diff options
Diffstat (limited to 'docs/_locale/de/configuration.pot')
| -rw-r--r-- | docs/_locale/de/configuration.pot | 643 |
1 files changed, 387 insertions, 256 deletions
diff --git a/docs/_locale/de/configuration.pot b/docs/_locale/de/configuration.pot index 4e898103..02238ad3 100644 --- a/docs/_locale/de/configuration.pot +++ b/docs/_locale/de/configuration.pot @@ -194,6 +194,10 @@ msgid "**If you are looking for a policy for your outbound traffic** but you don msgstr "**If you are looking for a policy for your outbound traffic** but you don't know which one you need and you don't want to go through every possible policy shown here, **our bet is that highly likely you are looking for a** Shaper_ **policy and you want to** :ref:`set its queues <embed>` **as FQ-CoDel**." #: ../../configuration/firewall/general-legacy.rst:9 +msgid "**Important note:** This documentation is valid only for VyOS Sagitta prior to 1.4-rolling-202308040557" +msgstr "**Important note:** This documentation is valid only for VyOS Sagitta prior to 1.4-rolling-202308040557" + +#: ../../configuration/firewall/general-legacy.rst:9 msgid "**Important note:** This documentation is valid only for VyOS Sagitta prior to 1.4-rolling-YYYYMMDDHHmm" msgstr "**Wichtiger Hinweis: ** Diese Dokumentation ist nur für VyOS Sagitta vor 1.4-Rolling-YYYYMMDDHHMM gültig" @@ -201,7 +205,7 @@ msgstr "**Wichtiger Hinweis: ** Diese Dokumentation ist nur für VyOS Sagitta vo msgid "**Important note about default-actions:** If default action for any chain is not defined, then the default action is set to **accept** for that chain. Only for custom chains, the default action is set to **drop**." msgstr "**Wichtiger Hinweis zu Standardaktionen: ** Wenn die Standardaktion für eine Kette nicht definiert ist, ist die Standardaktion für diese Kette auf ** accept** gesetzt. Nur für benutzerdefinierte Ketten ist die Standardaktion auf **drop** gesetzt." -#: ../../configuration/firewall/general.rst:409 +#: ../../configuration/firewall/general.rst:411 msgid "**Important note about default-actions:** If default action for any chain is not defined, then the default action is set to **drop** for that chain." msgstr "**Important note about default-actions:** If default action for any chain is not defined, then the default action is set to **drop** for that chain." @@ -1340,7 +1344,7 @@ msgstr "A Bridge is a way to connect two Ethernet segments together in a protoco msgid "A GRE tunnel operates at layer 3 of the OSI model and is represented by IP protocol 47. The main benefit of a GRE tunnel is that you are able to carry multiple protocols inside the same tunnel. GRE also supports multicast traffic and supports routing protocols that leverage multicast to form neighbor adjacencies." msgstr "A GRE tunnel operates at layer 3 of the OSI model and is represented by IP protocol 47. The main benefit of a GRE tunnel is that you are able to carry multiple protocols inside the same tunnel. GRE also supports multicast traffic and supports routing protocols that leverage multicast to form neighbor adjacencies." -#: ../../configuration/firewall/general-legacy.rst:746 +#: ../../configuration/firewall/general-legacy.rst:749 msgid "A Rule-Set can be applied to every interface:" msgstr "A Rule-Set can be applied to every interface:" @@ -1368,7 +1372,7 @@ msgstr "A :abbr:`NIS (Network Information Service)` domain can be set to be used msgid "A basic configuration requires a tunnel source (source-address), a tunnel destination (remote), an encapsulation type (gre), and an address (ipv4/ipv6). Below is a basic IPv4 only configuration example taken from a VyOS router and a Cisco IOS router. The main difference between these two configurations is that VyOS requires you explicitly configure the encapsulation type. The Cisco router defaults to GRE IP otherwise it would have to be configured as well." msgstr "A basic configuration requires a tunnel source (source-address), a tunnel destination (remote), an encapsulation type (gre), and an address (ipv4/ipv6). Below is a basic IPv4 only configuration example taken from a VyOS router and a Cisco IOS router. The main difference between these two configurations is that VyOS requires you explicitly configure the encapsulation type. The Cisco router defaults to GRE IP otherwise it would have to be configured as well." -#: ../../configuration/firewall/zone.rst:44 +#: ../../configuration/firewall/zone.rst:54 msgid "A basic introduction to zone-based firewalls can be found `here <https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall>`_, and an example at :ref:`examples-zone-policy`." msgstr "A basic introduction to zone-based firewalls can be found `here <https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall>`_, and an example at :ref:`examples-zone-policy`." @@ -1385,7 +1389,7 @@ msgstr "A class can have multiple match filters:" msgid "A common example is the case of some policies which, in order to be effective, they need to be applied to an interface that is directly connected where the bottleneck is. If your router is not directly connected to the bottleneck, but some hop before it, you can emulate the bottleneck by embedding your non-shaping policy into a classful shaping one so that it takes effect." msgstr "A common example is the case of some policies which, in order to be effective, they need to be applied to an interface that is directly connected where the bottleneck is. If your router is not directly connected to the bottleneck, but some hop before it, you can emulate the bottleneck by embedding your non-shaping policy into a classful shaping one so that it takes effect." -#: ../../configuration/interfaces/openvpn.rst:486 +#: ../../configuration/interfaces/openvpn.rst:538 msgid "A complete LDAP auth OpenVPN configuration could look like the following example:" msgstr "A complete LDAP auth OpenVPN configuration could look like the following example:" @@ -1477,8 +1481,8 @@ msgstr "A physical interface is required to connect this MACsec instance to. Tra msgid "A pool of addresses can be defined by using a hyphen between two IP addresses:" msgstr "A pool of addresses can be defined by using a hyphen between two IP addresses:" -#: ../../configuration/firewall/general.rst:766 -#: ../../configuration/firewall/general-legacy.rst:503 +#: ../../configuration/firewall/general.rst:768 +#: ../../configuration/firewall/general-legacy.rst:506 msgid "A port can be set with a port number or a name which is here defined: ``/etc/services``." msgstr "A port can be set with a port number or a name which is here defined: ``/etc/services``." @@ -1584,7 +1588,7 @@ msgstr "A value of 0 disables ARP monitoring. The default value is 0." msgid "A very small buffer will soon start dropping packets." msgstr "A very small buffer will soon start dropping packets." -#: ../../configuration/firewall/zone.rst:23 +#: ../../configuration/firewall/zone.rst:33 msgid "A zone must be configured before an interface is assigned to it and an interface can be assigned to only a single zone." msgstr "A zone must be configured before an interface is assigned to it and an interface can be assigned to only a single zone." @@ -1713,7 +1717,7 @@ msgstr "Additional global parameters are set, including the maximum number conne msgid "Additional option to run TFTP server in the :abbr:`VRF (Virtual Routing and Forwarding)` context" msgstr "Additional option to run TFTP server in the :abbr:`VRF (Virtual Routing and Forwarding)` context" -#: ../../configuration/interfaces/openvpn.rst:363 +#: ../../configuration/interfaces/openvpn.rst:415 msgid "Additionally, each client needs a copy of ca cert and its own client key and cert files. The files are plaintext so they may be copied either manually from the CLI. Client key and cert files should be signed with the proper ca cert and generated on the server side." msgstr "Additionally, each client needs a copy of ca cert and its own client key and cert files. The files are plaintext so they may be copied either manually from the CLI. Client key and cert files should be signed with the proper ca cert and generated on the server side." @@ -1782,7 +1786,7 @@ msgstr "Advertising a Prefix" msgid "After commit the plaintext passwords will be hashed and stored in your configuration. The resulting CLI config will look like:" msgstr "After commit the plaintext passwords will be hashed and stored in your configuration. The resulting CLI config will look like:" -#: ../../configuration/vrf/index.rst:287 +#: ../../configuration/vrf/index.rst:323 msgid "After committing the configuration we can verify all leaked routes are installed, and try to ICMP ping PC1 from PC3." msgstr "After committing the configuration we can verify all leaked routes are installed, and try to ICMP ping PC1 from PC3." @@ -1854,11 +1858,11 @@ msgstr "All these rules with OTC will help to detect and mitigate route leaks an msgid "All those protocols are grouped under ``interfaces tunnel`` in VyOS. Let's take a closer look at the protocols and options currently supported by VyOS." msgstr "All those protocols are grouped under ``interfaces tunnel`` in VyOS. Let's take a closer look at the protocols and options currently supported by VyOS." -#: ../../configuration/firewall/zone.rst:26 +#: ../../configuration/firewall/zone.rst:36 msgid "All traffic between zones is affected by existing policies" msgstr "All traffic between zones is affected by existing policies" -#: ../../configuration/firewall/zone.rst:25 +#: ../../configuration/firewall/zone.rst:35 msgid "All traffic to and from an interface within a zone is permitted." msgstr "All traffic to and from an interface within a zone is permitted." @@ -1894,8 +1898,8 @@ msgstr "Allow host networking in a container. The network stack of the container msgid "Allow this BFD peer to not be directly connected" msgstr "Allow this BFD peer to not be directly connected" -#: ../../configuration/firewall/general.rst:1142 -#: ../../configuration/firewall/general-legacy.rst:691 +#: ../../configuration/firewall/general.rst:1144 +#: ../../configuration/firewall/general-legacy.rst:694 msgid "Allowed values fpr TCP flags: ``SYN``, ``ACK``, ``FIN``, ``RST``, ``URG``, ``PSH``, ``ALL`` When specifying more than one flag, flags should be comma separated. The ``!`` negate the selected protocol." msgstr "Allowed values fpr TCP flags: ``SYN``, ``ACK``, ``FIN``, ``RST``, ``URG``, ``PSH``, ``ALL`` When specifying more than one flag, flags should be comma separated. The ``!`` negate the selected protocol." @@ -1919,7 +1923,7 @@ msgstr "Allows you to configure the next-hop interface for an interface-based IP msgid "Already learned known_hosts files of clients need an update as the public key will change." msgstr "Already learned known_hosts files of clients need an update as the public key will change." -#: ../../configuration/firewall/general.rst:382 +#: ../../configuration/firewall/general.rst:384 msgid "Also, **default-action** is an action that takes place whenever a packet does not match any rule in it's chain. For base chains, possible options for **default-action** are **accept** or **drop**." msgstr "Also, **default-action** is an action that takes place whenever a packet does not match any rule in it's chain. For base chains, possible options for **default-action** are **accept** or **drop**." @@ -1999,7 +2003,11 @@ msgstr "An alternate command could be \"mpls-te on\" (Traffic Engineering)" msgid "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 and a zone-based firewall as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)" msgstr "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 and a zone-based firewall as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)" -#: ../../configuration/firewall/general.rst:624 +#: ../../configuration/firewall/general-legacy.rst:424 +msgid "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 and a zone-based firewall as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)." +msgstr "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 and a zone-based firewall as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)." + +#: ../../configuration/firewall/general.rst:626 msgid "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)" msgstr "An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particularly useful with IPv6 as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6 address is static (for example, with SLAAC or `tokenised IPv6 addresses <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)" @@ -2074,11 +2082,11 @@ msgstr "Apply a route-map filter to routes for the specified protocol. The follo msgid "Apply routing policy to **inbound** direction of out VLAN interfaces" msgstr "Apply routing policy to **inbound** direction of out VLAN interfaces" -#: ../../configuration/firewall/zone.rst:72 +#: ../../configuration/firewall/zone.rst:82 msgid "Applying a Rule-Set to a Zone" msgstr "Applying a Rule-Set to a Zone" -#: ../../configuration/firewall/general-legacy.rst:744 +#: ../../configuration/firewall/general-legacy.rst:747 msgid "Applying a Rule-Set to an Interface" msgstr "Applying a Rule-Set to an Interface" @@ -2173,11 +2181,11 @@ msgstr "As VyOS makes use of the QMI interface to connect to the WWAN modem card msgid "As a reference: for 10mbit/s on Intel, you might need at least 10kbyte buffer if you want to reach your configured rate." msgstr "As a reference: for 10mbit/s on Intel, you might need at least 10kbyte buffer if you want to reach your configured rate." -#: ../../configuration/interfaces/openvpn.rst:614 +#: ../../configuration/interfaces/openvpn.rst:666 msgid "As a result, the processing of each packet becomes more efficient, potentially leveraging hardware encryption offloading support available in the kernel." msgstr "As a result, the processing of each packet becomes more efficient, potentially leveraging hardware encryption offloading support available in the kernel." -#: ../../configuration/firewall/zone.rst:39 +#: ../../configuration/firewall/zone.rst:49 msgid "As an alternative to applying policy to an interface directly, a zone-based firewall can be created to simplify configuration when multiple interfaces belong to the same security zone. Instead of applying rule-sets to interfaces, they are applied to source zone-destination zone pairs." msgstr "As an alternative to applying policy to an interface directly, a zone-based firewall can be created to simplify configuration when multiple interfaces belong to the same security zone. Instead of applying rule-sets to interfaces, they are applied to source zone-destination zone pairs." @@ -2189,6 +2197,10 @@ msgstr "As more and more routers run on Hypervisors, expecially with a :abbr:`NO msgid "As network address translation modifies the IP address information in packets, NAT implementations may vary in their specific behavior in various addressing cases and their effect on network traffic. The specifics of NAT behavior are not commonly documented by vendors of equipment containing NAT implementations." msgstr "As network address translation modifies the IP address information in packets, NAT implementations may vary in their specific behavior in various addressing cases and their effect on network traffic. The specifics of NAT behavior are not commonly documented by vendors of equipment containing NAT implementations." +#: ../../configuration/interfaces/openvpn.rst:48 +msgid "As of VyOS 1.4, OpenVPN site-to-site mode can use either pre-shared keys or x.509 certificates." +msgstr "As of VyOS 1.4, OpenVPN site-to-site mode can use either pre-shared keys or x.509 certificates." + #: ../../configuration/vpn/pptp.rst:10 msgid "As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption. If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1." msgstr "As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption. If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1." @@ -2229,7 +2241,7 @@ msgstr "As with other policies, you can embed_ other policies into the classes ( msgid "As you can see, Leaf2 and Leaf3 configuration is almost identical. There are lots of commands above, I'll try to into more detail below, command descriptions are placed under the command boxes:" msgstr "As you can see, Leaf2 and Leaf3 configuration is almost identical. There are lots of commands above, I'll try to into more detail below, command descriptions are placed under the command boxes:" -#: ../../configuration/firewall/general-legacy.rst:767 +#: ../../configuration/firewall/general-legacy.rst:770 msgid "As you can see in the example here, you can assign the same rule-set to several interfaces. An interface can only have one rule-set per chain." msgstr "As you can see in the example here, you can assign the same rule-set to several interfaces. An interface can only have one rule-set per chain." @@ -2321,8 +2333,8 @@ msgstr "Assured Forwarding(AF) 43" msgid "At every round, the deficit counter adds the quantum so that even large packets will have their opportunity to be dequeued." msgstr "At every round, the deficit counter adds the quantum so that even large packets will have their opportunity to be dequeued." -#: ../../configuration/firewall/general.rst:1451 -#: ../../configuration/firewall/general-legacy.rst:969 +#: ../../configuration/firewall/general.rst:1496 +#: ../../configuration/firewall/general-legacy.rst:972 msgid "At the moment it not possible to look at the whole firewall log with VyOS operational commands. All logs will save to ``/var/logs/messages``. For example: ``grep '10.10.0.10' /var/log/messages``" msgstr "At the moment it not possible to look at the whole firewall log with VyOS operational commands. All logs will save to ``/var/logs/messages``. For example: ``grep '10.10.0.10' /var/log/messages``" @@ -2358,7 +2370,7 @@ msgstr "Authentication application client-secret." msgid "Authentication application tenant-id" msgstr "Authentication application tenant-id" -#: ../../configuration/interfaces/openvpn.rst:397 +#: ../../configuration/interfaces/openvpn.rst:449 msgid "Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is shipped with every VyOS installation. A dedicated configuration file is required. It is best practise to store it in ``/config`` to survive image updates" msgstr "Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is shipped with every VyOS installation. A dedicated configuration file is required. It is best practise to store it in ``/config`` to survive image updates" @@ -2474,7 +2486,7 @@ msgstr "BGP roles are defined in RFC :rfc:`9234` and