| Age | Commit message (Collapse) | Author |
|---|
|
firewall: T4612: Support arbitrary netmasks
|
|
|
|
Clients supporting this DHCP option (DHCP option 108, RFC 8925) will
disable its IPv4 network stack for configured number of seconds
and operate in IPv6-only mode.
This option is known to work on iOS 15+ and macOS 12.0.1+.
Example command:
```sh
set service dhcp-server shared-network-name LAN6 subnet 192.168.64.0/24 ipv6-only-preferred 0
```
|
|
works as expected
|
|
so this new group can be used in inbound and outbound matcher
|
|
policy: T2199: T4605: Migrate policy route interface node
|
|
This reverts commit 726cdf8bfd27d751737383102fa205f3c082710c.
|
|
|
|
<name> interface <ifname>`
* Include refactor to policy route to allow for deletion of mangle table instead of complex cleanup
* T4605: Rename mangle table to vyos_mangle
|
|
|
|
|
|
|
|
This reverts commit f3420a967ad5597c57093b5279a844dca4c516c0.
|
|
|
|
|
|
`fqdn` node
|
|
wireguard: T4774: Prevent duplicate peer public keys
|
|
containers: T3903: Use systemd to handle containers
|
|
|
|
|
|
|
|
nat: T4764: Remove NAT tables on node deletion
|
|
|
|
|
|
|
|
|
|
Move default values of TOTP configuration from a global to a per user setting.
This makes the entire code easier as no global configuration must be blended
into the per user config dict.
Also it should be possible to set the authentication window "multiple concurrent
keys" individual per user.
set system login user vyos authentication otp key 'gzkmajid7na2oltajs4kbuq7lq'
set system login user vyos authentication plaintext-password 'vyos'
|
|
|
|
|
|
system login: T874: add 2FA support for local and ssh authentication
|
|
|
|
Due to monitoring telegraf was rewritten - fix template for
inputs.exec plugin
We do not use 'influxdb_configured' in the dictionary anymore and
use just 'influxdb'
|
|
isis: T4739: ISIS segment routing being refactored
|
|
This is to refactor ISIS segment routing to match up with OSPF segment routing.
|
|
See https://github.com/FRRouting/frr/issues/12007
|
|
Add support for arbitrary netmasks on source/destination addresses in
firewall rules. This is particularly useful with DHCPv6-PD when the
delegated prefix changes periodically.
|
|
|
|
In this commit we add OSPF segment routing, smoke tests, handlers,
FRR template changes, and CLI commands.
|
|
Section.interfaces() now as an option if it should return also VLAN interfaces
or not. No need to keep a custom logic for it.
|
|
Changed CLI syntax in route-map set community,
set large-community, set extcommunity
Allows to add multiple communities, large-communities
and extcommunities in clear view.
Added new well-known communities.
Added non-transitive feature in extcommunities.
Fixed community's validators.
|
|
T4700: Firewall: add interface matching criteria
|
|
The initial implementation from commit ac4e07f9 ("rfs: T4689: Support RFS
(Receive Flow Steering)") always adjusted the global rps_sock_flow_entries
configuration. So if RFS was enabled for one NIC but not the other - it did not
work.
According to the documentation:
RFS is only available if the kconfig symbol CONFIG_RPS is enabled (on by
default for SMP). The functionality remains disabled until explicitly
configured. The number of entries in the global flow table is set through:
/proc/sys/net/core/rps_sock_flow_entries
The number of entries in the per-queue flow table are set through:
/sys/class/net/<dev>/queues/rx-<n>/rps_flow_cnt
Both of these need to be set before RFS is enabled for a receive queue. Values
for both are rounded up to the nearest power of two. The suggested flow count
depends on the expected number of active connections at any given time, which
may be significantly less than the number of open connections. We have found
that a value of 32768 for rps_sock_flow_entries works fairly well on a
moderately loaded server.
This commit sets rps_sock_flow_entries via sysctl on bootup leafing the RFS
configuration to the interface level.
|
|
ids: T4557: Migrate threshold and add new threshold types
|
|
Migrate "service ids ddos-protection threshold xxx" to
"service ids ddos-protection general threshold xxx"
Add new threshold types:
set service ids ddos-protection threshold tcp xxx
set service ids ddos-protection threshold udp xxx
set service ids ddos-protection threshold icmp xxx
|
|
|
|
|
|
nat: nat66: T4605: T4706: Refactor NAT/NAT66 and use new table name
|
|
* Rename table to vyos_nat
* Add static NAT smoketest
|
|
* Rename table to vyos_nat
* Refactor tests to use `verify_nftables` format
|
|
* Rename table to vyos_nat
* Refactor tests to use `verify_nftables` format
|
