PR https://github.com/vyos/vyos-1x/pull/3280
vyos@r15-left:~$ show conntrack statistics CPU Found Invalid Insert Insert fail Drop Early drop Errors Search restart ----- ------- --------- -------- ------------- ------ ------------ -------- ---------------- -- -- 0 0 280 0 1 1 0 1 0 2 0 1 0 73 0 0 0 0 126 0 1 0 vyos@r15-left:~$
After deleting and adding the firewall, it looks good
So, for some reason, the rule 10 and default action accept were applied 2 times to the firewall
chain VYOS_FORWARD_filter {
type filter hook forward priority filter; policy accept;
counter packets 928376 bytes 1800341472 flow add @VYOS_FLOWTABLE_FLOWTABLE comment "ipv4-FWD-filter-10"
counter packets 928376 bytes 1800341472 accept comment "FWD-filter default-action accept"
counter packets 0 bytes 0 flow add @VYOS_FLOWTABLE_FLOWTABLE comment "ipv4-FWD-filter-10"
ct state { established, related } counter packets 0 bytes 0 flow add @VYOS_FLOWTABLE_FLOWTABLE comment "ipv4-FWD-filter-20"
counter packets 0 bytes 0 accept comment "FWD-filter default-action accept"
}@Daya @trae32566 Any updates?
@indrajitr Can we close it?
@indrajitr Can we close it?
@Giggum Can you check it on 1.5?
It is easy to add
In FRR it looks like:
r4(config-rpki)# rpki cache 192.0.2.1 8888 SSH_UNAME SSH user name preference Preference of the cache server source Configure source IP address of RPKI connection
PoC PR https://github.com/vyos/vyos-1x/pull/3274
set nat cgnat pool external ext1 external-port-range '1024-65535' set nat cgnat pool external ext1 per-user-limit port '1000' set nat cgnat pool external ext1 range 192.0.2.222/32 set nat cgnat pool internal int1 range '100.64.0.0/28' set nat cgnat rule 10 source pool 'int1' set nat cgnat rule 10 translation pool 'ext1'
@a.apostoliuk Recheck reconfguration, not new configuration
We are currently using FRR segment routing set protocols segment-routing srv6
For now, it could be closed
It is not a bug with the VyOS itself.
You don't need to create the task on Phabricator
Feel free to create a PR without the task https://github.com/vyos/vyos-documentation/tree/equuleus
You may only use this Speedtest software and information generated
from it for personal, non-commercial use, through a command line
interface on a personal computer. Your use of this software is subject
to the End User License Agreement, Terms of Use and Privacy Policy at
these URLs:
The original issue was resolved.
@ServerForge It is question for hsflowd
You can open the issue on their git repo
Proposed CLI:
set nat cgnat pool external <external> range 192.0.2.0/30 seq 1 set nat cgnat pool external <external> range 192.0.2.128-192.0.2.132 seq 2 set nat cgnat pool external <external> per-user-limit port 1024 set nat cgnat pool external <external> global-port-range 1024-65535 set nat cgnat pool internal <internal> range 100.64.1.0/24
I'm not sure that a list of ports will be helpful in this way.
From time to time, we need to scan specific ports.
What about
force scan-port-host <x.x.x.x> proto <tcp|udp> port '8080-8081,9200' force port--discovery-host <x.x.x.x> proto <tcp|udp> port '8080' force port-scan host <x.x.x.x> proto <tcp|udp> port '8080'
And use native nmap binaries (as python3 nmap module is not installed by default)
Also, it has XML format if you want a custom table:
sudo nmap -oX - 127.0.0.1
Probably VNI is applied after BGP
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "vrf|bri|vxlan"
11 vrf.py ['vrf']
310 interfaces_bridge.py ['interfaces', 'bridge']
460 interfaces_vxlan.py ['interfaces', 'vxlan']
481 protocols_static.py ['vrf', 'name', 'protocols', 'static']
611 protocols_isis.py ['vrf', 'name', 'protocols', 'isis']
621 protocols_ospf.py ['vrf', 'name', 'protocols', 'ospf']
621 protocols_ospfv3.py ['vrf', 'name', 'protocols', 'ospfv3']
821 protocols_bgp.py ['vrf', 'name', 'protocols', 'bgp']
821 protocols_eigrp.py ['vrf', 'name', 'protocols', 'eigrp']
822 vrf_vni.py ['vrf', 'name', 'vni']
vyos@r4:~$The current priorities:
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "vrf|bri|vxlan"
11 vrf.py ['vrf']
310 interfaces_bridge.py ['interfaces', 'bridge']
460 interfaces_vxlan.py ['interfaces', 'vxlan']
481 protocols_static.py ['vrf', 'name', 'protocols', 'static']
611 protocols_isis.py ['vrf', 'name', 'protocols', 'isis']
621 protocols_ospf.py ['vrf', 'name', 'protocols', 'ospf']
621 protocols_ospfv3.py ['vrf', 'name', 'protocols', 'ospfv3']
821 protocols_bgp.py ['vrf', 'name', 'protocols', 'bgp']
821 protocols_eigrp.py ['vrf', 'name', 'protocols', 'eigrp']
822 vrf_vni.py ['vrf', 'name', 'vni']
vyos@r4:~$@kevinrausch Thank you for the report, next time it is better to use set of the commands to reproduce
vyos@r4:~$ generate tech-support archive /tmp/foo
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/generate_tech-support_archive.py", line 123, in <module>
tmp_dir.mkdir()
File "/usr/lib/python3.11/pathlib.py", line 1117, in mkdir
os.mkdir(self, mode)
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/foo/drops-debug_2024-03-31T12-07-09'
vyos@r4:~$It seems hardcoded here https://github.com/vyos/vyos-1x/blob/252d03d6e419aae14ae75caed38d1b1001c916a2/src/op_mode/generate_tech-support_archive.py#L96
@ServerForge, it seems to be working with the v2.0.55-1 version. Could you build a package and re-check?
git clone -b v2.0.55-1 --single-branch https://github.com/sflow/host-sflow.git sudo apt-get install -y libpcap0.8-dev make deb FEATURES="PCAP DROPMON DBUS"
Only ethernet interfaces or bridges are allowed; from their docs https://sflow.net/host-sflow-linux-config.php
PCAP Packet Sampling
It seems a broken local build; close the task.
Reopen if necessary.
"reset vpn ipsec " command and does not reset SAs that are dow
PR https://github.com/vyos/vyos-1x/pull/3193
Extend config-sync for sections qos and system
vyos@r4# set service config-sync section system Possible completions: conntrack Connection Tracking flow-accounting Flow accounting option System Options sflow sFlow static-host-mapping Map host names to addresses sysctl Configure kernel parameters at runtime
It is not an actual ethernet interface, but you name it as an ethernet interface.
You can check the output sudo ip link show type wireguard or sudo ip link show type tun
@tjh already backported