provide an easy way to add msgid "BGP routers connected inside the same AS through BGP belong to an internal BGP session, or IBGP. In order to prevent routing table loops, IBGP speaker does not advertise IBGP-learned routes to other IBGP speaker (Split Horizon mechanism). As such, IBGP requires a full mesh of all peers. For large networks, this quickly becomes unscalable." msgstr "BGP routers connected inside the same AS through BGP belong to an internal BGP session, or IBGP. In order to prevent routing table loops, IBGP speaker does not advertise IBGP-learned routes to other IBGP speaker (Split Horizon mechanism). As such, IBGP requires a full mesh of all peers. For large networks, this quickly becomes unscalable." -#: ../../configuration/vrf/index.rst:375 +#: ../../configuration/vrf/index.rst:411 msgid "BGP routes may be leaked (i.e. copied) between a unicast VRF RIB and the VPN SAFI RIB of the default VRF for use in MPLS-based L3VPNs. Unicast routes may also be leaked between any VRFs (including the unicast RIB of the default BGP instance). A shortcut syntax is also available for specifying leaking from one VRF to another VRF using the default instance’s VPN RIB as the intemediary . A common application of the VRF-VRF feature is to connect a customer’s private routing domain to a provider’s VPN service. Leaking is configured from the point of view of an individual VRF: import refers to routes leaked from VPN to a unicast VRF, whereas export refers to routes leaked from a unicast VRF to VPN." msgstr "BGP routes may be leaked (i.e. copied) between a unicast VRF RIB and the VPN SAFI RIB of the default VRF for use in MPLS-based L3VPNs. Unicast routes may also be leaked between any VRFs (including the unicast RIB of the default BGP instance). A shortcut syntax is also available for specifying leaking from one VRF to another VRF using the default instance’s VPN RIB as the intemediary . A common application of the VRF-VRF feature is to connect a customer’s private routing domain to a provider’s VPN service. Leaking is configured from the point of view of an individual VRF: import refers to routes leaked from VPN to a unicast VRF, whereas export refers to routes leaked from a unicast VRF to VPN." @@ -2575,7 +2587,7 @@ msgstr "Because existing sessions do not automatically fail over to a new path, msgid "Before enabling any hardware segmentation offload a corresponding software offload is required in GSO. Otherwise it becomes possible for a frame to be re-routed between devices and end up being unable to be transmitted." msgstr "Before enabling any hardware segmentation offload a corresponding software offload is required in GSO. Otherwise it becomes possible for a frame to be re-routed between devices and end up being unable to be transmitted." -#: ../../configuration/firewall/zone.rst:74 +#: ../../configuration/firewall/zone.rst:84 msgid "Before you are able to apply a rule-set to a zone you have to create the zones first." msgstr "Before you are able to apply a rule-set to a zone you have to create the zones first." @@ -2678,7 +2690,7 @@ msgstr "Both local administered and remote administered :abbr:`RADIUS (Remote Au msgid "Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on." msgstr "Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on." -#: ../../configuration/interfaces/openvpn.rst:376 +#: ../../configuration/interfaces/openvpn.rst:428 msgid "Branch 1's router might have the following lines:" msgstr "Branch 1's router might have the following lines:" @@ -2820,7 +2832,7 @@ msgstr "Certificates" msgid "Change system keyboard layout to given language." msgstr "Change system keyboard layout to given language." -#: ../../configuration/firewall/zone.rst:65 +#: ../../configuration/firewall/zone.rst:75 msgid "Change the default-action with this setting." msgstr "Change the default-action with this setting." @@ -2844,7 +2856,7 @@ msgstr "Channel number (IEEE 802.11), for 2.4Ghz (802.11 b/g/n) channels range f msgid "Check if the Intel® QAT device is up and ready to do the job." msgstr "Check if the Intel® QAT device is up and ready to do the job." -#: ../../configuration/interfaces/openvpn.rst:654 +#: ../../configuration/interfaces/openvpn.rst:706 msgid "Check status" msgstr "Check status" @@ -2907,7 +2919,7 @@ msgstr "Classless static route" msgid "Clear all BGP extcommunities." msgstr "Clear all BGP extcommunities." -#: ../../configuration/interfaces/openvpn.rst:519 +#: ../../configuration/interfaces/openvpn.rst:571 msgid "Client" msgstr "Client" @@ -2927,7 +2939,7 @@ msgstr "Client Authentication" msgid "Client IP addresses will be provided from pool `192.0.2.0/25`" msgstr "Client IP addresses will be provided from pool `192.0.2.0/25`" -#: ../../configuration/interfaces/openvpn.rst:562 +#: ../../configuration/interfaces/openvpn.rst:614 msgid "Client Side" msgstr "Client Side" @@ -2947,7 +2959,7 @@ msgstr "Client domain search" msgid "Client isolation can be used to prevent low-level bridging of frames between associated stations in the BSS." msgstr "Client isolation can be used to prevent low-level bridging of frames between associated stations in the BSS." -#: ../../configuration/interfaces/openvpn.rst:347 +#: ../../configuration/interfaces/openvpn.rst:399 msgid "Clients are identified by the CN field of their x.509 certificates, in this example the CN is ``client0``:" msgstr "Clients are identified by the CN field of their x.509 certificates, in this example the CN is ``client0``:" @@ -2963,7 +2975,7 @@ msgstr "Clock daemon" msgid "Command completion can be used to list available time zones. The adjustment for daylight time will take place automatically based on the time of year." msgstr "Command completion can be used to list available time zones. The adjustment for daylight time will take place automatically based on the time of year." -#: ../../configuration/firewall/general.rst:535 +#: ../../configuration/firewall/general.rst:537 msgid "Command for disabling a rule but keep it in the configuration." msgstr "Command for disabling a rule but keep it in the configuration." @@ -2971,8 +2983,8 @@ msgstr "Command for disabling a rule but keep it in the configuration." msgid "Command should probably be extended to list also the real interfaces assigned to this one VRF to get a better overview." msgstr "Command should probably be extended to list also the real interfaces assigned to this one VRF to get a better overview." -#: ../../configuration/firewall/general.rst:1506 -#: ../../configuration/firewall/general-legacy.rst:1051 +#: ../../configuration/firewall/general.rst:1551 +#: ../../configuration/firewall/general-legacy.rst:1054 msgid "Command used to update GeoIP database and firewall sets." msgstr "Command used to update GeoIP database and firewall sets." @@ -3012,7 +3024,7 @@ msgid "Confidentiality – Encryption of packets to prevent snooping by an unaut msgstr "Confidentiality – Encryption of packets to prevent snooping by an unauthorized source." #: ../../configuration/container/index.rst:12 -#: ../../configuration/firewall/zone.rst:37 +#: ../../configuration/firewall/zone.rst:47 #: ../../configuration/interfaces/bonding.rst:17 #: ../../configuration/interfaces/bridge.rst:21 #: ../../configuration/interfaces/dummy.rst:28 @@ -3021,7 +3033,6 @@ msgstr "Confidentiality – Encryption of packets to prevent snooping by an unau #: ../../configuration/interfaces/l2tpv3.rst:31 #: ../../configuration/interfaces/loopback.rst:26 #: ../../configuration/interfaces/macsec.rst:20 -#: ../../configuration/interfaces/openvpn.rst:533 #: ../../configuration/interfaces/pppoe.rst:59 #: ../../configuration/interfaces/pseudo-ethernet.rst:45 #: ../../configuration/interfaces/sstp-client.rst:20 @@ -3078,7 +3089,8 @@ msgstr "Confidentiality – Encryption of packets to prevent snooping by an unau #: ../../configuration/vpn/sstp.rst:65 #: ../../configuration/vrf/index.rst:16 #: ../../configuration/vrf/index.rst:253 -#: ../../configuration/vrf/index.rst:398 +#: ../../configuration/vrf/index.rst:286 +#: ../../configuration/vrf/index.rst:434 msgid "Configuration" msgstr "Configuration" @@ -3111,7 +3123,7 @@ msgstr "Configuration commands for the private and public key will be displayed msgid "Configuration commands will display. Note the command with the public key (set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'). Then do the same on the opposite router:" msgstr "Configuration commands will display. Note the command with the public key (set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'). Then do the same on the opposite router:" -#: ../../configuration/vrf/index.rst:392 +#: ../../configuration/vrf/index.rst:428 msgid "Configuration for these exported routes must, at a minimum, specify these two parameters." msgstr "Configuration for these exported routes must, at a minimum, specify these two parameters." @@ -3123,7 +3135,7 @@ msgstr "Configuration of :ref:`routing-static`" msgid "Configuration of a DHCP failover pair" msgstr "Configuration of a DHCP failover pair" -#: ../../configuration/vrf/index.rst:400 +#: ../../configuration/vrf/index.rst:436 msgid "Configuration of route leaking between a unicast VRF RIB and the VPN SAFI RIB of the default VRF is accomplished via commands in the context of a VRF address-family." msgstr "Configuration of route leaking between a unicast VRF RIB and the VPN SAFI RIB of the default VRF is accomplished via commands in the context of a VRF address-family." @@ -3744,11 +3756,11 @@ msgstr "Custom health-check script allows checking real-server availability" msgid "Customized ignore rules, based on a packet and flow selector." msgstr "Customized ignore rules, based on a packet and flow selector." -#: ../../configuration/interfaces/openvpn.rst:633 +#: ../../configuration/interfaces/openvpn.rst:685 msgid "DCO can be enabled for both new and existing tunnels,VyOS adds an option in each tunnel configuration where we can enable this function .The current best practice is to create a new tunnel with DCO to minimize the chance of problems with existing clients." msgstr "DCO can be enabled for both new and existing tunnels,VyOS adds an option in each tunnel configuration where we can enable this function .The current best practice is to create a new tunnel with DCO to minimize the chance of problems with existing clients." -#: ../../configuration/interfaces/openvpn.rst:629 +#: ../../configuration/interfaces/openvpn.rst:681 msgid "DCO support is a per-tunnel option and it is not automatically enabled by default for new or upgraded tunnels. Existing tunnels will continue to function as they have in the past." msgstr "DCO support is a per-tunnel option and it is not automatically enabled by default for new or upgraded tunnels. Existing tunnels will continue to function as they have in the past." @@ -3863,8 +3875,8 @@ msgstr "DSCP values as per :rfc:`2474` and :rfc:`4595`:" msgid "DSSS/CCK Mode in 40 MHz, this sets ``[DSSS_CCK-40]``" msgstr "DSSS/CCK Mode in 40 MHz, this sets ``[DSSS_CCK-40]``" -#: ../../configuration/firewall/general.rst:719 -#: ../../configuration/firewall/general-legacy.rst:477 +#: ../../configuration/firewall/general.rst:721 +#: ../../configuration/firewall/general-legacy.rst:480 msgid "Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, permits redistribution so we can include a database in images(~3MB compressed). Includes cron script (manually callable by op-mode update geoip) to keep database and rules updated." msgstr "Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, permits redistribution so we can include a database in images(~3MB compressed). Includes cron script (manually callable by op-mode update geoip) to keep database and rules updated." @@ -3992,7 +4004,7 @@ msgstr "Define a IPv4 or IPv6 Network group." msgid "Define a IPv4 or a IPv6 address group" msgstr "Define a IPv4 or a IPv6 address group" -#: ../../configuration/firewall/zone.rst:49 +#: ../../configuration/firewall/zone.rst:59 msgid "Define a Zone" msgstr "Define a Zone" @@ -4115,22 +4127,22 @@ msgstr "Define different modes for sending replies in response to received ARP r msgid "Define different restriction levels for announcing the local source IP address from IP packets in ARP requests sent on interface." msgstr "Define different restriction levels for announcing the local source IP address from IP packets in ARP requests sent on interface." -#: ../../configuration/firewall/general.rst:481 +#: ../../configuration/firewall/general.rst:483 #: ../../configuration/firewall/general-legacy.rst:361 msgid "Define length of packet payload to include in netlink message. Only applicable if rule log is enable and log group is defined." msgstr "Define length of packet payload to include in netlink message. Only applicable if rule log is enable and log group is defined." -#: ../../configuration/firewall/general.rst:455 +#: ../../configuration/firewall/general.rst:457 #: ../../configuration/firewall/general-legacy.rst:347 msgid "Define log-level. Only applicable if rule log is enable." msgstr "Define log-level. Only applicable if rule log is enable." -#: ../../configuration/firewall/general.rst:468 +#: ../../configuration/firewall/general.rst:470 #: ../../configuration/firewall/general-legacy.rst:354 msgid "Define log group to send message to. Only applicable if rule log is enable." msgstr "Define log group to send message to. Only applicable if rule log is enable." -#: ../../configuration/firewall/general.rst:495 +#: ../../configuration/firewall/general.rst:497 #: ../../configuration/firewall/general-legacy.rst:369 msgid "Define number of packets to queue inside the kernel before sending them to userspace. Only applicable if rule log is enable and log group is defined." msgstr "Define number of packets to queue inside the kernel before sending them to userspace. Only applicable if rule log is enable and log group is defined." @@ -4139,7 +4151,7 @@ msgstr "Define number of packets to queue inside the kernel before sending them msgid "Define the time interval to update the local cache" msgstr "Define the time interval to update the local cache" -#: ../../configuration/firewall/zone.rst:60 +#: ../../configuration/firewall/zone.rst:70 msgid "Define the zone as a local zone. A local zone has no interfaces and will be applied to the router itself." msgstr "Define the zone as a local zone. A local zone has no interfaces and will be applied to the router itself." @@ -4231,7 +4243,7 @@ msgstr "Description" msgid "Despite the Drop-Tail policy does not slow down packets, if many packets are to be sent, they could get dropped when trying to get enqueued at the tail. This can happen if the queue has still not been able to release enough packets from its head." msgstr "Despite the Drop-Tail policy does not slow down packets, if many packets are to be sent, they could get dropped when trying to get enqueued at the tail. This can happen if the queue has still not been able to release enough packets from its head." -#: ../../configuration/interfaces/openvpn.rst:433 +#: ../../configuration/interfaces/openvpn.rst:485 msgid "Despite the fact that AD is a superset of LDAP" msgstr "Despite the fact that AD is a superset of LDAP" @@ -4288,6 +4300,10 @@ msgstr "Disable a BFD peer" msgid "Disable a container." msgstr "Disable a container." +#: ../../configuration/firewall/general.rst:1290 +msgid "Disable conntrack loose track option" +msgstr "Disable conntrack loose track option" + #: ../../configuration/service/dhcp-relay.rst:50 msgid "Disable dhcp-relay service." msgstr "Disable dhcp-relay service." @@ -4355,7 +4371,7 @@ msgstr "Disable this service." msgid "Disable transmit of LLDP frames on given `<interface>`. Useful to exclude certain interfaces from LLDP when ``all`` have been enabled." msgstr "Disable transmit of LLDP frames on given `<interface>`. Useful to exclude certain interfaces from LLDP when ``all`` have been enabled." -#: ../../configuration/interfaces/openvpn.rst:643 +#: ../../configuration/interfaces/openvpn.rst:695 msgid "Disabled by default - no kernel module loaded." msgstr "Disabled by default - no kernel module loaded." @@ -4809,7 +4825,7 @@ msgstr "Enable OSPF with route redistribution of the loopback and default origin msgid "Enable OTP 2FA for user `username` with default settings, using the BASE32 encoded 2FA/MFA key specified by `<key>`." msgstr "Enable OTP 2FA for user `username` with default settings, using the BASE32 encoded 2FA/MFA key specified by `<key>`." -#: ../../configuration/interfaces/openvpn.rst:640 +#: ../../configuration/interfaces/openvpn.rst:692 msgid "Enable OpenVPN Data Channel Offload feature by loading the appropriate kernel module." msgstr "Enable OpenVPN Data Channel Offload feature by loading the appropriate kernel module." @@ -4860,7 +4876,7 @@ msgstr "Enable or Disable VyOS to be :rfc:`1337` conform. The following system p msgid "Enable or Disable if VyOS use IPv4 TCP SYN Cookies. The following system parameter will be altered:" msgstr "Enable or Disable if VyOS use IPv4 TCP SYN Cookies. The following system parameter will be altered:" -#: ../../configuration/firewall/general.rst:431 +#: ../../configuration/firewall/general.rst:433 #: ../../configuration/firewall/general-legacy.rst:340 msgid "Enable or disable logging for the matched packet." msgstr "Enable or disable logging for the matched packet." @@ -4920,7 +4936,7 @@ msgstr "Enable spanning tree protocol. STP is disabled by default." msgid "Enable the Opaque-LSA capability (rfc2370), necessary to transport label on IGP" msgstr "Enable the Opaque-LSA capability (rfc2370), necessary to transport label on IGP" -#: ../../configuration/interfaces/openvpn.rst:645 +#: ../../configuration/interfaces/openvpn.rst:697 msgid "Enable this feature causes an interface reset." msgstr "Enable this feature causes an interface reset." @@ -4936,7 +4952,7 @@ msgstr "Enabled on-demand PPPoE connections bring up the link only when traffic msgid "Enables Cisco style authentication on NHRP packets. This embeds the secret plaintext password to the outgoing NHRP packets. Incoming NHRP packets on this interface are discarded unless the secret password is present. Maximum length of the secret is 8 characters." msgstr "Enables Cisco style authentication on NHRP packets. This embeds the secret plaintext password to the outgoing NHRP packets. Incoming NHRP packets on this interface are discarded unless the secret password is present. Maximum length of the secret is 8 characters." -#: ../../configuration/vrf/index.rst:423 +#: ../../configuration/vrf/index.rst:459 