Allowing only ethernet interface task https://vyos.dev/T6265
After adding check, this task can be closed
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Apr 25 2024
Apr 25 2024
Viacheslav triaged T6266: Firewall flowtable ability to set timeout for TCP and UDP flow as Wishlist priority.
Viacheslav triaged T6265: Firewall flowtable should allow ethernet only interfaces as Normal priority.
Will be available in the next rolling release.
Viacheslav changed the status of T6263: Commit failures when trying to set an IGMP group with source address on an interface from Open to In progress.
Viacheslav added a comment to T6263: Commit failures when trying to set an IGMP group with source address on an interface.
The group 224.0.0.0/24 is reserved
r4(config)# interface eth2 r4(config-if)# ip igmp join 224.0.0.0 224.0.0.10 % Configuration failed.
PR https://github.com/vyos/vyos-1x/pull/3361
vyos@r4# set interfaces ethernet eth2 ipv6 base-reachable-time 28 [edit] vyos@r4# commit [edit] vyos@r4# [edit] vyos@r4# sudo sysctl net.ipv6.neigh.eth2.base_reachable_time_ms net.ipv6.neigh.eth2.base_reachable_time_ms = 28000 [edit] vyos@r4# vyos@r4# cat /proc/sys/net/ipv6/neigh/eth2/base_reachable_time_ms 28000 [edit] vyos@r4#
Viacheslav moved T5833: Not all AFIs are compatible with VRF from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
In T6258#184876, @canoziia wrote:
In T6258#184875, @Viacheslav wrote:This sysctl option is deprecated
DEPRECATED PARAMETERS top The base_reachable_time and retrans_time are deprecated. The sysctl command does not allow changing values of these parameters. Users who insist to use deprecated kernel interfaces should push values to /proc file system by other means. For example: echo 256 > /proc/sys/net/ipv6/neigh/eth0/base_reachable_timeI propose to add new option under interface
set interfaces ethernet eth1 ip[v6] base-reachable-time xxx
This sysctl option is deprecated https://man7.org/linux/man-pages/man8/sysctl.8.html
DEPRECATED PARAMETERS top
Hi everyone, I think I found the simplest configuration that can reproduce this problem. If we set up firewall and use this command(set system sysctl parameter net.ipv6.neigh.eth3/2) in configuration at the same time, an error message will show when startup.
This is an example
set firewall set interfaces ethernet eth0 address 'xxx.xxx.184.32/24' set interfaces ethernet eth0 hw-id 'xx:xx:xx:xx:xx:50' set interfaces ethernet eth1 hw-id 'xx:xx:xx:xx:xx:ba' set interfaces ethernet eth1 vif 2 set interfaces loopback lo set protocols static route xxx.xxx.0.0/0 next-hop xxx.xxx.184.1 set service ntp allow-client xxxxxx 'xxx.xxx.0.0/0' set service ntp allow-client xxxxxx '::/0' set service ntp server xxxxx.tld set service ntp server xxxxx.tld set service ntp server xxxxx.tld set service ssh set system config-management commit-revisions '100' set system conntrack modules ftp set system conntrack modules h323 set system conntrack modules nfs set system conntrack modules pptp set system conntrack modules sip set system conntrack modules sqlnet set system conntrack modules tftp set system console device ttyS0 speed '115200' set system host-name xxxxxx set system login user xxxxxx authentication encrypted-password xxxxxx set system sysctl parameter net.ipv6.neigh.eth1/2.base_reachable_time_ms value '14400000' set system syslog global facility all level 'info' set system syslog global facility local7 level 'debug'
If delete the first line (set firewall), system will start normally without error message.
Apr 24 2024
Apr 24 2024
Unknown Object (User) added a comment to T6256: Replace deprecated ISC dhcp-relay (EOL) with something else.
So most likely we will have to find another implementation.
I sent a question to ISC regarding https://www.isc.org/blogs/dhcp-client-relay-eom/ and:
natali-rs1985 changed the status of T6234: PPPoE-server pado-delay refactoring from Open to In progress.
Viacheslav triaged T6263: Commit failures when trying to set an IGMP group with source address on an interface as Normal priority.
Reopen to investigate.
I tested in the latest rolling version and the traceback error is not received anymore and the tunnel ip column shows n/a but with multiple entries.
It still shows the disconnected client and I assume it should not show disconnected clients
Viacheslav closed T2747: "enable-local-traffic" has no effect in load-balancing to redirect local traffic as Wontfix.
Close it as wontfix due to legacy backend.
In some cases, we can't predict the interface name (if the interface name is over 15 characters) https://vyos.dev/T6222
Viacheslav changed the status of T6233: Container configurations on VyOS 1.5 prevent containers from starting from Open to Needs reporter action.
@sempervictus Any updates or additional context?
Fixed, VyOS 1.5-rolling-202404240023
vyos@r4# run show conf com | match "bri|tun0" set interfaces bridge br0 member interface tun0 set interfaces tunnel tun0 encapsulation 'gretap' set interfaces tunnel tun0 remote '192.168.122.111' set interfaces tunnel tun0 source-address '192.168.122.14' [edit] vyos@r4# delete interfaces tunnel [edit] vyos@r4# commit [ interfaces tunnel tun0 ] Interface "tun0" cannot be deleted as it is a member of bridge "br0"!
Viacheslav changed the subtype of T3915: Create op-mode top-level wrapper for ssh/scp command -VyOS 1.4 from "Bug" to "Feature Request".
Viacheslav renamed T5833: Not all AFIs are compatible with VRF from BGP address family flowspec incompatible with VRF to Not all AFIs compatible with VRF.
