Age | Commit message (Collapse) | Author |
|
filenames
|
|
|
|
As the keys are now stored inside the CLI configuration and no longer in a file
on the filesystem, this command is no longer required.
Also there are dedicated CLI commands available to display the additional
Wireguard information.
- show interfaces wireguard wg10
- show interfaces wireguard wg10 summary
|
|
As the keys are now stored inside the CLI configuration and no longer in a file
on the filesystem, this command is no longer required.
|
|
As the keys are now stored inside the CLI configuration and no longer in
a file on the filesystem, this command is no longer required.
|
|
bridge: op-mode: T3698: Support bridge monitoring
|
|
Per interface public-key can now be retrieved via:
vyos@vyos:~$ show interfaces wireguard wg10 public-key
+XZr0oUjYRQuB/kcO1f+puOjKkiOWBG8eZX1Jpyq2n0=
|
|
|
|
|
|
Update/refresh of DNS records is now handled internally by Strongswan.
|
|
|
|
bridge: op-mode: T3667: Fix displaying members of a specific bridge interface
|
|
pki: https: T3642: Migrate HTTPS to use PKI configuration
|
|
|
|
|
|
pki: openvpn: T3642: Migrate OpenVPN to PKI and refactor
|
|
|
|
|
|
generate ipsec mac-ios-profile <connection> remote <ip|fqdn>
will generate a matching IPSec profile which can be loaded on an iOS device.
|
|
pki: eapol: T3642: Migrate EAPoL to use PKI configuration
|
|
|
|
|
|
pki: openconnect: sstp: T3642: Migrate OpenConnect and SSTP to PKI configuration
|
|
|
|
|
|
This extends commit 22791e26 ("VRF: T3655: proper connection tracking for VRFs")
so that when the netfilter table is removed, we first check if it exists at all,
and if it does not exist we do not remove it.
This fixes the smoketest error:
PermissionError: [Errno 1] failed to run command: nft delete table inet vrf_zones
|
|
pki: wireguard: T3642: Migrate Wireguard private key directly into CLI
|
|
|
|
Also renames peer pubkey to public-key for consistency
|
|
Connection uniqueness policy to enforce. To avoid multiple connections from the
same user, a uniqueness policy can be enforced.
* never: never enforce such a policy, even if a peer included INITIAL_CONTACT
notification
* keep: reject new connection attempts if the same user already has an active
connection
* replace: delete any existing connection if a new one for the same user gets
established
To compare connections for uniqueness, the remote IKE identity is used. If EAP
or XAuth authentication is involved, the EAP-Identity or XAuth username is used
to enforce the uniqueness policy instead.
|
|
Remote access IP pools can now be defined at a global level and referenced
in IPSec remote-access connections. To defined a pool use:
set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1'
set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24'
set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1'
set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64'
A connection can then reference the pool:
set vpn ipsec remote-access connection foo pool 'global-ipv4'
set vpn ipsec remote-access connection foo pool 'global-ipv6'
|
|
... this enables a dual-stack IKEv2 VPN deployment.
|
|
|
|
|
|
This reverts commit 70f7f06e778efa4bd3c2ad127d66c080e1db80c5.
|
|
|
|
|
|
|
|
VRF: T3655: proper connection tracking for VRFs
|
|
Currently, all VRFs share the same connection tracking table, which can
lead to problems:
- traffic leaks to a wrong VRF
- improper NAT rules handling when multiple VRFs contain the same IP
networks
- stateful firewall rules issues
The commit implements connection tracking zones support. Each VRF
utilizes its own zone, so connections will never mix up.
It also adds some restrictions to VRF names and assigned table numbers,
because of nftables and conntrack requirements:
- VRF name should always start from a letter (interfaces that start from
numbers are not supported in nftables rules)
- table number must be in the 100-65535 range because conntrack supports
only 65535 zones
|
|
Commit 22739144 ('ipsec: T2816: migrate "ipsec interfaces" to "interface"')
by accident deleted the vpn_ipsec.py Python handler.
Handler was restored.
|
|
This reverts commit c414479fdf1d5ad77170f977481fb9197c9559ae.
This commit broke the smoketests and also OpenVPN complains:
Options error: You must define certificate file (--cert) or PKCS#12 file (--pkcs12)
|
|
|
|
|
|
|
|
|
|
pki: ipsec: l2tp: T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and update to use PKI.
|
|
update to use PKI.
|
|
dhclient is already handled by netplug so it's removed to avoid double
renewing of dhcp leases.
|
|
container: T3662: Set its priority to 1280
|