msgid "Enables an MPLS label to be attached to a route exported from the current unicast VRF to VPN. If the value specified is auto, the label value is automatically assigned from a pool maintained." msgstr "Enables an MPLS label to be attached to a route exported from the current unicast VRF to VPN. If the value specified is auto, the label value is automatically assigned from a pool maintained." @@ -4944,7 +4960,7 @@ msgstr "Enables an MPLS label to be attached to a route exported from the curren msgid "Enables bandwidth shaping via RADIUS." msgstr "Enables bandwidth shaping via RADIUS." -#: ../../configuration/vrf/index.rst:445 +#: ../../configuration/vrf/index.rst:481 msgid "Enables import or export of routes between the current unicast VRF and VPN." msgstr "Enables import or export of routes between the current unicast VRF and VPN." @@ -4980,7 +4996,7 @@ msgstr "Enslave `<member>` interface to bond `<interface>`." msgid "Ensure that when comparing routes where both are equal on most metrics, including local-pref, AS_PATH length, IGP cost, MED, that the tie is broken based on router-ID." msgstr "Ensure that when comparing routes where both are equal on most metrics, including local-pref, AS_PATH length, IGP cost, MED, that the tie is broken based on router-ID." -#: ../../configuration/interfaces/openvpn.rst:393 +#: ../../configuration/interfaces/openvpn.rst:445 msgid "Enterprise installations usually ship a kind of directory service which is used to have a single password store for all employees. VyOS and OpenVPN support using LDAP/AD as single user backend." msgstr "Enterprise installations usually ship a kind of directory service which is used to have a single password store for all employees. VyOS and OpenVPN support using LDAP/AD as single user backend." @@ -5707,8 +5723,8 @@ msgstr "Example IPv6 only:" msgid "Example Network" msgstr "Example Network" -#: ../../configuration/firewall/general.rst:1457 -#: ../../configuration/firewall/general-legacy.rst:976 +#: ../../configuration/firewall/general.rst:1502 +#: ../../configuration/firewall/general-legacy.rst:979 msgid "Example Partial Config" msgstr "Example Partial Config" @@ -5728,6 +5744,10 @@ msgstr "Example for configuring a simple L2TP over IPsec VPN for remote access ( msgid "Example of redirection:" msgstr "Example of redirection:" +#: ../../configuration/firewall/general.rst:1285 +msgid "Example synproxy" +msgstr "Example synproxy" + #: ../../configuration/interfaces/bridge.rst:187 #: ../../configuration/interfaces/macsec.rst:153 #: ../../configuration/interfaces/wireless.rst:541 @@ -5909,16 +5929,16 @@ msgstr "Firewall" msgid "Firewall-Legacy" msgstr "Firewall-Legacy" -#: ../../configuration/firewall/general.rst:500 +#: ../../configuration/firewall/general.rst:502 msgid "Firewall Description" msgstr "Firewall Description" -#: ../../configuration/interfaces/openvpn.rst:157 +#: ../../configuration/interfaces/openvpn.rst:209 #: ../../configuration/interfaces/wireguard.rst:207 msgid "Firewall Exceptions" msgstr "Firewall Exceptions" -#: ../../configuration/firewall/general.rst:415 +#: ../../configuration/firewall/general.rst:417 msgid "Firewall Logs" msgstr "Firewall Logs" @@ -5938,7 +5958,7 @@ msgstr "Firewall groups represent collections of IP addresses, networks, ports, msgid "Firewall mark. It possible to loadbalancing traffic based on ``fwmark`` value" msgstr "Firewall mark. It possible to loadbalancing traffic based on ``fwmark`` value" -#: ../../configuration/interfaces/openvpn.rst:259 +#: ../../configuration/interfaces/openvpn.rst:311 msgid "Firewall policy can also be applied to the tunnel interface for `local`, `in`, and `out` directions and functions identically to ethernet interfaces." msgstr "Firewall policy can also be applied to the tunnel interface for `local`, `in`, and `out` directions and functions identically to ethernet interfaces." @@ -5962,6 +5982,10 @@ msgstr "First, on both routers run the operational command \"generate pki key-pa msgid "First, one of the systems generate the key using the :ref:`generate pki openvpn shared-secret<configuration/pki/index:pki>` command. Once generated, you will need to install this key on the local system, then copy and install this key to the remote router." msgstr "First, one of the systems generate the key using the :ref:`generate pki openvpn shared-secret<configuration/pki/index:pki>` command. Once generated, you will need to install this key on the local system, then copy and install this key to the remote router." +#: ../../configuration/interfaces/openvpn.rst:176 +msgid "First, you need to generate a key by running ``run generate pki openvpn shared-secret install <name>`` from configuration mode. You can use any name, we will use ``s2s``." +msgstr "First, you need to generate a key by running ``run generate pki openvpn shared-secret install <name>`` from configuration mode. You can use any name, we will use ``s2s``." + #: ../../configuration/policy/route-map.rst:60 msgid "First hop interface of a route to match." msgstr "First hop interface of a route to match." @@ -5982,7 +6006,7 @@ msgstr "First steps" msgid "First the OTP keys must be generated and sent to the user and to the configuration:" msgstr "First the OTP keys must be generated and sent to the user and to the configuration:" -#: ../../configuration/interfaces/openvpn.rst:290 +#: ../../configuration/interfaces/openvpn.rst:342 msgid "First we need to specify the basic settings. 1194/UDP is the default. The ``persistent-tunnel`` option is recommended, it prevents the TUN/TAP device from closing on connection resets or daemon reloads." msgstr "First we need to specify the basic settings. 1194/UDP is the default. The ``persistent-tunnel`` option is recommended, it prevents the TUN/TAP device from closing on connection resets or daemon reloads." @@ -6026,11 +6050,11 @@ msgstr "Follow the instructions to generate CA cert (in configuration mode):" msgid "Follow the instructions to generate server cert (in configuration mode):" msgstr "Follow the instructions to generate server cert (in configuration mode):" -#: ../../configuration/interfaces/openvpn.rst:206 +#: ../../configuration/interfaces/openvpn.rst:258 msgid "For Encryption:" msgstr "For Encryption:" -#: ../../configuration/interfaces/openvpn.rst:243 +#: ../../configuration/interfaces/openvpn.rst:295 msgid "For Hashing:" msgstr "For Hashing:" @@ -6126,6 +6150,10 @@ msgstr "For ipv4:" msgid "For latest releases, refer the `firewall <https://docs.vyos.io/en/latest/configuration/firewall/general.html#interface-groups>`_ main page to configure zone based rules. New syntax was introduced here :vytask:`T5160`" msgstr "For latest releases, refer the `firewall <https://docs.vyos.io/en/latest/configuration/firewall/general.html#interface-groups>`_ main page to configure zone based rules. New syntax was introduced here :vytask:`T5160`" +#: ../../configuration/firewall/zone.rst:19 +msgid "For latest releases, refer the `firewall (interface-groups) <https://docs.vyos.io/en/latest/configuration/firewall/general.html#interface-groups>`_ main page to configure zone based rules. New syntax was introduced here :vytask:`T5160`" +msgstr "For latest releases, refer the `firewall (interface-groups) <https://docs.vyos.io/en/latest/configuration/firewall/general.html#interface-groups>`_ main page to configure zone based rules. New syntax was introduced here :vytask:`T5160`" + #: ../../configuration/protocols/mpls.rst:27 msgid "For more information on how MPLS label switching works, please go visit `Wikipedia (MPLS)`_." msgstr "For more information on how MPLS label switching works, please go visit `Wikipedia (MPLS)`_." @@ -6142,7 +6170,7 @@ msgstr "For optimal scalability, Multicast shouldn't be used at all, but instead msgid "For outbound updates the order of preference is:" msgstr "For outbound updates the order of preference is:" -#: ../../configuration/firewall/general.rst:502 +#: ../../configuration/firewall/general.rst:504 msgid "For reference, a description can be defined for every single rule, and for every defined custom chain." msgstr "For reference, a description can be defined for every single rule, and for every defined custom chain." @@ -6158,7 +6186,7 @@ msgstr "For serial via USB port information please refor to: :ref:`hardware_usb` msgid "For simplicity we'll assume that the protocol is GRE, it's not hard to guess what needs to be changed to make it work with a different protocol. We assume that IPsec will use pre-shared secret authentication and will use AES128/SHA1 for the cipher and hash. Adjust this as necessary." msgstr "For simplicity we'll assume that the protocol is GRE, it's not hard to guess what needs to be changed to make it work with a different protocol. We assume that IPsec will use pre-shared secret authentication and will use AES128/SHA1 for the cipher and hash. Adjust this as necessary." -#: ../../configuration/interfaces/openvpn.rst:159 +#: ../../configuration/interfaces/openvpn.rst:211 msgid "For the OpenVPN traffic to pass through the WAN interface, you must create a firewall exception." msgstr "For the OpenVPN traffic to pass through the WAN interface, you must create a firewall exception." @@ -6339,7 +6367,7 @@ msgstr "Getting started" msgid "Given the fact that open DNS recursors could be used on DDoS amplification attacks, you must configure the networks which are allowed to use this recursor. A network of ``0.0.0.0/0`` or ``::/0`` would allow all IPv4 and IPv6 networks to query this server. This is generally a bad idea." msgstr "Given the fact that open DNS recursors could be used on DDoS amplification attacks, you must configure the networks which are allowed to use this recursor. A network of ``0.0.0.0/0`` or ``::/0`` would allow all IPv4 and IPv6 networks to query this server. This is generally a bad idea." -#: ../../configuration/interfaces/openvpn.rst:525 +#: ../../configuration/interfaces/openvpn.rst:577 msgid "Given the following example we have one VyOS router acting as OpenVPN server and another VyOS router acting as OpenVPN client. The server also pushes a static client IP address to the OpenVPN client. Remember, clients are identified using their CN attribute in the SSL certificate." msgstr "Given the following example we have one VyOS router acting as OpenVPN server and another VyOS router acting as OpenVPN client. The server also pushes a static client IP address to the OpenVPN client. Remember, clients are identified using their CN attribute in the SSL certificate." @@ -6381,7 +6409,7 @@ msgstr "Groups" msgid "Groups need to have unique names. Even though some contain IPv4 addresses and others contain IPv6 addresses, they still need to have unique names, so you may want to append \"-v4\" or \"-v6\" to your group names." msgstr "Groups need to have unique names. Even though some contain IPv4 addresses and others contain IPv6 addresses, they still need to have unique names, so you may want to append \"-v4\" or \"-v6\" to your group names." -#: ../../configuration/interfaces/openvpn.rst:368 +#: ../../configuration/interfaces/openvpn.rst:420 msgid "HQ's router requires the following steps to generate crypto materials for the Branch 1:" msgstr "HQ's router requires the following steps to generate crypto materials for the Branch 1:" @@ -6454,7 +6482,7 @@ msgstr "Here's the neighbors up:" msgid "Here's the routes:" msgstr "Here's the routes:" -#: ../../configuration/firewall/general-legacy.rst:756 +#: ../../configuration/firewall/general-legacy.rst:759 msgid "Here are some examples for applying a rule-set to an interface" msgstr "Here are some examples for applying a rule-set to an interface" @@ -6555,6 +6583,10 @@ msgstr "How to make it work" msgid "However, now you need to make IPsec work with dynamic address on one side. The tricky part is that pre-shared secret authentication doesn't work with dynamic address, so we'll have to use RSA keys." msgstr "However, now you need to make IPsec work with dynamic address on one side. The tricky part is that pre-shared secret authentication doesn't work with dynamic address, so we'll have to use RSA keys." +#: ../../configuration/interfaces/openvpn.rst:80 +msgid "However, since VyOS 1.4, it is possible to verify self-signed certificates using certificate fingerprints." +msgstr "However, since VyOS 1.4, it is possible to verify self-signed certificates using certificate fingerprints." + #: ../../configuration/interfaces/wireguard.rst:319 msgid "However, split-tunneling can be achieved by specifying the remote subnets. This ensures that only traffic destined for the remote site is sent over the tunnel. All other traffic is unaffected." msgstr "However, split-tunneling can be achieved by specifying the remote subnets. This ensures that only traffic destined for the remote site is sent over the tunnel. All other traffic is unaffected." @@ -7072,7 +7104,7 @@ msgstr "If guaranteed traffic for a class is met and there is room for more traf msgid "If it's vital that the daemon should act exactly like a real multicast client on the upstream interface, this function should be enabled." msgstr "If it's vital that the daemon should act exactly like a real multicast client on the upstream interface, this function should be enabled." -#: ../../configuration/interfaces/openvpn.rst:72 +#: ../../configuration/interfaces/openvpn.rst:69 msgid "If known, the IP of the remote router can be configured using the ``remote-host`` directive; if unknown, it can be omitted. We will assume a dynamic IP for our remote router." msgstr "If known, the IP of the remote router can be configured using the ``remote-host`` directive; if unknown, it can be omitted. We will assume a dynamic IP for our remote router." @@ -7080,7 +7112,7 @@ msgstr "If known, the IP of the remote router can be configured using the ``remo msgid "If logging to a local user account is configured, all defined log messages are display on the console if the local user is logged in, if the user is not logged in, no messages are being displayed. For an explanation on :ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see tables below." msgstr "If logging to a local user account is configured, all defined log messages are display on the console if the local user is logged in, if the user is not logged in, no messages are being displayed. For an explanation on :ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see tables below." -#: ../../configuration/interfaces/openvpn.rst:262 +#: ../../configuration/interfaces/openvpn.rst:314 msgid "If making use of multiple tunnels, OpenVPN must have a way to distinguish between different tunnels aside from the pre-shared-key. This is either by referencing IP address or port number. One option is to dedicate a public IP to each tunnel. Another option is to dedicate a port number to each tunnel (e.g. 1195,1196,1197...)." msgstr "If making use of multiple tunnels, OpenVPN must have a way to distinguish between different tunnels aside from the pre-shared-key. This is either by referencing IP address or port number. One option is to dedicate a public IP to each tunnel. Another option is to dedicate a port number to each tunnel (e.g. 1195,1196,1197...)." @@ -7329,7 +7361,7 @@ msgstr "If you've completed all the above steps you no doubt want to see if it's msgid "If you apply a parameter to an individual neighbor IP address, you override the action defined for a peer group that includes that IP address." msgstr "If you apply a parameter to an individual neighbor IP address, you override the action defined for a peer group that includes that IP address." -#: ../../configuration/interfaces/openvpn.rst:585 +#: ../../configuration/interfaces/openvpn.rst:637 msgid "If you are a hacker or want to try on your own we support passing raw OpenVPN options to OpenVPN." msgstr "If you are a hacker or want to try on your own we support passing raw OpenVPN options to OpenVPN." @@ -7353,7 +7385,7 @@ msgstr "If you are using FQ-CoDel embedded into Shaper_ and you have large rates msgid "If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface." msgstr "If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface." -#: ../../configuration/interfaces/openvpn.rst:254 +#: ../../configuration/interfaces/openvpn.rst:306 msgid "If you change the default encryption and hashing algorithms, be sure that the local and remote ends have matching configurations, otherwise the tunnel will not come up." msgstr "If you change the default encryption and hashing algorithms, be sure that the local and remote ends have matching configurations, otherwise the tunnel will not come up." @@ -7396,7 +7428,7 @@ msgstr "If you have configured the `INSIDE-OUT` policy, you will need to add add msgid "If you need to sample also egress traffic, you may want to configure egress flow-accounting:" msgstr "If you need to sample also egress traffic, you may want to configure egress flow-accounting:" -#: ../../configuration/interfaces/openvpn.rst:466 +#: ../../configuration/interfaces/openvpn.rst:518 msgid "If you only want to check if the user account is enabled and can authenticate (against the primary group) the following snipped is sufficient:" msgstr "If you only want to check if the user account is enabled and can authenticate (against the primary group) the following snipped is sufficient:" @@ -7501,7 +7533,7 @@ msgstr "In VyOS the terms ``vif-s`` and ``vif-c`` stand for the ethertype tags t msgid "In :rfc:`3069` it is called VLAN Aggregation" msgstr "In :rfc:`3069` it is called VLAN Aggregation" -#: ../../configuration/firewall/zone.rst:31 +#: ../../configuration/firewall/zone.rst:41 msgid "In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone <name>`` to ``firewall zone <name>``." msgstr "In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone <name>`` to ``firewall zone <name>``." @@ -7556,6 +7588,10 @@ msgstr "In addition you will specifiy the IP address or FQDN for the client wher msgid "In an **address group** a single IP address or IP address ranges are defined." msgstr "In an **address group** a single IP address or IP address ranges are defined." +#: ../../configuration/interfaces/openvpn.rst:57 +msgid "In both cases, we will use the following settings:" +msgstr "In both cases, we will use the following settings:" + #: ../../configuration/system/flow-accounting.rst:78 msgid "In case, if you need to catch some logs from flow-accounting daemon, you may configure logging facility:" msgstr "In case, if you need to catch some logs from flow-accounting daemon, you may configure logging