| Age | Commit message (Collapse) | Author |
|---|
|
A list containing only unique elements not part of the other list is
returned. This is usefull to check e.g. which IP addresses need to be
removed from the OS.
|
|
vyos.ifconfig class
|
|
The following CLI command can be used to add a raw option to OpenVPN
which requires quotes:
> set interfaces openvpn vtun10 openvpn-option 'push "keepalive 1 10"'
The resulting config file will then have the following set:
> push "keepalive 1 10"
|
|
|
|
|
|
T1614 bonding
|
|
a bond
|
|
As in the past during the priority race of the bash script invalid configuration
could appear in the CLI and are de-synced from the kernle state, e.g. some
bonding modes do not support arp_interval.
This is no longer allowed and added to the migration script so that the config
again represents the truth.
|
|
|
|
Tested using:
=============
set interfaces bonding bond0 address 192.0.2.1/24
set interfaces bonding bond0 description "VyOS bonding"
set interfaces bonding bond0 disable-link-detect
set interfaces bonding bond0 hash-policy layer2+3
set interfaces bonding bond0 ip arp-cache-timeout 86400
set interfaces bonding bond0 mac 00:91:00:00:00:01
set interfaces bonding bond0 mode active-backup
set interfaces bonding bond0 mtu 9000
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
set interfaces bonding bond0 vif-s 100 address 192.168.10.1/24
set interfaces bonding bond0 vif-s 100 description "802.1ad service VLAN 100"
set interfaces bonding bond0 vif-s 100 mtu 1500
set interfaces bonding bond0 vif-s 100 mac 00:91:00:00:00:02
set interfaces bonding bond0 vif-s 100 vif-c 110 address "192.168.110.1/24"
set interfaces bonding bond0 vif-s 100 vif-c 110 description "client VLAN 110"
set interfaces bonding bond0 vif-s 100 vif-c 120 address "192.168.120.1/24"
set interfaces bonding bond0 vif-s 100 vif-c 120 description "client VLAN 120"
set interfaces bonding bond0 vif-s 100 vif-c 130 address "192.168.130.1/24"
set interfaces bonding bond0 vif-s 100 vif-c 130 description "client VLAN 130"
set interfaces bonding bond0 vif 400 address 192.168.40.1/24
set interfaces bonding bond0 vif 400 description "802.1q VLAN 400"
set interfaces bonding bond0 vif 400 mtu 1500
set interfaces bonding bond0 vif 400 mac 00:91:00:00:00:03
|
|
|
|
Support for vif-c interfaces is still missing
|
|
|
|
|
|
The node 'interfaces ethernet eth0 bond-group' has been changed and
de-nested. Bond members are now configured in the bond interface itself.
set interfaces bonding bond0 member interface eth0
|
|
|
|
|
|
|
|
|
|
T1557 Create generic abstraction for configuring interfaces e.g. IP address
|
|
|
|
|
|
|
|
functionality must saved
|
|
|
|
This feature is not well supported by pyroute2 and thus uses the proof-of-concept
vyos.interfaceconfig library.
Maybe it's a better idea to write our own library from scratch.
|
|
|
|
* t1614-bonding:
Python/VyOS validate: add is_ip() to check for IPv4 or IPv4 address
bridge: T1556: remove unused function freeze()
list-interfaces: T1614: support listing interfaces which can be bonded
|
|
|
|
|
|
|
|
loopback: T1601: migrate to pyroute2
|
|
|
|
|
|
bridge: T1556: migrate to pyroute2
|
|
Tested with:
set interfaces bridge br0 address '192.0.2.1/24'
set interfaces bridge br0 aging '500'
set interfaces bridge br0 disable-link-detect
set interfaces bridge br0 forwarding-delay '11'
set interfaces bridge br0 hello-time '5'
set interfaces bridge br0 igmp querier
set interfaces bridge br0 max-age '11'
set interfaces bridge br0 member interface eth1 cost '1000'
set interfaces bridge br0 member interface eth1 priority '4'
set interfaces bridge br0 member interface eth2 cost '1001'
set interfaces bridge br0 member interface eth2 priority '56'
|
|
|
|
|
|
|
|
vyos.interfaceconfig common ipv4/ipv6 functions
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Netmasks (both IPv4 and IPv6) that are allowed to use the server. The default
allows access only from RFC 1918 private IP addresses. Due to the aggressive
nature of the internet these days, it is highly recommended to not open up the
recursor for the entire internet. Questions from IP addresses not listed here
are ignored and do not get an answer.
https://docs.powerdns.com/recursor/settings.html#allow-from
Imagine an ISP network with non RFC1918 IP adresses - they can't make
use of PowerDNS recursor.
As of now VyOS hat allow-from set to 0.0.0.0/0 and ::/0 which created an open
resolver. If there is no allow-from statement a config-migrator will add
the appropriate nodes to the configuration, resulting in:
service {
dns {
forwarding {
allow-from 0.0.0.0/0
allow-from ::/0
cache-size 0
ignore-hosts-file
listen-address 192.0.2.1
}
}
}
|
|
|
|
According to https://github.com/twilio/authy-openvpn commit 3e5dc73:
> This plugin is no longer actively maintained. If you're interested in
becoming a maintainer, we welcome forks of this project.
In addition this plugin was always missing in the current branch ov VyOS and
did not make it into VyOS 1.2 (crux)
If 2FA for OpenVPN is required we should probably opt for Google Authenticator
or if possible a U2F device.
|
|
|
