phabricator.vyos.net/T4186

I can't reproduce this issue on latest rolling

I'm looking into it. From the logs it seems like for src in (pbr[rule_rm][rule]['source'] or ['']) doesn't work if 'source' doesn't exist.

@hensur Smoketest failed.

(VyOS 1.4-rolling-202201200814) - The same.

I ve testet it on (Version:VyOS 1.4-rolling-202201200814). It seems well.

I ve tested this scenario on VyOS 1.4-rolling-202201200814, as said Srividya you can choose minutes betwen 1-99.
If this is critical, you can expand the range by opening a "feature request".

Seems to have fixed it