facility:" @@ -7759,7 +7795,7 @@ msgstr "In this example, we will be using the example Quick Start configuration msgid "In this example all traffic destined to ports \"80, 2222, 8888\" protocol TCP marks to fwmark \"111\" and balanced between 2 real servers. Port \"0\" is required if multiple ports are used." msgstr "In this example all traffic destined to ports \"80, 2222, 8888\" protocol TCP marks to fwmark \"111\" and balanced between 2 real servers. Port \"0\" is required if multiple ports are used." -#: ../../configuration/interfaces/openvpn.rst:282 +#: ../../configuration/interfaces/openvpn.rst:334 msgid "In this example we will use the most complicated case: a setup where each client is a router that has its own subnet (think HQ and branch offices), since simpler setups are subsets of it." msgstr "In this example we will use the most complicated case: a setup where each client is a router that has its own subnet (think HQ and branch offices), since simpler setups are subsets of it." @@ -7783,7 +7819,7 @@ msgstr "In typical uses of SNMP, one or more administrative computers called man msgid "In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones and acted on according to firewall rules. A Zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of a network." msgstr "In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones and acted on according to firewall rules. A Zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of a network." -#: ../../configuration/firewall/zone.rst:14 +#: ../../configuration/firewall/zone.rst:24 msgid "In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones and acted on according to firewall rules. A zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of a network." msgstr "In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones and acted on according to firewall rules. A zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of a network." @@ -8033,7 +8069,7 @@ msgstr "It generates the keypair, which includes the public and private parts. T msgid "It helps to support as HELPER only for planned restarts." msgstr "It helps to support as HELPER only for planned restarts." -#: ../../configuration/firewall/zone.rst:77 +#: ../../configuration/firewall/zone.rst:87 msgid "It helps to think of the syntax as: (see below). The 'rule-set' should be written from the perspective of: *Source Zone*-to->*Destination Zone*" msgstr "It helps to think of the syntax as: (see below). The 'rule-set' should be written from the perspective of: *Source Zone*-to->*Destination Zone*" @@ -8057,7 +8093,7 @@ msgstr "It is highly recommended to use the same address for both the LDP router msgid "It is important to note that when creating firewall rules that the DNAT translation occurs **before** traffic traverses the firewall. In other words, the destination address has already been translated to 192.168.0.100." msgstr "It is important to note that when creating firewall rules that the DNAT translation occurs **before** traffic traverses the firewall. In other words, the destination address has already been translated to 192.168.0.100." -#: ../../configuration/vrf/index.rst:467 +#: ../../configuration/vrf/index.rst:503 msgid "It is not sufficient to only configure a L3VPN VRFs but L3VPN VRFs must be maintained, too.For L3VPN VRF maintenance the following operational commands are in place." msgstr "It is not sufficient to only configure a L3VPN VRFs but L3VPN VRFs must be maintained, too.For L3VPN VRF maintenance the following operational commands are in place." @@ -8073,7 +8109,7 @@ msgstr "It is not valid to use the `vif 1` option for VLAN aware bridges because msgid "It is possible to enhance authentication security by using the :abbr:`2FA (Two-factor authentication)`/:abbr:`MFA (Multi-factor authentication)` feature together with :abbr:`OTP (One-Time-Pad)` on VyOS. :abbr:`2FA (Two-factor authentication)`/:abbr:`MFA (Multi-factor authentication)` is configured independently per each user. If an OTP key is configured for a user, 2FA/MFA is automatically enabled for that particular user. If a user does not have an OTP key configured, there is no 2FA/MFA check for that user." msgstr "It is possible to enhance authentication security by using the :abbr:`2FA (Two-factor authentication)`/:abbr:`MFA (Multi-factor authentication)` feature together with :abbr:`OTP (One-Time-Pad)` on VyOS. :abbr:`2FA (Two-factor authentication)`/:abbr:`MFA (Multi-factor authentication)` is configured independently per each user. If an OTP key is configured for a user, 2FA/MFA is automatically enabled for that particular user. If a user does not have an OTP key configured, there is no 2FA/MFA check for that user." -#: ../../configuration/vrf/index.rst:458 +#: ../../configuration/vrf/index.rst:494 msgid "It is possible to permit BGP install VPN prefixes without transport labels. This configuration will install VPN prefixes originated from an e-bgp session, and with the next-hop directly connected." msgstr "It is possible to permit BGP install VPN prefixes without transport labels. This configuration will install VPN prefixes originated from an e-bgp session, and with the next-hop directly connected." @@ -8145,7 +8181,7 @@ msgstr "Key Management" msgid "Key Parameters:" msgstr "Key Parameters:" -#: ../../configuration/firewall/zone.rst:21 +#: ../../configuration/firewall/zone.rst:31 msgid "Key Points:" msgstr "Key Points:" @@ -8198,11 +8234,11 @@ msgstr "L2TPv3 is described in :rfc:`3931`." msgid "L2TPv3 options" msgstr "L2TPv3 options" -#: ../../configuration/vrf/index.rst:361 +#: ../../configuration/vrf/index.rst:397 msgid "L3VPN VRFs" msgstr "L3VPN VRFs" -#: ../../configuration/interfaces/openvpn.rst:391 +#: ../../configuration/interfaces/openvpn.rst:443 #: ../../configuration/service/webproxy.rst:203 msgid "LDAP" msgstr "LDAP" @@ -8395,8 +8431,8 @@ msgstr "Load the container image in op-mode." msgid "Local" msgstr "Local" -#: ../../configuration/interfaces/openvpn.rst:77 -#: ../../configuration/interfaces/openvpn.rst:189 +#: ../../configuration/interfaces/openvpn.rst:134 +#: ../../configuration/interfaces/openvpn.rst:241 msgid "Local Configuration:" msgstr "Local Configuration:" @@ -8492,7 +8528,7 @@ msgstr "Log the connection tracking events per protocol." msgid "Logging" msgstr "Logging" -#: ../../configuration/firewall/general.rst:417 +#: ../../configuration/firewall/general.rst:419 msgid "Logging can be enable for every single firewall rule. If enabled, other log options can be defined." msgstr "Logging can be enable for every single firewall rule. If enabled, other log options can be defined." @@ -8681,11 +8717,11 @@ msgstr "Mark the private key as password protected. User is asked for the passwo msgid "Match BGP large communities." msgstr "Match BGP large communities." -#: ../../configuration/firewall/general-legacy.rst:471 +#: ../../configuration/firewall/general-legacy.rst:474 msgid "Match IP addresses based on its geolocation. More info: `geoip matching <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_." msgstr "Match IP addresses based on its geolocation. More info: `geoip matching <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_." -#: ../../configuration/firewall/general.rst:715 +#: ../../configuration/firewall/general.rst:717 msgid "Match IP addresses based on its geolocation. More info: `geoip matching <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_. Use inverse-match to match anything except the given country-codes." msgstr "Match IP addresses based on its geolocation. More info: `geoip matching <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_. Use inverse-match to match anything except the given country-codes." @@ -8697,18 +8733,18 @@ msgstr "Match RPKI validation result." msgid "Match a protocol criteria. A protocol number or a name which is defined in: ``/etc/protocols``. Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp based packets. The ``!`` negates the selected protocol." msgstr "Match a protocol criteria. A protocol number or a name which is defined in: ``/etc/protocols``. Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp based packets. The ``!`` negates the selected protocol." -#: ../../configuration/firewall/general.rst:1096 -#: ../../configuration/firewall/general-legacy.rst:668 +#: ../../configuration/firewall/general.rst:1098 +#: ../../configuration/firewall/general-legacy.rst:671 msgid "Match a protocol criteria. A protocol number or a name which is here defined: ``/etc/protocols``. Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp based packets. The ``!`` negate the selected protocol." msgstr "Match a protocol criteria. A protocol number or a name which is here defined: ``/etc/protocols``. Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp based packets. The ``!`` negate the selected protocol." -#: ../../configuration/firewall/general.rst:1163 -#: ../../configuration/firewall/general-legacy.rst:706 +#: ../../configuration/firewall/general.rst:1165 +#: ../../configuration/firewall/general-legacy.rst:709 msgid "Match against the state of a packet." msgstr "Match against the state of a packet." -#: ../../configuration/firewall/general.rst:929 -#: ../../configuration/firewall/general-legacy.rst:587 +#: ../../configuration/firewall/general.rst:931 +#: ../../configuration/firewall/general-legacy.rst:590 msgid "Match based on dscp value." msgstr "Match based on dscp value." @@ -8716,19 +8752,19 @@ msgstr "Match based on dscp value." msgid "Match based on dscp value criteria. Multiple values from 0 to 63 and ranges are supported." msgstr "Match based on dscp value criteria. Multiple values from 0 to 63 and ranges are supported." -#: ../../configuration/firewall/general.rst:942 -#: ../../configuration/firewall/general-legacy.rst:594 +#: ../../configuration/firewall/general.rst:944 +#: ../../configuration/firewall/general-legacy.rst:597 msgid "Match based on fragment criteria." msgstr "Match based on fragment criteria." -#: ../../configuration/firewall/general.rst:961 -#: ../../configuration/firewall/general-legacy.rst:601 +#: ../../configuration/firewall/general.rst:963 +#: ../../configuration/firewall/general-legacy.rst:604 #: ../../configuration/policy/route.rst:131 msgid "Match based on icmp|icmpv6 code and type." msgstr "Match based on icmp|icmpv6 code and type." -#: ../../configuration/firewall/general.rst:980 -#: ../../configuration/firewall/general-legacy.rst:607 +#: ../../configuration/firewall/general.rst:982 +#: ../../configuration/firewall/general-legacy.rst:610 msgid "Match based on icmp|icmpv6 type-name criteria. Use tab for information about what **type-name** criteria are supported." msgstr "Match based on icmp|icmpv6 type-name criteria. Use tab for information about what **type-name** criteria are supported." @@ -8736,61 +8772,61 @@ msgstr "Match based on icmp|icmpv6 type-name criteria. Use tab for information a msgid "Match based on icmp|icmpv6 type-name criteria. Use tab for information about what type-name criteria are supported." msgstr "Match based on icmp|icmpv6 type-name criteria. Use tab for information about what type-name criteria are supported." -#: ../../configuration/firewall/general-legacy.rst:619 +#: ../../configuration/firewall/general-legacy.rst:622 msgid "Match based on inbound/outbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" msgstr "Match based on inbound/outbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" -#: ../../configuration/firewall/general.rst:992 +#: ../../configuration/firewall/general.rst:994 msgid "Match based on inbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" msgstr "Match based on inbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" -#: ../../configuration/firewall/general.rst:1018 -#: ../../configuration/firewall/general-legacy.rst:627 +#: ../../configuration/firewall/general.rst:1020 +#: ../../configuration/firewall/general-legacy.rst:630 msgid "Match based on ipsec criteria." msgstr "Match based on ipsec criteria." -#: ../../configuration/firewall/general.rst:1004 +#: ../../configuration/firewall/general.rst:1006 msgid "Match based on outbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" msgstr "Match based on outbound interface. Wilcard ``*`` can be used. For example: ``eth2*``" -#: ../../configuration/firewall/general.rst:1069 -#: ../../configuration/firewall/general-legacy.rst:653 +#: ../../configuration/firewall/general.rst:1071 +#: ../../configuration/firewall/general-legacy.rst:656 #: ../../configuration/policy/route.rst:176 msgid "Match based on packet length criteria. Multiple values from 1 to 65535 and ranges are supported." msgstr "Match based on packet length criteria. Multiple values from 1 to 65535 and ranges are supported." -#: ../../configuration/firewall/general.rst:1083 -#: ../../configuration/firewall/general-legacy.rst:661 +#: ../../configuration/firewall/general.rst:1085 +#: ../../configuration/firewall/general-legacy.rst:664 #: ../../configuration/policy/route.rst:184 msgid "Match based on packet type criteria." msgstr "Match based on packet type criteria." -#: ../../configuration/firewall/general.rst:1044 -#: ../../configuration/firewall/general-legacy.rst:641 +#: ../../configuration/firewall/general.rst:1046 +#: ../../configuration/firewall/general-legacy.rst:644 msgid "Match based on the maximum average rate, specified as **integer/unit**. For example **5/minutes**" msgstr "Match based on the maximum average rate, specified as **integer/unit**. For example **5/minutes**" -#: ../../configuration/firewall/general.rst:1031 -#: ../../configuration/firewall/general-legacy.rst:634 +#: ../../configuration/firewall/general.rst:1033 +#: ../../configuration/firewall/general-legacy.rst:637 msgid "Match based on the maximum number of packets to allow in excess of rate." msgstr "Match based on the maximum number of packets to allow in excess of rate." -#: ../../configuration/firewall/general.rst:1129 -#: ../../configuration/firewall/general-legacy.rst:686 +#: ../../configuration/firewall/general.rst:1131 +#: ../../configuration/firewall/general-legacy.rst:689 msgid "Match bases on recently seen sources." msgstr "Match bases on recently seen sources." -#: ../../configuration/firewall/general.rst:567 +#: ../../configuration/firewall/general.rst:569 #: ../../configuration/firewall/general-legacy.rst:394 msgid "Match criteria based on connection mark." msgstr "Match criteria based on connection mark." -#: ../../configuration/firewall/general.rst:554 +#: ../../configuration/firewall/general.rst:556 #: ../../configuration/firewall/general-legacy.rst:387 msgid "Match criteria based on nat connection status." msgstr "Match criteria based on nat connection status." -#: ../../configuration/firewall/general.rst:591 +#: ../../configuration/firewall/general.rst:593 msgid "Match criteria based on source and/or destination address. This is similar to the network groups part, but here you are able to negate the matching addresses." msgstr "Match criteria based on source and/or destination address. This is similar to the network groups part, but here you are able to negate the matching addresses." @@ -8798,8 +8834,8 @@ msgstr "Match criteria based on source and/or destination address. This is simil msgid "Match domain name" msgstr "Match domain name" -#: ../../configuration/firewall/general.rst:1239 -#: ../../configuration/firewall/general-legacy.rst:729 +#: ../../configuration/firewall/general.rst:1241 +#: ../../configuration/firewall/general-legacy.rst:732 #: ../../configuration/policy/route.rst:234 msgid "Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for 'greater than', and 'lt' stands for 'less than'." msgstr "Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for 'greater than', and 'lt' stands for 'less than'." @@ -8812,18 +8848,18 @@ msgstr "Match local preference." msgid "Match route metric." msgstr "Match route metric." -#: ../../configuration/firewall/general.rst:1227 -#: ../../configuration/firewall/general-legacy.rst:723 +#: ../../configuration/firewall/general.rst:1229 +#: ../../configuration/firewall/general-legacy.rst:726 #: ../../configuration/policy/route.rst:229 msgid "Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for 'greater than', and 'lt' stands for 'less than'." msgstr "Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for 'greater than', and 'lt' stands for 'less than'." -#: ../../configuration/firewall/general.rst:1264 -#: ../../configuration/firewall/general-legacy.rst:739 +#: ../../configuration/firewall/general.rst:1266 +#: ../../configuration/firewall/general-legacy.rst:742 msgid "Match when 'count' amount of connections are seen within 'time'. These matching criteria can be used to block brute-force attempts." msgstr "Match when 'count' amount of connections are seen within 'time'. These matching criteria can be used to block brute-force attempts." -#: ../../configuration/firewall/general.rst:539 +#: ../../configuration/firewall/general.rst:541 #: ../../configuration/firewall/general-legacy.rst:378 #: ../../configuration/policy/route.rst:38 msgid "Matching criteria" @@ -8909,7 +8945,7 @@ msgstr "Mount a volume into the container" msgid "Multi" msgstr "Multi" -#: ../../configuration/interfaces/openvpn.rst:275 +#: ../../configuration/interfaces/openvpn.rst:327 msgid "Multi-client server is the most popular OpenVPN mode on routers. It always uses x.509 authentication and therefore requires a PKI setup. Refer this topic :ref:`configuration/pki/index:pki` to generate a CA certificate, a server certificate and key, a certificate revocation list, a Diffie-Hellman key exchange parameters file. You do not need client certificates and keys for the server setup." msgstr "Multi-client server is the most popular OpenVPN mode on routers. It always uses x.509 authentication and therefore requires a PKI setup. Refer this topic :ref:`configuration/pki/index:pki` to generate a CA certificate, a server certificate and key, a certificate revocation list, a Diffie-Hellman key exchange parameters file. You do not need client certificates and keys for the server setup." @@ -9000,8 +9036,8 @@ msgstr "Multiple servers can be specified." msgid "Multiple services can be used per interface. Just specify as many services per interface as you like!" msgstr "Multiple services can be used per interface. Just specify as many services per interface as you like!" -#: ../../configuration/firewall/general.rst:775 -#: ../../configuration/firewall/general-legacy.rst:512 +#: ../../configuration/firewall/general.rst:777 +#: ../../configuration/firewall/general-legacy.rst:515 msgid "Multiple source ports can be specified as a comma-separated list. The whole list can also be \"negated\" using ``!