@lue30499 T4997 was merged, so the script I put above (which adds/updates a firewall group for the DHCP IP of any DHCP-enabled interfaces) can now be installed on an official build of 1.4-rolling!
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Feb 28 2023
Feb 28 2023
Viacheslav moved T5028: Add package exfatprogs to VyOS from Open to Finished on the VyOS 1.4 Sagitta board.
Feb 27 2023
Feb 27 2023
c-po moved T4997: Add DHCP client user hooks dir from Open to In Progress on the VyOS 1.4 Sagitta board.
c-po moved T5025: Time-zone validation failed from Open to In Progress on the VyOS 1.4 Sagitta board.
c-po moved T5029: Nginx change default root directory and fix regex from Open to In Progress on the VyOS 1.4 Sagitta board.
PR using list_interfaces from vyos-utils:
Openconnect
[edit] vyos@r14# set vpn openconnect network-settings push-route 100.64.22.0/24 [edit] vyos@r14# commit [ vpn openconnect ] /usr/libexec/vyos/conf_mode/vpn_openconnect.py:32: DeprecationWarning: 'crypt' is deprecated and slated for removal in Python 3.13 from crypt import crypt, mksalt, METHOD_SHA512
thank you, yes updating to latest 1.4 rolling has resolved the issue, pls feel free to close this task as duplicate to https://vyos.dev/T4907
I'd be happy to test anything that implements this. Previously, I (judging from the forum, I'm not the only one) using this EdgeOS-BL-Mgmt with 1.3.x.
are you saying this has been fixed in just the last 2 months ? i reported this on 1.4-rolling-202212280917
There is missed the command tc qdisc add dev eth0 handle ffff: ingress
vyos@r14# tc qdisc show dev eth0 qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 [edit] vyos@r14# [edit] vyos@r14# tc filter add dev eth0 parent ffff: protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev ifb0 Error: Parent Qdisc doesn't exists. We have an error talking to the kernel [edit] vyos@r14#
Viacheslav changed the status of T5018: Redirect to IFB removed after change in qos policy from Open to Confirmed.
a.apostoliuk moved T4985: reset vpn ipsec-peer command with peer name does not work from Open to Finished on the VyOS 1.4 Sagitta board.
a.apostoliuk moved T5008: MACsec CKN of 32 chars is not allowed in CLI, but works fine from Open to Finished on the VyOS 1.4 Sagitta board.
Try the latest rolling release
Feb 26 2023
Feb 26 2023
Viacheslav changed the status of T5035: Add more actions to policy route rule from Open to In progress.
Feb 25 2023
Feb 25 2023
Viacheslav changed the status of T5033: generate-public-key command fails for address with multiple public keys like GitHub from Open to In progress.
Viacheslav added a comment to T5033: generate-public-key command fails for address with multiple public keys like GitHub.
PR https://github.com/vyos/vyos-1x/pull/1853
vyos@r14:~$ generate public-key-command user foo path https://github.com/xxxxx.keys # To add this key as an embedded key, run the following commands: configure set system login user foo authentication public-keys github@39e9c9ba-408d-4b4b-9aa6-d07f531285bf key xxxxx set system login user foo authentication public-keys github@39e9c9ba-408d-4b4b-9aa6-d07f531285bf type ssh-rsa set system login user foo authentication public-keys github@4732d9b0-4bc5-47d1-9028-0e68348a932f key xxxxx set system login user foo authentication public-keys github@4732d9b0-4bc5-47d1-9028-0e68348a932f type ssh-rsa set system login user foo authentication public-keys github@a93a85ba-5b63-4c3a-a589-2e82da7c8f1f key xxxxx set system login user foo authentication public-keys github@a93a85ba-5b63-4c3a-a589-2e82da7c8f1f type ssh-rsa commit save exit vyos@r14:~$
c-po closed T5034: Migrate multicast CLI node to valueLess, a subtask of T5007: Interface multicast setting is invalid, as Resolved.
c-po changed the status of T5034: Migrate multicast CLI node to valueLess, a subtask of T5007: Interface multicast setting is invalid, from Open to In progress.
c-po moved T4948: pppoe: add CLI option to allow definition of host-uniq flag from In Progress to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
c-po moved T5007: Interface multicast setting is invalid from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
c-po moved T5008: MACsec CKN of 32 chars is not allowed in CLI, but works fine from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
doctorpangloss added a comment to T5033: generate-public-key command fails for address with multiple public keys like GitHub.
Yes, apparently so from GitHub.
Viacheslav edited projects for T5033: generate-public-key command fails for address with multiple public keys like GitHub, added: VyOS 1.3 Equuleus (1.3.3), VyOS 1.4 Sagitta; removed VyOS 1.3 Equuleus (1.3.4).
Do those keys always without an "identifier"?
I mean foo@localhost
ssh-rsa AAA....
Coopercentral added a comment to T4943: Radius SSH login displays "permission denied" on 1.4 rolling release.
Hello - I upgraded to the latest rolling release (1.4-rolling-202302250317), and it appears to be working. I am able to login with a radius account successfully. Thank you for your efforts! I see in you PR's above, the second link is to change the shell from "bash" to "vbash". It appears once I login with a radius privileged account, the shell continues to default to "bash":
including information about Netopee2/sysrepo services, how to integrate it with FRR, where we can utilize the advantages netconf/yang :
Viacheslav changed the status of T4943: Radius SSH login displays "permission denied" on 1.4 rolling release from In progress to Needs testing.