Viacheslav changed the status of T5833: Not all AFIs are compatible with VRF from Open to In progress.
Viacheslav renamed T5833: Not all AFIs are compatible with VRF from BGP Impossible to use address family flowspec with VRF to BGP address family flowspec incompatible with VRF.
Viacheslav changed the status of T6109: remote syslog does not get all the logs from Unknown Status to Resolved.
c-po moved T6244: Improve formatting in "show system uptime" from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
c-po moved T6261: Typo in the operational mode connect and disconnect command output from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.7) board.
c-po moved T6261: Typo in the operational mode connect and disconnect command output from Finished to 1.3.7 on the VyOS 1.3 Equuleus board.
c-po moved T6261: Typo in the operational mode connect and disconnect command output from Need Triage to Finished on the VyOS 1.3 Equuleus board.
c-po moved T5755: Running set pki ca NAME certificate with a name with spaces breaks the config from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6246: Add support for server health checks to reverse proxy from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6261: Typo in the operational mode connect and disconnect command output from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6252: GRE tunnels don't allow configuring MTU larger than 8024 from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6261: Typo in the operational mode connect and disconnect command output from Open to Finished on the VyOS 1.4 Sagitta board.
c-po moved T6226: Add "tcp-requece inspect-delay" to reverse proxy from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
c-po moved T6259: PKI: Support RFC822 (email) names in SAN from Open to In Progress on the VyOS 1.5 Circinus board.
c-po moved T6226: Add "tcp-requece inspect-delay" to reverse proxy from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6262: Update the boot splash for VyOS 1.5 ISO from Open to Finished on the VyOS 1.5 Circinus board.
c-po added a project to T6226: Add "tcp-requece inspect-delay" to reverse proxy: VyOS 1.4 Sagitta (1.4.0-epa3).
c-po moved T6109: remote syslog does not get all the logs from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6109: remote syslog does not get all the logs from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
c-po added a project to T6109: remote syslog does not get all the logs: VyOS 1.4 Sagitta (1.4.0-epa3).
c-po moved T6217: Set the log id of the VRRP contrack-sync script to vyos-vrrp-conntracksync from Open to Finished on the VyOS 1.5 Circinus board.
c-po moved T6255: Static table description should not contain white-space from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
c-po moved T6255: Static table description should not contain white-space from Open to Finished on the VyOS 1.5 Circinus board.
Apr 23 2024
Apr 23 2024
Embezzle changed the status of T6255: Static table description should not contain white-space from In progress to Needs testing.
Viacheslav added a comment to T6042: ssh scripts should work with arguments again; they do not anymore.
@doctorpangloss Any updates?
Viacheslav changed the status of T6058: Commit-Archive Save doesn't use https_proxy from Open to Needs reporter action.
@modzilla99 Could you provide an example of set commands to reproduce?
Viacheslav moved T6237: IPSec remote access VPN: ability to set EAP ID of clients from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
Tested as working in: VyOS 1.5-rolling-202404230019
In T6258#184716, @Viacheslav wrote:Most likely needs to change priority to 319 for the sysctl
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "ethernet|sysctl" 300 interfaces_virtual-ethernet.py ['interfaces', 'virtual-ethernet'] 318 interfaces_ethernet.py ['interfaces', 'ethernet'] 318 system_sysctl.py ['system', 'sysctl'] 321 interfaces_pseudo-ethernet.py ['interfaces', 'pseudo-ethernet'] vyos@r4:~$
What happens if another interface/value occupies the index 101?
For example, PPPoE-server and PPP interface can generate thousands of interfaces
It was filtered in https://vyos.dev/T2086 to avoid pam_unix mess
Giggum closed T6261: Typo in the operational mode connect and disconnect command output as Resolved.
Viacheslav placed T1751: DNS server addresses from DHCPv6 are not added to resolv.conf up for grabs.
Viacheslav changed the status of T6217: Set the log id of the VRRP contrack-sync script to vyos-vrrp-conntracksync from Open to In progress.
Can't reproduce it, close the task
Viacheslav added a project to T6251: Extend table number limits for policy route-map set table: Restricted Project.
Viacheslav triaged T6257: Add op mode commands for dynamic firewall address groups as Normal priority.
Most likely needs to change priority to 319 for the sysctl
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "ethernet|sysctl"
300 interfaces_virtual-ethernet.py ['interfaces', 'virtual-ethernet']
318 interfaces_ethernet.py ['interfaces', 'ethernet']
318 system_sysctl.py ['system', 'sysctl']
321 interfaces_pseudo-ethernet.py ['interfaces', 'pseudo-ethernet']
vyos@r4:~$I have asked the OP @canoziia to provide such in the forum.
Extend to <1-65535>
PR https://github.com/vyos/vyos-1x/pull/3353
What do I need to do to get these values?
root@r1-right:/home/vyos# sysctl net.ipv6.neigh.eth3/2.base_reachable_time_ms sysctl: cannot stat /proc/sys/net/ipv6/neigh/eth3.2/base_reachable_time_ms: No such file or directory
I can only refer to whats unfolded on the forum at https://forum.vyos.io/t/how-to-set-net-ipv6-neigh-etha-b-base-reachable-time-in-vyos/14304
Giggum added a comment to T6261: Typo in the operational mode connect and disconnect command output.
Apr 22 2024
Apr 22 2024
Embezzle changed the status of T6259: PKI: Support RFC822 (email) names in SAN from Open to In progress.
Giggum updated subscribers of T6123: Limit NTP allow-client config to internal addresses by default.
@Viacheslav or another of the Maintainers:
Could you provide the full set of commands to reproduce?