``. For example:" msgstr "Multiple source ports can be specified as a comma-separated list. The whole list can also be \"negated\" using ``!``. For example:" @@ -9262,6 +9298,10 @@ msgstr "Normal but significant conditions - conditions that are not error condit msgid "Not all transmit policies may be 802.3ad compliant, particularly in regards to the packet misordering requirements of section 43.2.4 of the 802.3ad standard." msgstr "Not all transmit policies may be 802.3ad compliant, particularly in regards to the packet misordering requirements of section 43.2.4 of the 802.3ad standard." +#: ../../configuration/interfaces/openvpn.rst:127 +msgid "Note: certificate names don't matter, we use 'openvpn-local' and 'openvpn-remote' but they can be arbitrary." +msgstr "Note: certificate names don't matter, we use 'openvpn-local' and 'openvpn-remote' but they can be arbitrary." + #: ../../configuration/system/syslog.rst:246 msgid "Note that deleting the log file does not stop the system from logging events. If you use this command while the system is logging events, old log events will be deleted, but events after the delete operation will be recorded in the new file. To delete the file altogether, first delete logging to the file using system syslog :ref:`custom-file` command, and then delete the file." msgstr "Note that deleting the log file does not stop the system from logging events. If you use this command while the system is logging events, old log events will be deleted, but events after the delete operation will be recorded in the new file. To delete the file altogether, first delete logging to the file using system syslog :ref:`custom-file` command, and then delete the file." @@ -9287,7 +9327,7 @@ msgstr "Now the noted public keys should be entered on the opposite routers." msgid "Now we add the option to the scope, adapt to your setup" msgstr "Now we add the option to the scope, adapt to your setup" -#: ../../configuration/interfaces/openvpn.rst:333 +#: ../../configuration/interfaces/openvpn.rst:385 msgid "Now we need to specify the server network settings. In all cases we need to specify the subnet for client tunnel endpoints. Since we want clients to access a specific network behind our router, we will use a push-route option for installing that route on clients." msgstr "Now we need to specify the server network settings. In all cases we need to specify the subnet for client tunnel endpoints. Since we want clients to access a specific network behind our router, we will use a push-route option for installing that route on clients." @@ -9359,6 +9399,10 @@ msgstr "Often you will also have to configure your *default* traffic in the same msgid "On active router run:" msgstr "On active router run:" +#: ../../configuration/interfaces/openvpn.rst:83 +msgid "On both sides, you need to generate a self-signed certificate, preferrably using the \"ec\" (elliptic curve) type. You can generate them by executing command ``run generate pki certificate self-signed install <name>`` in the configuration mode. Once the command is complete, it will add the certificate to the configuration session, to the ``pki`` subtree. You can then review the proposed changes and commit them." +msgstr "On both sides, you need to generate a self-signed certificate, preferrably using the \"ec\" (elliptic curve) type. You can generate them by executing command ``run generate pki certificate self-signed install <name>`` in the configuration mode. Once the command is complete, it will add the certificate to the configuration session, to the ``pki`` subtree. You can then review the proposed changes and commit them." + #: ../../configuration/trafficpolicy/index.rst:487 msgid "On low rates (below 40Mbit) you may want to tune `quantum` down to something like 300 bytes." msgstr "On low rates (below 40Mbit) you may want to tune `quantum` down to something like 300 bytes." @@ -9518,8 +9562,8 @@ msgstr "Only 802.1Q-tagged packets are accepted on Ethernet vifs." msgid "Only VRRP is supported. Required option." msgstr "Only VRRP is supported. Required option." -#: ../../configuration/firewall/general.rst:736 -#: ../../configuration/firewall/general-legacy.rst:487 +#: ../../configuration/firewall/general.rst:738 +#: ../../configuration/firewall/general-legacy.rst:490 msgid "Only in the source criteria, you can specify a mac-address." msgstr "Only in the source criteria, you can specify a mac-address." @@ -9587,19 +9631,19 @@ msgstr "OpenConnect supports a subset of it's configuration options to be applie msgid "OpenVPN" msgstr "OpenVPN" -#: ../../configuration/interfaces/openvpn.rst:355 +#: ../../configuration/interfaces/openvpn.rst:407 msgid "OpenVPN **will not** automatically create routes in the kernel for client subnets when they connect and will only use client-subnet association internally, so we need to create a route to the 10.23.0.0/20 network ourselves:" msgstr "OpenVPN **will not** automatically create routes in the kernel for client subnets when they connect and will only use client-subnet association internally, so we need to create a route to the 10.23.0.0/20 network ourselves:" -#: ../../configuration/interfaces/openvpn.rst:617 +#: ../../configuration/interfaces/openvpn.rst:669 msgid "OpenVPN DCO is not full OpenVPN features supported , is currently considered experimental. Furthermore, there are certain OpenVPN features and use cases that remain incompatible with DCO. To get a comprehensive understanding of the limitations associated with DCO, refer to the list of known limitations in the documentation." msgstr "OpenVPN DCO is not full OpenVPN features supported , is currently considered experimental. Furthermore, there are certain OpenVPN features and use cases that remain incompatible with DCO. To get a comprehensive understanding of the limitations associated with DCO, refer to the list of known limitations in the documentation." -#: ../../configuration/interfaces/openvpn.rst:606 +#: ../../configuration/interfaces/openvpn.rst:658 msgid "OpenVPN Data Channel Offload (DCO)" msgstr "OpenVPN Data Channel Offload (DCO)" -#: ../../configuration/interfaces/openvpn.rst:608 +#: ../../configuration/interfaces/openvpn.rst:660 msgid "OpenVPN Data Channel Offload (DCO) enables significant performance enhancement in encrypted OpenVPN data processing. By minimizing context switching for each packet, DCO effectively reduces overhead. This optimization is achieved by keeping most data handling tasks within the kernel, avoiding frequent switches between kernel and user space for encryption and packet handling." msgstr "OpenVPN Data Channel Offload (DCO) enables significant performance enhancement in encrypted OpenVPN data processing. By minimizing context switching for each packet, DCO effectively reduces overhead. This optimization is achieved by keeping most data handling tasks within the kernel, avoiding frequent switches between kernel and user space for encryption and packet handling." @@ -9607,7 +9651,11 @@ msgstr "OpenVPN Data Channel Offload (DCO) enables significant performance enhan msgid "OpenVPN allows for either TCP or UDP. UDP will provide the lowest latency, while TCP will work better for lossy connections; generally UDP is preferred when possible." msgstr "OpenVPN allows for either TCP or UDP. UDP will provide the lowest latency, while TCP will work better for lossy connections; generally UDP is preferred when possible." -#: ../../configuration/interfaces/openvpn.rst:268 +#: ../../configuration/interfaces/openvpn.rst:43 +msgid "OpenVPN is popular for client-server setups, but its site-to-site mode remains a relatively obscure feature, and many router appliances still don't support it. However, it's very useful for quickly setting up tunnels between routers." +msgstr "OpenVPN is popular for client-server setups, but its site-to-site mode remains a relatively obscure feature, and many router appliances still don't support it. However, it's very useful for quickly setting up tunnels between routers." + +#: ../../configuration/interfaces/openvpn.rst:320 msgid "OpenVPN status can be verified using the `show openvpn` operational commands. See the built-in help for a complete list of options." msgstr "OpenVPN status can be verified using the `show openvpn` operational commands. See the built-in help for a complete list of options." @@ -9643,13 +9691,13 @@ msgstr "Operating Modes" #: ../../configuration/system/default-route.rst:25 #: ../../configuration/system/flow-accounting.rst:175 #: ../../configuration/vrf/index.rst:111 -#: ../../configuration/vrf/index.rst:285 -#: ../../configuration/vrf/index.rst:465 +#: ../../configuration/vrf/index.rst:321 +#: ../../configuration/vrf/index.rst:501 msgid "Operation" msgstr "Operation" -#: ../../configuration/firewall/general.rst:1269 -#: ../../configuration/firewall/general-legacy.rst:775 +#: ../../configuration/firewall/general.rst:1314 +#: ../../configuration/firewall/general-legacy.rst:778 msgid "Operation-mode Firewall" msgstr "Operation-mode Firewall" @@ -9741,7 +9789,7 @@ msgstr "Optional Configuration" msgid "Optionally set a specific static IPv4 or IPv6 address for the container. This address must be within the named network prefix." msgstr "Optionally set a specific static IPv4 or IPv6 address for the container. This address must be within the named network prefix." -#: ../../configuration/interfaces/openvpn.rst:579 +#: ../../configuration/interfaces/openvpn.rst:631 #: ../../configuration/service/dhcp-relay.rst:53 #: ../../configuration/service/dhcp-relay.rst:158 #: ../../configuration/service/dhcp-server.rst:257 @@ -9824,8 +9872,8 @@ msgstr "Overview" msgid "Overview and basic concepts" msgstr "Overview and basic concepts" -#: ../../configuration/firewall/general.rst:1423 -#: ../../configuration/firewall/general-legacy.rst:905 +#: ../../configuration/firewall/general.rst:1468 +#: ../../configuration/firewall/general-legacy.rst:908 msgid "Overview of defined groups. You see the type, the members, and where the group is used." msgstr "Overview of defined groups. You see the type, the members, and where the group is used." @@ -10125,6 +10173,10 @@ msgstr "Port to listen for HTTPS requests; default 443" msgid "Portions of the network which are VLAN-aware (i.e., IEEE 802.1q_ conformant) can include VLAN tags. When a frame enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does not contain a VLAN tag is assumed to be flowing on the native VLAN." msgstr "Portions of the network which are VLAN-aware (i.e., IEEE 802.1q_ conformant) can include VLAN tags. When a frame enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does not contain a VLAN tag is assumed to be flowing on the native VLAN." +#: ../../configuration/interfaces/openvpn.rst:169 +msgid "Pre-shared keys" +msgstr "Pre-shared keys" + #: ../../configuration/trafficpolicy/index.rst:787 #: ../../configuration/trafficpolicy/index.rst:862 msgid "Precedence" @@ -10234,11 +10286,11 @@ msgstr "Prepend the given string of AS numbers to the AS_PATH of the BGP path's msgid "Principle of SNMP Communication" msgstr "Principle of SNMP Communication" -#: ../../configuration/vrf/index.rst:494 +#: ../../configuration/vrf/index.rst:530 msgid "Print a summary of neighbor connections for the specified AFI/SAFI combination." msgstr "Print a summary of neighbor connections for the specified AFI/SAFI combination." -#: ../../configuration/vrf/index.rst:473 +#: ../../configuration/vrf/index.rst:509 msgid "Print active IPV4 or IPV6 routes advertised via the VPN SAFI." msgstr "Print active IPV4 or IPV6 routes advertised via the VPN SAFI." @@ -10311,7 +10363,7 @@ msgstr "Provide a IPv4 or IPv6 address group description" msgid "Provide a IPv4 or IPv6 network group description." msgstr "Provide a IPv4 or IPv6 network group description." -#: ../../configuration/firewall/general.rst:520 +#: ../../configuration/firewall/general.rst:522 #: ../../configuration/firewall/general-legacy.rst:334 #: ../../configuration/policy/route.rst:30 msgid "Provide a description for each rule." @@ -10335,7 +10387,7 @@ msgstr "Provide a port group description." msgid "Provide a rule-set description." msgstr "Provide a rule-set description." -#: ../../configuration/firewall/general.rst:508 +#: ../../configuration/firewall/general.rst:510 msgid "Provide a rule-set description to a custom firewall chain." msgstr "Provide a rule-set description to a custom firewall chain." @@ -10672,8 +10724,8 @@ msgstr "Remote Access \"RoadWarrior\" Example" msgid "Remote Access \"RoadWarrior\" clients" msgstr "Remote Access \"RoadWarrior\" clients" -#: ../../configuration/interfaces/openvpn.rst:120 -#: ../../configuration/interfaces/openvpn.rst:195 +#: ../../configuration/interfaces/openvpn.rst:152 +#: ../../configuration/interfaces/openvpn.rst:247 msgid "Remote Configuration:" msgstr "Remote Configuration:" @@ -10721,6 +10773,10 @@ msgstr "Remote transmission interval will be multiplied by this value" msgid "Renaming clients interfaces by RADIUS" msgstr "Renaming clients interfaces by RADIUS" +#: ../../configuration/interfaces/openvpn.rst:129 +msgid "Repeat the procedure on the other router." +msgstr "Repeat the procedure on the other router." + #: ../../configuration/interfaces/macsec.rst:93 msgid "Replay protection" msgstr "Replay protection" @@ -10760,12 +10816,16 @@ msgstr "Requirements" msgid "Requirements:" msgstr "Requirements:" +#: ../../configuration/firewall/general.rst:1286 +msgid "Requirements to enable synproxy:" +msgstr "Requirements to enable synproxy:" + #: ../../configuration/protocols/bgp.rst:1063 #: ../../configuration/protocols/mpls.rst:248 msgid "Reset" msgstr "Reset" -#: ../../configuration/interfaces/openvpn.rst:673 +#: ../../configuration/interfaces/openvpn.rst:725 msgid "Reset OpenVPN" msgstr "Reset OpenVPN" @@ -10923,7 +10983,7 @@ msgstr "Router Lifetime" msgid "Router receives DHCP client requests on ``eth1`` and relays them to the server at 10.0.1.4 on ``eth2``." msgstr "Router receives DHCP client requests on ``eth1`` and relays them to the server at 10.0.1.4 on ``eth2``." -#: ../../configuration/vrf/index.rst:387 +#: ../../configuration/vrf/index.rst:423 msgid "Routes exported from a unicast VRF to the VPN RIB must be augmented by two parameters:" msgstr "Routes exported from a unicast VRF to the VPN RIB must be augmented by two parameters:" @@ -10964,8 +11024,8 @@ msgstr "Routing tables that will be used in this example are:" msgid "Rule-Sets" msgstr "Rule-Sets" -#: ../../configuration/firewall/general.rst:1272 -#: ../../configuration/firewall/general-legacy.rst:778 +#: ../../configuration/firewall/general.rst:1317 +#: ../../configuration/firewall/general-legacy.rst:781 msgid "Rule-set overview" msgstr "Rule-set overview" @@ -10985,7 +11045,7 @@ msgstr "Rule 20 matches requests with URL paths ending in ``/mail`` or exact pat msgid "Rule 20 matches requests with the domain name ``node2.example.com`` forwards to the backend ``bk-api-02``" msgstr "Rule 20 matches requests with the domain name ``node2.example.com`` forwards to the backend ``bk-api-02``" -#: ../../configuration/firewall/general.rst:524 +#: ../../configuration/firewall/general.rst:526 msgid "Rule Status" msgstr "Rule Status" @@ -11214,7 +11274,7 @@ msgstr "Segment routing defines a control plane network architecture and can be msgid "Select cipher suite used for cryptographic operations. This setting is mandatory." msgstr "Select cipher suite used for cryptographic operations. This setting is mandatory." -#: ../../configuration/vrf/index.rst:430 +#: ../../configuration/vrf/index.rst:466 msgid "Select how labels are allocated in the given VRF. By default, the per-vrf mode is selected, and one label is used for all prefixes from the VRF. The per-nexthop will use a unique label for all prefixes that are reachable via the same nexthop." msgstr "Select how labels are allocated in the given VRF. By default, the per-vrf mode is selected, and one label is used for all prefixes from the VRF. The per-nexthop will use a unique label for all prefixes that are reachable via the same nexthop." @@ -11246,7 +11306,7 @@ msgstr "Serial Console" msgid "Serial interfaces can be any interface which is directly connected to the CPU or chipset (mostly known as a ttyS interface in Linux) or any other USB to serial converter (Prolific PL2303 or FTDI FT232/FT4232 based chips)." msgstr "Serial interfaces can be any interface which is directly connected to the CPU or chipset (mostly known as a ttyS interface in Linux) or any other USB to serial converter (Prolific PL2303 or FTDI FT232/FT4232 based chips)." -#: ../../configuration/interfaces/openvpn.rst:273 +#: ../../configuration/interfaces/openvpn.rst:325 #: ../../configuration/vpn/sstp.rst:199 msgid "Server" msgstr "Server" @@ -11263,7 +11323,7 @@ msgstr "Server Certificate" msgid "Server Configuration" msgstr "Server Configuration" -#: ../../configuration/interfaces/openvpn.rst:536 +#: ../../configuration/interfaces/openvpn.rst:588 msgid "Server Side" msgstr "Server Side" @@ -11340,6 +11400,10 @@ msgstr "Set SNAT rule 30 to only NAT packets arriving from the 203.0.113.0/24 ne msgid "Set SSL certeficate <name> for service <name>" msgstr "Set SSL certeficate <name> for service <name>" +#: ../../configuration/firewall/general.rst:1278 +msgid "Set TCP-MSS (maximum segment size) for the connection" +msgstr "Set TCP-MSS (maximum segment size) for the connection" + #: ../../configuration/service/dns.rst:267 msgid "Set TTL to 300 seconds" msgstr "Set TTL to 300 seconds" @@ -11388,7 +11452,7 @@ msgstr "Set a human readable, descriptive alias for this connection. Alias is us msgid "Set a limit on the maximum number of concurrent logged-in users on the system." msgstr "Set a limit on the maximum number of concurrent logged-in users on the system." -#: ../../configuration/firewall/zone.rst:69 +#: ../../configuration/firewall/zone.rst:79 msgid "Set a meaningful description." msgstr "Set a meaningful description." @@ -11528,7 +11592,7 @@ msgstr "Set if antenna pattern does not change during the lifetime of an associa msgid "Set inbound interface to match." msgstr "Set inbound interface to match." -#: ../../configuration/firewall/zone.rst:55 +#: ../../configuration/firewall/zone.rst:65 msgid "Set interfaces to a zone. A zone can have multiple interfaces. But an interface can only be a member in one zone." msgstr "Set interfaces to a zone. A zone can have multiple interfaces. But an interface can only be a