It is possible but with specific syntax
I found some examples:
nft insert rule ip filter VYOS_FW_FORWARD ip 'saddr & 0.255.0.255 != 0.11.0.13' counter
It is possible but with specific syntax
I found some examples:
nft insert rule ip filter VYOS_FW_FORWARD ip 'saddr & 0.255.0.255 != 0.11.0.13' counter
@patrickli nftables is not engine for iptables. It is programs to work with netfilter
That's why I ask for the real example
root@r1:/home/vyos# nft insert rule ip6 filter INPUT ip6 saddr ::dead:beef/::ffff:ffff counter
Error: syntax error, unexpected string, expecting number
insert rule ip6 filter INPUT ip6 saddr ::dead:beef/::ffff:ffff counter
^^^^^^^^^^^
root@r1:/home/vyos#@patrickli In 1.4 we don't use iptables, we use nftables
LInk to nftables example will be helpful.
@patrickli Could you attach an example of VyOS configuration with set service upnp xxx
If you manually change upnpd.conf does it work correctly?
It seems after this commit https://github.com/vyos/vyos-1x/commit/08cb762347208b21a8cbf81f7b35707d7e6dd4ac
I’ll take a look later
PR https://github.com/vyos/vyos-1x/pull/1466
Let me know if there is what you are expecting,
requires more tests
set nat static rule 10 destination address '10.0.1.1' set nat static rule 10 inbound-interface 'eth0' set nat static rule 10 translation address '192.168.1.1'
@artooro Did you try listen-port option for this case?
set service https api gql set service https api keys id KID key 'foo' set service https api socket set service https virtual-host foo listen-port '2580'
Check:
vyos@r14# sudo netstat -tulpn | grep nginx tcp 0 0 0.0.0.0:2580 0.0.0.0:* LISTEN 3570/nginx: master tcp6 0 0 :::2580 :::* LISTEN 3570/nginx: master [edit] vyos@r14#
@n.fort Create please PR for 1.3
@aserkin Will be present in the next rolling release.
@ajgnet Could you show routes after this bug?
sudo ip -6 route show sudo ip -6 route get 2607:f8b0:4006:80d::200e
@aserkin Could you send an example of the required accel-ppp section? And how do you see this command in VyOS CLI?
Will be fixed in https://github.com/vyos/vyos-1x/pull/1458
ping-check shouldn't be allowed by default
To enable it you have to set set service dhcp-server shared-network-name Lan01 ping-check
There is no configuration in generated .conf:
vyos@r14# cat /run/dhcp-server/dhcpd.conf | grep ping [edit] vyos@r14#
PR checks if openconnect port is listened by another service https://github.com/vyos/vyos-1x/pull/1460
It is already present in 1.4
vyos@r14:~$ show conf com | match bgp set protocols bgp listen limit '1000' set protocols bgp listen range 192.0.2.0/24 peer-group 'FOO' set protocols bgp local-as '65001' set protocols bgp peer-group FOO remote-as '65001'
It appeared after this commit
It doesn't like this check https://github.com/vyos/vyos-1x/blob/2a10ffa4b5074be27458159fa94d6227d0e5c7f7/src/op_mode/openconnect-control.py#L63-L65
Check root user https://github.com/vyos/vyos-1x/blob/2a10ffa4b5074be27458159fa94d6227d0e5c7f7/python/vyos/util.py#L625-L626
PR https://github.com/vyos/vyos-1x/pull/1458
Formatted output
vyos@r14:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------------------- ------- -------- -------------- ---------------- ---------------- ----------- --------------------------------------- peer_2001-db8--2_tunnel_0 up 9m15s 0B/0B 0/0 2001:db8::2 2001:db8::2 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 peer_2001-db8--2_tunnel_0 up 24m9s 0B/0B 0/0 2001:db8::2 2001:db8::2 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 vyos@r14:~$
PR https://github.com/vyos/vyos-1x/pull/1457
set nat66 destination rule 10 destination address '2001:db8:1111::/64' set nat66 destination rule 10 inbound-interface 'eth1' set nat66 destination rule 10 source address '!2001:db8::6/127' set nat66 destination rule 10 translation address '2001:db8::444' set nat66 source rule 10 destination prefix '2001:db8::2/128' set nat66 source rule 10 outbound-interface 'eth1' set nat66 source rule 10 source prefix '2001:db8:1111::/64' set nat66 source rule 10 translation address 'masquerade' set nat66 source rule 20 destination prefix '!2001:db8::6/127' set nat66 source rule 20 outbound-interface 'eth1' set nat66 source rule 20 source prefix '2001:db8:1111::/64' set nat66 source rule 20 translation address 'masquerade'
PR https://github.com/vyos/vyos-1x/pull/1456
vyos@r14:~$ /usr/libexec/vyos/op_mode/container.py restart --name alp01 Container name "alp01" restarted! vyos@r14:~$ vyos@r14:~$ /usr/libexec/vyos/op_mode/container.py restart --name alp02 Error: no container with name or ID alp02 found: no such container vyos@r14:~$
PR https://github.com/vyos/vyos-1x/pull/1455
curl -k --raw 'https://localhost/graphql' \
-H 'Content-Type: application/json' \
-d '{"query":" {\n ShowVrf (data: {key: \"foo\"}) {\n success\n errors\n data {\n result\n }\n}\n}\n"}'Getting data:
{"data":{"ShowVrf":{"success":true,"errors":null,"data":{"result":[{"ifname":"foo","operstate":"UP","address":"26:f6:35:05:7e:0a","flags":["NOARP","MASTER","UP","LOWER_UP"]}]}}}}PR for 1.3 https://github.com/vyos/vyos-1x/pull/1453
To solve the issue with MTU over DHCP we can use some new options like mtu for example:
set interfaces ethernet eth0 dhcp-options mtu
If vrf not configured:
vyos@r14:~$ /usr/libexec/vyos/op_mode/vrf.py show
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/vrf.py", line 89, in <module>
res = vyos.opmode.run(sys.modules[__name__])
File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 118, in run
res = func(**args)
File "/usr/libexec/vyos/op_mode/vrf.py", line 84, in show
return _get_formatted_output(vrf_data)
File "/usr/libexec/vyos/op_mode/vrf.py", line 68, in _get_formatted_output
state = vrf.get('operstate').lower()
AttributeError: 'NoneType' object has no attribute 'lower'
vyos@r14:~$