Feb 24 2023
Feb 24 2023
I looked into it, but there doesn't seem to be a way to temporarily disable a particular interface in DHCP relay.
Have you try getting same result using VRRP transitions scripts?
zsdc added a comment to T4943: Radius SSH login displays "permission denied" on 1.4 rolling release.
Viacheslav updated the task description for T5029: Nginx change default root directory and fix regex.
a.apostoliuk changed the status of T5008: MACsec CKN of 32 chars is not allowed in CLI, but works fine from Needs testing to In progress.
zsdc changed the status of T4943: Radius SSH login displays "permission denied" on 1.4 rolling release from Open to In progress.
Looks like a new nightly rolling update was finally released (vyos-1.4-rolling-202302231931-amd64) 🎉 I just installed it and so far it looks good. I'm no longer getting the 502 errors / segfault. Thanks again!
I can confirm adding this packaged worked, you can now mount with
Feb 23 2023
Feb 23 2023
It looks like I also need to add the exfat-fuse package inorder to get the helpers for mounting filesystems.
The above repos are suitable for testing: basic tests in vm's and a Protecli device look fine. Note that the vyos-1x repo artificially disables the potential config mode reordering in order to confirm tests of vyos-interface-monitor.:
https://github.com/vyos/vyos-1x/commit/02d874e65262cbd53b413b3eef659b8e7d78bf31
Viacheslav added a project to T5007: Interface multicast setting is invalid: VyOS 1.3 Equuleus (1.3.3).
Hey @fernando thanks for your comment.
Personally I haven't tried openvpn2.6.0 + ovpn-dco on Debian 12 yet. However, there should be no real difference as ovpn-dco can happily run up to linux-6.1/6.2 as well.
Viacheslav changed the status of T5028: Add package exfatprogs to VyOS from In progress to Needs testing.
@ordex nice your reply here , we're planning to introduce it in our last upgrade version( we need to upgrade openvpn version to work with opvn-dco ) , Di you try it on Debian 12? My current environment was over Debian 11, if you have any suggestion it will good to know.
Viacheslav closed T5013: Extend accelppp.py op-mode to get subnet start stop info from config, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, as Resolved.
PR https://github.com/vyos/vyos-1x/pull/1842
vyos@r14:~$ /usr/libexec/vyos/tests/smoke/cli/test_interfaces_openvpn.py test_openvpn_client_interfaces (__main__.TestInterfacesOpenVPN.test_openvpn_client_interfaces) ... ok test_openvpn_client_verify (__main__.TestInterfacesOpenVPN.test_openvpn_client_verify) ... ok test_openvpn_options (__main__.TestInterfacesOpenVPN.test_openvpn_options) ... ok test_openvpn_server_net30_topology (__main__.TestInterfacesOpenVPN.test_openvpn_server_net30_topology) ... ok test_openvpn_server_subnet_topology (__main__.TestInterfacesOpenVPN.test_openvpn_server_subnet_topology) ... ok test_openvpn_server_verify (__main__.TestInterfacesOpenVPN.test_openvpn_server_verify) ... ok test_openvpn_site2site_interfaces_tun (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_interfaces_tun) ... ok test_openvpn_site2site_verify (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_verify) ... ok
secret has been deprecated
static key mode (non-TLS) is no longer considered "good and secure enough" for today's requirements. Use TLS mode instead. If deploying a PKI CA is considered "too complicated", using --peer-fingerprint makes TLS mode about as easy as using --secret.https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst
Config VyOS:
set interfaces openvpn vtun5001 local-address 203.0.113.1 set interfaces openvpn vtun5001 mode 'site-to-site' set interfaces openvpn vtun5001 remote-address '192.0.2.5' set interfaces openvpn vtun5001 shared-secret-key 'ovpn_test' set pki openvpn shared-secret ovpn_test key '9caf354e0f313b3a671d01e62ea2b512346a651dd30a9e51d6c45dc1031f1b0931eabdf7a0ddcbe1a147ff882ccce35dcb5e1d4d6ddb5e909ca012a8d8e16fe50dd332005dff9a836a2852f36e84e27bad07993a8094c56fb0553866ef74c6c5cc6ddb8f4673d3ff300c48068b944bd8ba1100d41f91d156bcd2629ff39837ddcb34d93147a4aabc7e6ad95d5800c82c8ab60ba302d6625a3b26fbfe183fd6c06d884be44edde344fd0ac91a33064529e010eba0c0f495fa44519fd98adb97452a27fb3340bc20efadd68c9538aa4a238c9f58f542e3571ec78790fdd03e678e18631b82edb9358a2c55ce581d68b71881cad0d0419d4cc58c13641f84281260' set pki openvpn shared-secret ovpn_test version '1'
Feb 22 2023
Feb 22 2023
Viacheslav changed the status of T5025: Time-zone validation failed from In progress to Needs testing.
Viacheslav changed the status of T4978: KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536 from In progress to Needs testing.
In T5022#143112, @syncer wrote:@Viacheslav can you see what auth modes supported by keepalive
also I think we don't need to configure bothset high-availablilty vrrp global notification_email [email protected] set high-availablilty vrrp global notification_email_from [email protected]or that is destination and from ?