member in one zone." @@ -11887,6 +11951,10 @@ msgstr "Set the timeout in secounds for a protocol or state in a custom rule." msgid "Set the tunnel id, which is a 32-bit integer value. Uniquely identifies the tunnel into which the session will be created." msgstr "Set the tunnel id, which is a 32-bit integer value. Uniquely identifies the tunnel into which the session will be created." +#: ../../configuration/firewall/general.rst:1282 +msgid "Set the window scale factor for TCP window scaling" +msgstr "Set the window scale factor for TCP window scaling" + #: ../../configuration/system/login.rst:124 msgid "Set window of concurrently valid codes." msgstr "Set window of concurrently valid codes." @@ -11919,6 +11987,18 @@ msgstr "Setting name" msgid "Setting this up on AWS will require a \"Custom Protocol Rule\" for protocol number \"47\" (GRE) Allow Rule in TWO places. Firstly on the VPC Network ACL, and secondly on the security group network ACL attached to the EC2 instance. This has been tested as working for the official AMI image on the AWS Marketplace. (Locate the correct VPC and security group by navigating through the details pane below your EC2 instance in the AWS console)." msgstr "Setting this up on AWS will require a \"Custom Protocol Rule\" for protocol number \"47\" (GRE) Allow Rule in TWO places. Firstly on the VPC Network ACL, and secondly on the security group network ACL attached to the EC2 instance. This has been tested as working for the official AMI image on the AWS Marketplace. (Locate the correct VPC and security group by navigating through the details pane below your EC2 instance in the AWS console)." +#: ../../configuration/interfaces/openvpn.rst:132 +msgid "Setting up OpenVPN" +msgstr "Setting up OpenVPN" + +#: ../../configuration/interfaces/openvpn.rst:76 +msgid "Setting up a full-blown PKI with a CA certificate would arguably defeat the purpose of site-to-site OpenVPN, since its main goal is supposed to be configuration simplicity, compared to server setups that need to support multiple clients." +msgstr "Setting up a full-blown PKI with a CA certificate would arguably defeat the purpose of site-to-site OpenVPN, since its main goal is supposed to be configuration simplicity, compared to server setups that need to support multiple clients." + +#: ../../configuration/interfaces/openvpn.rst:74 +msgid "Setting up certificates" +msgstr "Setting up certificates" + #: ../../configuration/service/dhcp-server.rst:432 msgid "Setup DHCP failover for network 192.0.2.0/24" msgstr "Setup DHCP failover for network 192.0.2.0/24" @@ -11971,7 +12051,7 @@ msgstr "Short GI capabilities for 20 and 40 MHz" msgid "Short bursts can be allowed to exceed the limit. On creation, the Rate-Control traffic is stocked with tokens which correspond to the amount of traffic that can be burst in one go. Tokens arrive at a steady rate, until the bucket is full." msgstr "Short bursts can be allowed to exceed the limit. On creation, the Rate-Control traffic is stocked with tokens which correspond to the amount of traffic that can be burst in one go. Tokens arrive at a steady rate, until the bucket is full." -#: ../../configuration/vrf/index.rst:450 +#: ../../configuration/vrf/index.rst:486 msgid "Shortcut syntax for specifying automatic leaking from vrf VRFNAME to the current VRF using the VPN RIB as intermediary. The RD and RT are auto derived and should not be specified explicitly for either the source or destination VRF’s." msgstr "Shortcut syntax for specifying automatic leaking from vrf VRFNAME to the current VRF using the VPN RIB as intermediary. The RD and RT are auto derived and should not be specified explicitly for either the source or destination VRF’s." @@ -11988,8 +12068,8 @@ msgstr "Show DHCP server daemon log file" msgid "Show DHCPv6 server daemon log file" msgstr "Show DHCPv6 server daemon log file" -#: ../../configuration/firewall/general.rst:1444 -#: ../../configuration/firewall/general-legacy.rst:962 +#: ../../configuration/firewall/general.rst:1489 +#: ../../configuration/firewall/general-legacy.rst:965 msgid "Show Firewall log" msgstr "Show Firewall log" @@ -12236,8 +12316,8 @@ msgstr "Show the list of all active containers." msgid "Show the local container images." msgstr "Show the local container images." -#: ../../configuration/firewall/general.rst:1448 -#: ../../configuration/firewall/general-legacy.rst:966 +#: ../../configuration/firewall/general.rst:1493 +#: ../../configuration/firewall/general-legacy.rst:969 msgid "Show the logs of a specific Rule-Set." msgstr "Show the logs of a specific Rule-Set." @@ -12306,7 +12386,7 @@ msgstr "Simple text password authentication is insecure and deprecated in favour msgid "Since both routers do not know their effective public addresses, we set the local-address of the peer to \"any\"." msgstr "Since both routers do not know their effective public addresses, we set the local-address of the peer to \"any\"." -#: ../../configuration/interfaces/openvpn.rst:343 +#: ../../configuration/interfaces/openvpn.rst:395 msgid "Since it's a HQ and branch offices setup, we will want all clients to have fixed addresses and we will route traffic to specific subnets through them. We need configuration for each client to achieve this." msgstr "Since it's a HQ and branch offices setup, we will want all clients to have fixed addresses and we will route traffic to specific subnets through them. We need configuration for each client to achieve this." @@ -12416,7 +12496,7 @@ msgstr "Some services don't work correctly when being handled via a web proxy. S msgid "Some users tend to connect their mobile devices using WireGuard to their VyOS router. To ease deployment one can generate a \"per mobile\" configuration from the VyOS CLI." msgstr "Some users tend to connect their mobile devices using WireGuard to their VyOS router. To ease deployment one can generate a \"per mobile\" configuration from the VyOS CLI." -#: ../../configuration/interfaces/openvpn.rst:599 +#: ../../configuration/interfaces/openvpn.rst:651 msgid "Sometimes option lines in the generated OpenVPN configuration require quotes. This is done through a hack on our config generator. You can pass quotes using the ``"`` statement." msgstr "Sometimes option lines in the generated OpenVPN configuration require quotes. This is done through a hack on our config generator. You can pass quotes using the ``"`` statement." @@ -12492,7 +12572,7 @@ msgstr "Specifies IP address for Dynamic Authorization Extension server (DM/CoA) msgid "Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation preference." msgstr "Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation preference." -#: ../../configuration/vrf/index.rst:439 +#: ../../configuration/vrf/index.rst:475 msgid "Specifies an optional route-map to be applied to routes imported or exported between the current unicast VRF and VPN." msgstr "Specifies an optional route-map to be applied to routes imported or exported between the current unicast VRF and VPN." @@ -12573,11 +12653,11 @@ msgstr "Specifies the port `<port>` that the SSTP port will listen on (default 4 msgid "Specifies the protection scope (aka realm name) which is to be reported to the client for the authentication scheme. It is commonly part of the text the user will see when prompted for their username and password." msgstr "Specifies the protection scope (aka realm name) which is to be reported to the client for the authentication scheme. It is commonly part of the text the user will see when prompted for their username and password." -#: ../../configuration/vrf/index.rst:414 +#: ../../configuration/vrf/index.rst:450 msgid "Specifies the route-target list to be attached to a route (export) or the route-target list to match against (import) when exporting/importing between the current unicast VRF and VPN.The RTLIST is a space-separated list of route-targets, which are BGP extended community values as described in Extended Communities Attribute." msgstr "Specifies the route-target list to be attached to a route (export) or the route-target list to match against (import) when exporting/importing between the current unicast VRF and VPN.The RTLIST is a space-separated list of route-targets, which are BGP extended community values as described in Extended Communities Attribute." -#: ../../configuration/vrf/index.rst:407 +#: ../../configuration/vrf/index.rst:443 msgid "Specifies the route distinguisher to be added to a route exported from the current unicast VRF to VPN." msgstr "Specifies the route distinguisher to be added to a route exported from the current unicast VRF to VPN." @@ -12605,8 +12685,8 @@ msgstr "Specifies which RADIUS server attribute contains the rate limit informat msgid "Specify IPv4/IPv6 listen address of SSH server. Multiple addresses can be defined." msgstr "Specify IPv4/IPv6 listen address of SSH server. Multiple addresses can be defined." -#: ../../configuration/firewall/general.rst:668 -#: ../../configuration/firewall/general-legacy.rst:452 +#: ../../configuration/firewall/general.rst:670 +#: ../../configuration/firewall/general-legacy.rst:455 msgid "Specify a Fully Qualified Domain Name as source/destination matcher. Ensure router is able to resolve such dns query." msgstr "Specify a Fully Qualified Domain Name as source/destination matcher. Ensure router is able to resolve such dns query." @@ -12756,6 +12836,10 @@ msgstr "Squid_ is a caching and forwarding HTTP web proxy. It has a wide variety msgid "Start by checking for IPSec SAs (Security Associations) with:" msgstr "Start by checking for IPSec SAs (Security Associations) with:" +#: ../../configuration/firewall/zone.rst:9 +msgid "Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos instalations, and zone based firewall is no longer supported. Documentation for most of the new firewall CLI can be found in the `firewall <https://docs.vyos.io/en/latest/configuration/firewall/general.html>`_ chapter. The legacy firewall is still available for versions before 1.4-rolling-202308040557 and can be found in the :ref:`firewall-legacy` chapter. The examples in this section use the legacy firewall configuration commands, since this feature has been removed in earlier releases." +msgstr "Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos instalations, and zone based firewall is no longer supported. Documentation for most of the new firewall CLI can be found in the `firewall <https://docs.vyos.io/en/latest/configuration/firewall/general.html>`_ chapter. The legacy firewall is still available for versions before 1.4-rolling-202308040557 and can be found in the :ref:`firewall-legacy` chapter. The examples in this section use the legacy firewall configuration commands, since this feature has been removed in earlier releases." + #: ../../configuration/firewall/index.rst:5 msgid "Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos installations. Documentation for most new firewall cli can be found here:" msgstr "Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos installations. Documentation for most new firewall cli can be found here:" @@ -12788,7 +12872,7 @@ msgstr "Static Keys" msgid "Static Routes" msgstr "Static Routes" -#: ../../configuration/interfaces/openvpn.rst:183 +#: ../../configuration/interfaces/openvpn.rst:235 msgid "Static Routing:" msgstr "Static Routing:" @@ -12814,7 +12898,7 @@ msgstr "Static mappings aren't shown. To show all states, use ``show dhcp server msgid "Static routes are manually configured routes, which, in general, cannot be updated dynamically from information VyOS learns about the network topology from other routing protocols. However, if a link fails, the router will remove routes, including static routes, from the :abbr:`RIPB (Routing Information Base)` that used this interface to reach the next hop. In general, static routes should only be used for very simple network topologies, or to override the behavior of a dynamic routing protocol for a small number of routes. The collection of all routes the router has learned from its configuration or from its dynamic routing protocols is stored in the RIB. Unicast routes are directly used to determine the forwarding table used for unicast packet forwarding." msgstr "Static routes are manually configured routes, which, in general, cannot be updated dynamically from information VyOS learns about the network topology from other routing protocols. However, if a link fails, the router will remove routes, including static routes, from the :abbr:`RIPB (Routing Information Base)` that used this interface to reach the next hop. In general, static routes should only be used for very simple network topologies, or to override the behavior of a dynamic routing protocol for a small number of routes. The collection of all routes the router has learned from its configuration or from its dynamic routing protocols is stored in the RIB. Unicast routes are directly used to determine the forwarding table used for unicast packet forwarding." -#: ../../configuration/interfaces/openvpn.rst:185 +#: ../../configuration/interfaces/openvpn.rst:237 msgid "Static routes can be configured referencing the tunnel interface; for example, the local router will use a network of 10.0.0.0/16, while the remote has a network of 10.1.0.0/16:" msgstr "Static routes can be configured referencing the tunnel interface; for example, the local router will use a network of 10.0.0.0/16, while the remote has a network of 10.1.0.0/16:" @@ -12871,7 +12955,7 @@ msgstr "Supports as HELPER for configured grace period." msgid "Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface, and the RIGHT router is 203.0.113.45" msgstr "Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface, and the RIGHT router is 203.0.113.45" -#: ../../configuration/interfaces/openvpn.rst:286 +#: ../../configuration/interfaces/openvpn.rst:338 msgid "Suppose you want to use 10.23.1.0/24 network for client tunnel endpoints and all client subnets belong to 10.23.0.0/20. All clients need access to the 192.168.0.0/16 network." msgstr "Suppose you want to use 10.23.1.0/24 network for client tunnel endpoints and all client subnets belong to 10.23.0.0/20. All clients need access to the 192.168.0.0/16 network." @@ -12887,6 +12971,18 @@ msgstr "Synamic instructs to forward to all peers which we have a direct connect msgid "Sync groups" msgstr "Sync groups" +#: ../../configuration/firewall/general.rst:1271 +msgid "Synproxy" +msgstr "Synproxy" + +#: ../../configuration/firewall/general.rst:1272 +msgid "Synproxy connections" +msgstr "Synproxy connections" + +#: ../../configuration/firewall/general.rst:1289 +msgid "Synproxy relies on syncookies and TCP timestamps, ensure these are enabled" +msgstr "Synproxy relies on syncookies and TCP timestamps, ensure these are enabled" + #: ../../configuration/interfaces/pppoe.rst:327 msgid "Syntax has changed from VyOS 1.2 (crux) and it will be automatically migrated during an upgrade." msgstr "Syntax has changed from VyOS 1.2 (crux) and it will be automatically migrated during an upgrade." @@ -13233,7 +13329,7 @@ msgstr "The ``http`` service is lestens on port 80 and force redirects from HTTP msgid "The ``https`` service listens on port 443 with backend `bk-default` to handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination." msgstr "The ``https`` service listens on port 443 with backend `bk-default` to handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination." -#: ../../configuration/interfaces/openvpn.rst:69 +#: ../../configuration/interfaces/openvpn.rst:66 msgid "The ``persistent-tunnel`` directive will allow us to configure tunnel-related attributes, such as firewall policy as we would on any normal network interface." msgstr "The ``persistent-tunnel`` directive will allow us to configure tunnel-related attributes, such as firewall policy as we would on any normal network interface." @@ -13342,7 +13438,7 @@ msgstr "The computers on an internal network can use any of the addresses set as msgid "The configuration will look as follows:" msgstr "The configuration will look as follows:" -#: ../../configuration/interfaces/openvpn.rst:201 +#: ../../configuration/interfaces/openvpn.rst:253 msgid "The configurations above will default to using 256-bit AES in GCM mode for encryption (if both sides support NCP) and SHA-1 for HMAC authentication. SHA-1 is considered weak, but other hashing algorithms are available, as are encryption algorithms:" msgstr "The configurations above will default to using 256-bit AES in GCM mode for encryption (if both sides support NCP) and SHA-1 for HMAC authentication. SHA-1 is considered weak, but other hashing algorithms are available, as are encryption algorithms:" @@ -13529,11 +13625,11 @@ msgstr "The following PPP configuration tests MSCHAP-v2:" msgid "The following command can be used to generate the OTP key as well as the CLI commands to configure them:" msgstr "The following command can be used to generate the OTP key as well as the CLI commands to configure them:" -#: ../../configuration/interfaces/openvpn.rst:656 +#: ../../configuration/interfaces/openvpn.rst:708 msgid "The following commands let you check tunnel status." msgstr "The following commands let you check tunnel status." -#: ../../configuration/interfaces/openvpn.rst:675 +#: ../../configuration/interfaces/openvpn.rst:727 msgid "The following commands let you reset OpenVPN." msgstr "The following commands let you reset OpenVPN." @@ -13700,7 +13796,7 @@ msgstr "The local IPv4 or IPv6 addresses to bind the DNS forwarder to. The forwa msgid "The local IPv4 or IPv6 addresses to use as a source address for sending queries. The forwarder will send forwarded outbound DNS requests from this address." msgstr "The local IPv4 or IPv6 addresses to use as a source address for sending queries. The forwarder will send forwarded outbound DNS requests from this address." -#: ../../configuration/interfaces/openvpn.rst:61 +#: ../../configuration/interfaces/openvpn.rst:62 msgid "The local site will have a subnet of 10.0.0.0/16." msgstr "The local site will have a subnet of 10.0.0.0/16." @@ -13764,7 +13860,7 @@ msgstr "The number of milliseconds to wait for a remote authoritative server to msgid "The number parameter (1-10) configures the amount of accepted occurences of the system AS number in AS path." msgstr "The number parameter (1-10) configures the amount of accepted occurences of the system AS number in AS path." -#: ../../configuration/interfaces/openvpn.rst:67 +#: ../../configuration/interfaces/openvpn.rst:64 msgid "The official port