Confirmed working on "current" branch.

OK, I just noticed the merge to "current" branch.

I'd be glad to help test it, but I checked the repos and didn't see where it got merged in?

I think there's still a problem possible with /var/log/messages handling:

PR: https://github.com/vyos/vyos-1x/pull/1398

PR https://github.com/vyos/vyos-1x/pull/1397

Confirmed issue, seems to be a problem in rsyslog/logrotate. Possibly related to T4250

In T3933#124952, @sandwichdoge wrote:

@Viacheslav I tested your fix in my environment. The inbound filtering worked as expected after the fix. However it did not work correctly for the case we where we want both inbound and outbound firewalls on a single vrf member interface (or any case that has more than 2 directions on the same interface).

table ip filter {
	chain VYOS_FW_LOCAL {
		type filter hook input priority filter; policy accept;
		oifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO # <<< Problem here, oifname should be eth0, not vrf name
		iifname "ONE" counter packets 63 bytes 6024 jump NAME_FOO
		jump VYOS_POST_FW
	}
...
	chain NAME_FOO {
		ip saddr 8.8.8.8 counter packets 79 bytes 6636 drop comment "FOO-10"
		counter packets 3 bytes 984 return comment "FOO default-action accept"
	}
}

@a.apostoliuk Could you create PR for 1.3?

Pull request for VyOS 1.4

I see that the pull request was accepted. I just tested it with the latest rolling and it seems to work as expected.
Thanks a lot!

PR: https://github.com/vyos/vyos-1x/pull/1394

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1392

Closed
https://github.com/vyos/vyos-1x/pull/1384

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1391

Sorry just to clarify these are mostly web domains, not DCs, so there is no DNS running on them just HTTP.

I wanted to ask you guys if this is an appropriate change to make. Considering it's on BGP, it's going to be a change in a crucial part but I think this one is probably a good one to make just to reduce ambiguity.

PR for equuleus (upcoming 1.3.2 release https://github.com/vyos/vyos-1x/pull/1390)

PR https://github.com/vyos/vyos-1x/pull/1389

set service dns forwarding dns64-prefix 2001:db8:aabc::/96

Or probably better:

Oh, if you are asking for an example of what the VyOS config setting would look like?

I've been manually adding TAYGA to VyOS (See T160) for my NAT64 capability.

@dsummers Could you provide an example of VyOS configuration and an example of what you add?

PR: https://github.com/vyos/vyos-1x/pull/1388

Yes, I spent quite some time trying to replicate your findings until I noticed that you used if commit_in_progress, so the truth value of a defined object that isn't None or False was trivially true.

Bug of testing
I tested commit_in_progress instead of commit_in_progress()

Is there any further testing needed by me or someone else will do that?

I tested on VyOS 1.4-rolling-202207030217. The bug was resolved.

I already tested the PR before submitting:

PR https://github.com/vyos/vyos-1x/pull/1387

Potentially slow validators:

src/validators/interface-address:ipaddrcheck --is-ipv4-host $1 || ipaddrcheck --is-ipv6-host $1 
src/validators/ip-address:ipaddrcheck --is-any-single $1
src/validators/ip-cidr:ipaddrcheck --is-any-cidr $1
src/validators/ip-host:ipaddrcheck --is-any-host $1
src/validators/ip-prefix:ipaddrcheck --is-any-net $1
src/validators/ipv4:ipaddrcheck --is-ipv4 $1
src/validators/ipv4-address:ipaddrcheck --is-ipv4-single $1
src/validators/ipv4-host:ipaddrcheck --is-ipv4-host $1
src/validators/ipv4-multicast:ipaddrcheck --is-ipv4-multicast $1 && ipaddrcheck --is-ipv4-single $1
src/validators/ipv4-prefix:ipaddrcheck --is-ipv4-net $1
src/validators/ipv4-range:  ipaddrcheck --is-ipv4-single ${strarr[0]}
src/validators/ipv4-range:  ipaddrcheck --is-ipv4-single ${strarr[1]}
src/validators/ipv6:ipaddrcheck --is-ipv6 $1
src/validators/ipv6-address:ipaddrcheck --is-ipv6-single $1
src/validators/ipv6-host:ipaddrcheck --is-ipv6-host $1
src/validators/ipv6-multicast:ipaddrcheck --is-ipv6-multicast $1 && ipaddrcheck --is-ipv6-single $1
src/validators/ipv6-prefix:ipaddrcheck --is-ipv6-net $1

Inverse match PR: https://github.com/vyos/vyos-1x/pull/1386

If the counters are visible and incrementing when checking with nft list table ip filter then I don't think this is an implementation issue. Wondering if its a problem with the syslog daemon.

@a.apostoliuk Will be fixed in the next rolling release, could you re-test it?

@n.fort Could you create PR for 1.3?
I think it should be here https://github.com/vyos/vyatta-cfg-quagga/blob/d4097690c40f619bc0e78a0d674985f7880a19a3/templates/policy/route-map/node.tag/rule/node.tag/match/peer/node.def#L3-L4