for OpenVPN is 1194, which we reserve for client VPN; we will use 1195 for site-to-site VPN." msgstr "The official port for OpenVPN is 1194, which we reserve for client VPN; we will use 1195 for site-to-site VPN." @@ -13806,6 +13902,10 @@ msgstr "The ping command is used to test whether a network host is reachable or msgid "The popular Unix/Linux ``dig`` tool sets the AD-bit in the query. This might lead to unexpected query results when testing. Set ``+noad`` on the ``dig`` command line when this is the case." msgstr "The popular Unix/Linux ``dig`` tool sets the AD-bit in the query. This might lead to unexpected query results when testing. Set ``+noad`` on the ``dig`` command line when this is the case." +#: ../../configuration/interfaces/openvpn.rst:50 +msgid "The pre-shared key mode is deprecated and will be removed from future OpenVPN versions, so VyOS will have to remove support for that option as well. The reason is that using pre-shared keys is significantly less secure than using TLS." +msgstr "The pre-shared key mode is deprecated and will be removed from future OpenVPN versions, so VyOS will have to remove support for that option as well. The reason is that using pre-shared keys is significantly less secure than using TLS." + #: ../../configuration/protocols/rpki.rst:49 msgid "The prefix and ASN that originated it match a signed ROA. These are probably trustworthy route announcements." msgstr "The prefix and ASN that originated it match a signed ROA. These are probably trustworthy route announcements." @@ -13854,11 +13954,11 @@ msgstr "The protocol overhead of L2TPv3 is also significantly bigger than MPLS." msgid "The proxy service in VyOS is based on Squid_ and some related modules." msgstr "The proxy service in VyOS is based on Squid_ and some related modules." -#: ../../configuration/interfaces/openvpn.rst:58 +#: ../../configuration/interfaces/openvpn.rst:59 msgid "The public IP address of the local side of the VPN will be 198.51.100.10." msgstr "The public IP address of the local side of the VPN will be 198.51.100.10." -#: ../../configuration/interfaces/openvpn.rst:59 +#: ../../configuration/interfaces/openvpn.rst:60 msgid "The public IP address of the remote side of the VPN will be 203.0.113.11." msgstr "The public IP address of the remote side of the VPN will be 203.0.113.11." @@ -13875,7 +13975,7 @@ msgstr "The regular expression matches if and only if the entire string matches msgid "The remote peer `to-wg02` uses XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI= as its public key portion" msgstr "The remote peer `to-wg02` uses XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI= as its public key portion" -#: ../../configuration/interfaces/openvpn.rst:62 +#: ../../configuration/interfaces/openvpn.rst:63 msgid "The remote site will have a subnet of 10.1.0.0/16." msgstr "The remote site will have a subnet of 10.1.0.0/16." @@ -13883,7 +13983,7 @@ msgstr "The remote site will have a subnet of 10.1.0.0/16." msgid "The remote user will use the openconnect client to connect to the router and will receive an IP address from a VPN pool, allowing full access to the network." msgstr "The remote user will use the openconnect client to connect to the router and will receive an IP address from a VPN pool, allowing full access to the network." -#: ../../configuration/interfaces/openvpn.rst:406 +#: ../../configuration/interfaces/openvpn.rst:458 msgid "The required config file may look like this:" msgstr "The required config file may look like this:" @@ -13988,7 +14088,7 @@ msgstr "The task scheduler allows you to execute tasks on a given schedule. It m msgid "The translation address must be set to one of the available addresses on the configured `outbound-interface` or it must be set to `masquerade` which will use the primary IP address of the `outbound-interface` as its translation address." msgstr "The translation address must be set to one of the available addresses on the configured `outbound-interface` or it must be set to `masquerade` which will use the primary IP address of the `outbound-interface` as its translation address." -#: ../../configuration/interfaces/openvpn.rst:60 +#: ../../configuration/interfaces/openvpn.rst:61 msgid "The tunnel will use 10.255.1.1 for the local IP and 10.255.1.2 for the remote." msgstr "The tunnel will use 10.255.1.1 for the local IP and 10.255.1.2 for the remote." @@ -14043,10 +14143,18 @@ msgstr "The wireless client (supplicant) authenticates against the RADIUS server msgid "Then a corresponding SNAT rule is created to NAT outgoing traffic for the internal IP to a reserved external IP. This dedicates an external IP address to an internal IP address and is useful for protocols which don't have the notion of ports, such as GRE." msgstr "Then a corresponding SNAT rule is created to NAT outgoing traffic for the internal IP to a reserved external IP. This dedicates an external IP address to an internal IP address and is useful for protocols which don't have the notion of ports, such as GRE." -#: ../../configuration/interfaces/openvpn.rst:307 +#: ../../configuration/interfaces/openvpn.rst:359 msgid "Then we need to generate, add and specify the names of the cryptographic materials. Each of the install command should be applied to the configuration and commited before using under the openvpn interface configuration." msgstr "Then we need to generate, add and specify the names of the cryptographic materials. Each of the install command should be applied to the configuration and commited before using under the openvpn interface configuration." +#: ../../configuration/interfaces/openvpn.rst:196 +msgid "Then you need to install the key on the remote router:" +msgstr "Then you need to install the key on the remote router:" + +#: ../../configuration/interfaces/openvpn.rst:202 +msgid "Then you need to set the key in your OpenVPN interface settings:" +msgstr "Then you need to set the key in your OpenVPN interface settings:" + #: ../../configuration/interfaces/openvpn.rst:24 msgid "There's a variety of client GUI frontends for any platform" msgstr "There's a variety of client GUI frontends for any platform" @@ -14055,7 +14163,7 @@ msgstr "There's a variety of client GUI frontends for any platform" msgid "There are 3 default NTP server set. You are able to change them." msgstr "There are 3 default NTP server set. You are able to change them." -#: ../../configuration/firewall/general.rst:541 +#: ../../configuration/firewall/general.rst:543 #: ../../configuration/firewall/general-legacy.rst:380 msgid "There are a lot of matching criteria against which the package can be tested." msgstr "There are a lot of matching criteria against which the package can be tested." @@ -15265,17 +15373,17 @@ msgstr "This command will generate a default-route in L1 database." msgid "This command will generate a default-route in L2 database." msgstr "This command will generate a default-route in L2 database." -#: ../../configuration/firewall/general.rst:1419 -#: ../../configuration/firewall/general-legacy.rst:901 +#: ../../configuration/firewall/general.rst:1464 +#: ../../configuration/firewall/general-legacy.rst:904 msgid "This command will give an overview of a rule in a single rule-set" msgstr "This command will give an overview of a rule in a single rule-set" -#: ../../configuration/firewall/general-legacy.rst:937 +#: ../../configuration/firewall/general-legacy.rst:940 msgid "This command will give an overview of a rule in a single rule-set." msgstr "This command will give an overview of a rule in a single rule-set." -#: ../../configuration/firewall/general.rst:1397 -#: ../../configuration/firewall/general-legacy.rst:929 +#: ../../configuration/firewall/general.rst:1442 +#: ../../configuration/firewall/general-legacy.rst:932 msgid "This command will give an overview of a single rule-set." msgstr "This command will give an overview of a single rule-set." @@ -15402,8 +15510,8 @@ msgstr "This example shows how to target an MSS clamp (in our example to 1360 by msgid "This feature summarises originated external LSAs (Type-5 and Type-7). Summary Route will be originated on-behalf of all matched external LSAs." msgstr "This feature summarises originated external LSAs (Type-5 and Type-7). Summary Route will be originated on-behalf of all matched external LSAs." -#: ../../configuration/firewall/general.rst:631 -#: ../../configuration/firewall/general-legacy.rst:430 +#: ../../configuration/firewall/general.rst:633 +#: ../../configuration/firewall/general-legacy.rst:431 msgid "This functions for both individual addresses and address groups." msgstr "This functions for both individual addresses and address groups." @@ -15643,7 +15751,7 @@ msgstr "This prompted some ISPs to develop a policy within the :abbr:`ARIN (Amer msgid "This required setting defines the action of the current rule. If action is set to ``jump``, then ``jump-target`` is also needed." msgstr "This required setting defines the action of the current rule. If action is set to ``jump``, then ``jump-target`` is also needed." -#: ../../configuration/firewall/general.rst:365 +#: ../../configuration/firewall/general.rst:367 msgid "This required setting defines the action of the current rule. If action is set to jump, then jump-target is also needed." msgstr "This required setting defines the action of the current rule. If action is set to jump, then jump-target is also needed." @@ -15689,15 +15797,15 @@ msgstr "This section needs improvements, examples and explanations." msgid "This set the default action of the rule-set if no rule matched a packet criteria. If defacult-action is set to ``jump``, then ``default-jump-target`` is also needed." msgstr "This set the default action of the rule-set if no rule matched a packet criteria. If defacult-action is set to ``jump``, then ``default-jump-target`` is also needed." -#: ../../configuration/firewall/general.rst:397 +#: ../../configuration/firewall/general.rst:399 msgid "This set the default action of the rule-set if no rule matched a packet criteria. If defacult-action is set to ``jump``, then ``default-jump-target`` is also needed. Note that for base chains, default action can only be set to ``accept`` or ``drop``, while on custom chain, more actions are available." msgstr "This set the default action of the rule-set if no rule matched a packet criteria. If defacult-action is set to ``jump``, then ``default-jump-target`` is also needed. Note that for base chains, default action can only be set to ``accept`` or ``drop``, while on custom chain, more actions are available." -#: ../../configuration/interfaces/openvpn.rst:226 +#: ../../configuration/interfaces/openvpn.rst:278 msgid "This sets the accepted ciphers to use when version => 2.4.0 and NCP is enabled (which is the default). Default NCP cipher for versions >= 2.4.0 is aes256gcm. The first cipher in this list is what server pushes to clients." msgstr "This sets the accepted ciphers to use when version => 2.4.0 and NCP is enabled (which is the default). Default NCP cipher for versions >= 2.4.0 is aes256gcm. The first cipher in this list is what server pushes to clients." -#: ../../configuration/interfaces/openvpn.rst:208 +#: ../../configuration/interfaces/openvpn.rst:260 msgid "This sets the cipher when NCP (Negotiable Crypto Parameters) is disabled or OpenVPN version < 2.4.0." msgstr "This sets the cipher when NCP (Negotiable Crypto Parameters) is disabled or OpenVPN version < 2.4.0." @@ -15797,22 +15905,22 @@ msgstr "This will match TCP traffic with source port 80." msgid "This will render the following ddclient_ configuration entry:" msgstr "This will render the following ddclient_ configuration entry:" -#: ../../configuration/firewall/general.rst:1276 -#: ../../configuration/firewall/general-legacy.rst:782 +#: ../../configuration/firewall/general.rst:1321 +#: ../../configuration/firewall/general-legacy.rst:785 msgid "This will show you a basic firewall overview" msgstr "This will show you a basic firewall overview" -#: ../../configuration/firewall/general-legacy.rst:933 +#: ../../configuration/firewall/general-legacy.rst:936 msgid "This will show you a rule-set statistic since the last boot." msgstr "This will show you a rule-set statistic since the last boot." -#: ../../configuration/firewall/general.rst:1441 -#: ../../configuration/firewall/general-legacy.rst:897 +#: ../../configuration/firewall/general.rst:1486 +#: ../../configuration/firewall/general-legacy.rst:900 msgid "This will show you a statistic of all rule-sets since the last boot." msgstr "This will show you a statistic of all rule-sets since the last boot." -#: ../../configuration/firewall/general.rst:1339 -#: ../../configuration/firewall/general-legacy.rst:848 +#: ../../configuration/firewall/general.rst:1384 +#: ../../configuration/firewall/general-legacy.rst:851 msgid "This will show you a summary of rule-sets and groups" msgstr "This will show you a summary of rule-sets and groups" @@ -15856,8 +15964,8 @@ msgstr "Time in seconds that the prefix will remain valid (default: 30 days)" msgid "Time is in minutes and defaults to 60." msgstr "Time is in minutes and defaults to 60." -#: ../../configuration/firewall/general.rst:1216 -#: ../../configuration/firewall/general-legacy.rst:719 +#: ../../configuration/firewall/general.rst:1218 +#: ../../configuration/firewall/general-legacy.rst:722 #: ../../configuration/policy/route.rst:225 msgid "Time to match the defined rule." msgstr "Time to match the defined rule." @@ -15907,12 +16015,12 @@ msgstr "To automatically assign the client an IP address as tunnel endpoint, a c msgid "To be used only when ``action`` is set to ``jump``. Use this command to specify jump target." msgstr "To be used only when ``action`` is set to ``jump``. Use this command to specify jump target." -#: ../../configuration/firewall/general.rst:406 +#: ../../configuration/firewall/general.rst:408 #: ../../configuration/firewall/general-legacy.rst:295 msgid "To be used only when ``defult-action`` is set to ``jump``. Use this command to specify jump target for default rule." msgstr "To be used only when ``defult-action`` is set to ``jump``. Use this command to specify jump target for default rule." -#: ../../configuration/firewall/general.rst:379 +#: ../../configuration/firewall/general.rst:381 msgid "To be used only when action is set to jump. Use this command to specify jump target." msgstr "To be used only when action is set to jump. Use this command to specify jump target." @@ -15960,7 +16068,7 @@ msgstr "To create more than one tunnel, use distinct UDP ports." msgid "To create routing table 100 and add a new default gateway to be used by traffic matching our route policy:" msgstr "To create routing table 100 and add a new default gateway to be used by traffic matching our route policy:" -#: ../../configuration/firewall/zone.rst:51 +#: ../../configuration/firewall/zone.rst:61 msgid "To define a zone setup either one with interfaces or a local zone." msgstr "To define a zone setup either one with interfaces or a local zone." @@ -16134,7 +16242,7 @@ msgstr "Traffic Filters are used to control which packets will have the defined msgid "Traffic Policy" msgstr "Traffic Policy" -#: ../../configuration/firewall/zone.rst:27 +#: ../../configuration/firewall/zone.rst:37 msgid "Traffic cannot flow between zone member interface and any interface that is not a zone member." msgstr "Traffic cannot flow between zone member interface and any interface that is not a zone member." @@ -16146,6 +16254,10 @@ msgstr "Traffic from multicast sources will go to the Rendezvous Point, and rece msgid "Traffic from multicast sources will go to the Rendezvous Point, and receivers will pull it from a shared tree using MLD (Multicast Listener Discovery)." msgstr "Traffic from multicast sources will go to the Rendezvous Point, and receivers will pull it from a shared tree using MLD (Multicast Listener Discovery)." +#: ../../configuration/firewall/general.rst:1288 +msgid "Traffic must be symmetric" +msgstr "Traffic must be symmetric" + #: ../../configuration/highavailability/index.rst:322 msgid "Transition scripts" msgstr "Transition scripts" @@ -16158,7 +16270,6 @@ msgstr "Transition scripts can help you implement various fixups, such as starti msgid "Transparent Proxy" msgstr "Transparent Proxy" -#: ../../configuration/interfaces/openvpn.rst:649 #: ../../configuration/interfaces/tunnel.rst:227 msgid "Troubleshooting" msgstr "Troubleshooting" @@ -16256,6 +16367,10 @@ msgstr "Unit of this command is MB." msgid "Units" msgstr "Units" +#: ../../configuration/interfaces/openvpn.rst:171 +msgid "Until VyOS 1.4, the only option for site-to-site OpenVPN without PKI was to use pre-shared keys. That option is still available but it is deprecated and will be removed in the future. However, if you need to set up a tunnel to an older VyOS version or a system with older OpenVPN, you need to still need to know how to use it." +msgstr "Until VyOS 1.4, the only option for site-to-site OpenVPN without PKI was to use pre-shared keys. That option is still available but it is deprecated and will be removed in the future. However, if you need to set up a tunnel to an older VyOS version or a system with older OpenVPN, you need to still need to know how to use it." + #: ../../configuration/trafficpolicy/index.rst:705 msgid "Up to seven queues -defined as classes_ with different priorities- can be configured. Packets are placed into queues based on associated match criteria. Packets are transmitted from the queues in priority order. If classes with a higher priority are being filled with packets continuously, packets from lower priority classes will only be transmitted after traffic volume from higher priority classes decreases." msgstr "Up to seven queues -defined as classes_ with different priorities- can be configured. Packets are placed into queues based on associated match criteria. Packets are transmitted from the queues in priority order. If classes with a higher priority are being filled with packets continuously, packets from lower priority classes will only be transmitted after traffic volume from higher priority classes decreases." @@ -16268,8 +16383,8 @@ msgstr "Update" msgid "Update container image" msgstr "Update container image" -#: ../../configuration/firewall/general.rst:1502 -#: ../../configuration/firewall/general-legacy.rst:1047 +#: ../../configuration/firewall/general.rst:1547 +#: ../../configuration/firewall/general-legacy.rst:1050 msgid "Update geoip database" msgstr "Update geoip database" @@ -16322,28 +16437,28 @@ msgstr "Use `delete system conntrack modules` to deactive all modules." msgid "Use a persistent LDAP connection. Normally the LDAP connection is only open while validating a username to preserve resources at the LDAP server. This option causes the LDAP connection to be kept open, allowing it to be reused for further user validations." msgstr "Use a persistent LDAP connection. Normally the LDAP connection is only open while validating a username to preserve resources at the LDAP server. This option causes the LDAP connection to be kept open, allowing it to be reused for further user validations." -#: ../../configuration/firewall/general.rst:804 -#: ../../configuration/firewall/general-legacy.rst:528 +#: ../../configuration/firewall/general.rst:806 +#: ../../configuration/firewall/general-legacy.rst:531 msgid "Use a specific address-group. Prepend character ``!`` for inverted matching criteria." msgstr "Use a specific address-group. Prepend character ``!`` for inverted matching criteria." -#: ../../configuration/firewall/general.rst:879 -#: ../../configuration/firewall/general-legacy.rst:564 +#: ../../configuration/firewall/general.rst:881 +#: ../../configuration/firewall/general-legacy.rst:567 msgid "Use a specific domain-group. Prepend character ``!`` for inverted matching criteria." msgstr "Use a specific domain-group. Prepend character ``!`` for inverted matching criteria." -#: ../../configuration/firewall/general.rst:904 -#: ../../configuration/firewall/general-legacy.rst:576 +#: ../../configuration/firewall/general.rst:906 +#: ../../configuration/firewall/general-legacy.rst:579 msgid "Use a specific mac-group. Prepend character ``!`` for inverted matching criteria." msgstr "Use a specific mac-group. Prepend character ``!`` for inverted matching criteria." -#: ../../configuration/firewall/general.rst:829 -#: ../../configuration/firewall/general-legacy.rst:540 +#: ../../configuration/firewall/general.rst:831 +#: ../../configuration/firewall/general-legacy.rst:543 msgid "Use a specific network-group. Prepend character ``!`` for inverted matching criteria." msgstr "Use a specific network-group. Prepend character ``!`` for inverted matching criteria." -#: ../../configuration/firewall/general.rst:854 -#: ../../configuration/firewall/general-legacy.rst:552 +#: ../../configuration/firewall/general.rst:856 +#: ../../configuration/firewall/general-legacy.rst:555 msgid "Use a specific port-group. Prepend character ``!`` for inverted matching criteria." msgstr "Use a specific port-group. Prepend character ``!`` for inverted matching criteria." @@ -16386,7 +16501,7 @@ msgstr "Use auth key file at ``/config/auth/my.key``" msgid "Use configured `<url>` to determine your IP address. ddclient_ will load `<url>` and tries to extract your IP address from the response." msgstr "Use configured `<url>` to determine your IP address. ddclient_ will load `<url>` and tries to extract your IP address from the response." -#: ../../configuration/firewall/general-legacy.rst:475 +#: ../../configuration/firewall/general-legacy.rst:478 msgid "Use inverse-match to match anything except the given country-codes." msgstr "Use inverse-match to match anything except the given country-codes." @@ -16478,15 +16593,15 @@ msgstr "Use this command to allow the selected interface to join a multicast gro msgid "Use this command to allow the selected interface to join a source-specific multicast group." msgstr "Use this command to allow the selected interface to join a source-specific multicast group." -#: ../../configuration/interfaces/openvpn.rst:660 +#: ../../configuration/interfaces/openvpn.rst:712 msgid "Use this command to check the tunnel status for OpenVPN client interfaces." msgstr "Use this command to check the tunnel status for OpenVPN client interfaces." -#: ../../configuration/interfaces/openvpn.rst:664 +#: ../../configuration/interfaces/openvpn.rst:716 msgid "Use this command to check the tunnel status for OpenVPN server interfaces." msgstr "Use this command to check the tunnel status for OpenVPN server interfaces." -#: ../../configuration/interfaces/openvpn.rst:668 +#: ../../configuration/interfaces/openvpn.rst:720 msgid "Use this command to check the tunnel status for OpenVPN site-to-site interfaces." msgstr "Use this command to check the tunnel status for OpenVPN site-to-site interfaces." @@ -16878,7 +16993,7 @@ msgstr "Use this command to enable the local router to try and connect with a ta msgid "Use this command to enable the logging of the default action." msgstr "Use this command to enable the logging of the default action." -#: ../../configuration/firewall/general.rst:436 +#: ../../configuration/firewall/general.rst:438 msgid "Use this command to enable the logging of the default action on custom chains." msgstr "Use this command to enable the logging of the default action on custom chains." @@ -16886,7 +17001,7 @@ msgstr "Use this command to enable the logging of the default action on custom c msgid "Use this command to flush the kernel IPv6 route cache. An address can be added to flush it only for that route." msgstr "Use this command to flush the kernel IPv6 route cache. An address can be added to flush it only for that route." -#: ../../configuration/firewall/general-legacy.rst:945 +#: ../../configuration/firewall/general-legacy.rst:948 msgid "Use this command to get an overview of a zone." msgstr "Use this command to get an overview of a zone." @@ -16931,11 +17046,11 @@ msgstr "Use this command to reset IPv6 Neighbor Discovery Protocol cache for an msgid "Use this command to reset an LDP neighbor/TCP session that is established" msgstr "Use this command to reset an LDP neighbor/TCP session that is established" -#: ../../configuration/interfaces/openvpn.rst:683 +#: ../../configuration/interfaces/openvpn.rst:735 msgid "Use this command to reset the OpenVPN process on a specific interface." msgstr "Use this command to reset the OpenVPN process on a specific interface." -#: ../../configuration/interfaces/openvpn.rst:679 +#: ../../configuration/interfaces/openvpn.rst:731 msgid "Use this command to reset the specified OpenVPN client." msgstr "Use this command to reset the specified OpenVPN client." @@ -17095,7 +17210,7 @@ msgstr "User-level messages" msgid "Using 'soft-reconfiguration' we get the policy update without bouncing the neighbor." msgstr "Using 'soft-reconfiguration' we get the policy update without bouncing the neighbor." -#: ../../configuration/interfaces/openvpn.rst:294 +#: ../../configuration/interfaces/openvpn.rst:346 msgid "Using **openvpn-option -reneg-sec** can be tricky. This option is used to renegotiate data channel after n seconds. When used at both server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur." msgstr "Using **openvpn-option -reneg-sec** can be tricky. This option is used to renegotiate data channel after n seconds. When used at both server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur." @@ -17184,19 +17299,23 @@ msgstr "VPN-clients will request configuration parameters, optionally you can DN msgid "VRF" msgstr "VRF" -#: ../../configuration/vrf/index.rst:373 +#: ../../configuration/vrf/index.rst:409 msgid "VRF Route Leaking" msgstr "VRF Route Leaking" -#: ../../configuration/vrf/index.rst:342 +#: ../../configuration/vrf/index.rst:283 +msgid "VRF and NAT" +msgstr "VRF and NAT" + +#: ../../configuration/vrf/index.rst:378 msgid "VRF blue routing table" msgstr "VRF blue routing table" -#: ../../configuration/vrf/index.rst:309 +#: ../../configuration/vrf/index.rst:345 msgid "VRF default routing table" msgstr "VRF default routing table" -#: ../../configuration/vrf/index.rst:325 +#: ../../configuration/vrf/index.rst:361 msgid "VRF red routing table" msgstr "VRF red routing table" @@ -17391,7 +17510,7 @@ msgstr "VyOS can also run in DMVPN spoke mode." msgid "VyOS can be configured to track connections using the connection tracking subsystem. Connection tracking becomes operational once either stateful firewall or NAT is configured." msgstr "VyOS can be configured to track connections using the connection tracking subsystem. Connection tracking becomes operational once either stateful firewall or NAT is configured." -#: ../../configuration/interfaces/openvpn.rst:521 +#: ../../configuration/interfaces/openvpn.rst:573 msgid "VyOS can not only act as an OpenVPN site-to-site or server for multiple clients. You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client connecting to a VyOS OpenVPN server or any other OpenVPN server." msgstr "VyOS can not only act as an OpenVPN site-to-site or server for multiple clients. You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client connecting to a VyOS OpenVPN server or any other OpenVPN server." @@ -17481,7 +17600,7 @@ msgstr "VyOS provides policies commands exclusively for BGP traffic filtering an msgid "VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: **large-community-list** is one of them." msgstr "VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: **large-community-list** is one of them." -#: ../../configuration/interfaces/openvpn.rst:651 +#: ../../configuration/interfaces/openvpn.rst:703 msgid "VyOS provides some operational commands on OpenVPN." msgstr "VyOS provides some operational commands on OpenVPN." @@ -17584,6 +17703,10 @@ msgstr "Warning" msgid "Warning conditions" msgstr "Warning conditions" +#: ../../configuration/interfaces/openvpn.rst:54 +msgid "We'll configure OpenVPN using self-signed certificates, and then discuss the legacy pre-shared key mode." +msgstr "We'll configure OpenVPN using self-signed certificates, and then discuss the legacy pre-shared key mode." + #: ../../configuration/nat/nat44.rst:760 msgid "We'll use the IKE and ESP groups created above for this VPN. Because we need access to 2 different subnets on the far side, we will need two different tunnels. If you changed the names of the ESP group and IKE group in the previous step, make sure you use the correct names here too." msgstr "We'll use the IKE and ESP groups created above for this VPN. Because we need access to 2 different subnets on the far side, we will need two different tunnels. If you changed the names of the ESP group and IKE group in the previous step, make sure you use the correct names here too." @@ -17608,7 +17731,7 @@ msgstr "We can build route-maps for import based on these states. Here is a simp msgid "We could expand on this and also deny link local and multicast in the rule 20 action deny." msgstr "We could expand on this and also deny link local and multicast in the rule 20 action deny." -#: ../../configuration/interfaces/openvpn.rst:581 +#: ../../configuration/interfaces/openvpn.rst:633 msgid "We do not have CLI nodes for every single OpenVPN option. If an option is missing, a feature request should be opened at Phabricator_ so all users can benefit from it (see :ref:`issues_features`)." msgstr "We do not have CLI nodes for every single OpenVPN option. If an option is missing, a feature request should be opened at Phabricator_ so all users can benefit from it (see :ref:`issues_features`)." @@ -17704,7 +17827,7 @@ msgstr "When configuring your filter, you can use the ``Tab`` key to see the man msgid "When configuring your traffic policy, you will have to set data rate values, watch out the units you are managing, it is easy to get confused with the different prefixes and suffixes you can use. VyOS will always show you the different units you can use." msgstr "When configuring your traffic policy, you will have to set data rate values, watch out the units you are managing, it is easy to get confused with the different prefixes and suffixes you can use. VyOS will always show you the different units you can use." -#: ../../configuration/firewall/general.rst:526 +#: ../../configuration/firewall/general.rst:528 msgid "When defining a rule, it is enable by default. In some cases, it is useful to just disable the rule, rather than removing it." msgstr "When defining a rule, it is enable by default. In some cases, it is useful to just disable the rule, rather than removing it." @@ -17931,11 +18054,11 @@ msgstr "While normal GRE is for layer 3, GRETAP is for layer 2. GRETAP can encap msgid "Whitelist of addresses and networks. Always allow inbound connections from these systems." msgstr "Whitelist of addresses and networks. Always allow inbound connections from these systems." -#: ../../configuration/interfaces/openvpn.rst:590 +#: ../../configuration/interfaces/openvpn.rst:642 msgid "Will add ``persistent-key`` at the end of the generated OpenVPN configuration. Please use this only as last resort - things might break and OpenVPN won't start if you pass invalid options/syntax." msgstr "Will add ``persistent-key`` at the end of the generated OpenVPN configuration. Please use this only as last resort - things might break and OpenVPN won't start if you pass invalid options/syntax." -#: ../../configuration/interfaces/openvpn.rst:597 +#: ../../configuration/interfaces/openvpn.rst:649 msgid "Will add ``push \"keepalive 1 10\"`` to the generated OpenVPN config file." msgstr "Will add ``push \"keepalive 1 10\"`` to the generated OpenVPN config file." @@ -18024,7 +18147,7 @@ msgstr "With this command, you can specify how the URL path should be matched ag msgid "Y" msgstr "Y" -#: ../../configuration/firewall/zone.rst:89 +#: ../../configuration/firewall/zone.rst:99 msgid "You apply a rule-set always to a zone from an other zone, it is recommended to create one rule-set for each zone pair." msgstr "You apply a rule-set always to a zone from an other zone, it is recommended to create one rule-set for each zone pair." @@ -18142,7 +18265,7 @@ msgstr "You can specify a static DHCP assignment on a per host basis. You will n msgid "You can test the SNMPv3 functionality from any linux based system, just run the following command: ``snmpwalk -v 3 -u vyos -a SHA -A vyos12345678 -x AES -X vyos12345678 -l authPriv 192.0.2.1 .1``" msgstr "You can test the SNMPv3 functionality from any linux based system, just run the following command: ``snmpwalk -v 3 -u vyos -a SHA -A vyos12345678 -x AES -X vyos12345678 -l authPriv 192.0.2.1 .1``" -#: ../../configuration/firewall/general-legacy.rst:771 +#: ../../configuration/firewall/general-legacy.rst:774 msgid "You can use wildcard ``*`` to match a group of interfaces." msgstr "You can use wildcard ``*`` to match a group of interfaces." @@ -18158,6 +18281,10 @@ msgstr "You can view that the policy is being correctly (or incorrectly) utilise msgid "You cannot easily redistribute IPv6 routes via OSPFv3 on a WireGuard interface link. This requires you to configure link-local addresses manually on the WireGuard interfaces, see :vytask:`T1483`." msgstr "You cannot easily redistribute IPv6 routes via OSPFv3 on a WireGuard interface link. This requires you to configure link-local addresses manually on the WireGuard interfaces, see :vytask:`T1483`." +#: ../../configuration/interfaces/openvpn.rst:119 +msgid "You do **not** need to copy the certificate to the other router. Instead, you need to retrieve its SHA-256 fingerprint. OpenVPN only supports SHA-256 fingerprints at the moment, so you need to use the following command:" +msgstr "You do **not** need to copy the certificate to the other router. Instead, you need to retrieve its SHA-256 fingerprint. OpenVPN only supports SHA-256 fingerprints at the moment, so you need to use the following command:" + #: ../../configuration/system/flow-accounting.rst:135 msgid "You may also additionally configure timeouts for different types of connections." msgstr "You may also additionally configure timeouts for different types of connections." @@ -18170,7 +18297,7 @@ msgstr "You may prefer locally configured capabilities more than the negotiated msgid "You may want to disable sending Capability Negotiation OPEN message optional parameter to the peer when remote peer does not implement Capability Negotiation. Please use :cfgcmd:`disable-capability-negotiation` command to disable the feature." msgstr "You may want to disable sending Capability Negotiation OPEN message optional parameter to the peer when remote peer does not implement Capability Negotiation. Please use :cfgcmd:`disable-capability-negotiation` command to disable the feature." -#: ../../configuration/firewall/zone.rst:29 +#: ../../configuration/firewall/zone.rst:39 msgid "You need 2 separate firewalls to define traffic: one for each direction." msgstr "You need 2 separate firewalls to define traffic: one for each direction." @@ -18190,7 +18317,7 @@ msgstr "You now see the longer AS path." msgid "You should add a firewall to your configuration above as well by assigning it to the pppoe0 itself as shown here:" msgstr "You should add a firewall to your configuration above as well by assigning it to the pppoe0 itself as shown here:" -#: ../../configuration/interfaces/openvpn.rst:175 +#: ../../configuration/interfaces/openvpn.rst:227 #: ../../configuration/interfaces/wireguard.rst:225 msgid "You should also ensure that the OUTISDE_LOCAL firewall group is applied to the WAN interface and a direction (local)." msgstr "You should also ensure that the OUTISDE_LOCAL firewall group is applied to the WAN interface and a direction (local)." @@ -18215,7 +18342,7 @@ msgstr "Zebra/Kernel route filtering" msgid "Zebra supports prefix-lists and Route Mapss to match routes received from other FRR components. The permit/deny facilities provided by these commands can be used to filter which routes zebra will install in the kernel." msgstr "Zebra supports prefix-lists and Route Mapss to match routes received from other FRR components. The permit/deny facilities provided by these commands can be used to filter which routes zebra will install in the kernel." -#: ../../configuration/firewall/general-legacy.rst:941 +#: ../../configuration/firewall/general-legacy.rst:944 msgid "Zone-Policy Overview" msgstr "Zone-Policy Overview" @@ -18314,7 +18441,7 @@ msgstr ":abbr:`IPSec (IP Security)` - too many RFCs to list, but start with :rfc msgid ":abbr:`IS-IS (Intermediate System to Intermediate System)` is a link-state interior gateway protocol (IGP) which is described in ISO10589, :rfc:`1195`, :rfc:`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) algorithm to create a database of the network’s topology, and from that database to determine the best (that is, lowest cost) path to a destination. The intermediate systems (the name for routers) exchange topology information with their directly conencted neighbors. IS-IS runs directly on the data link layer (Layer 2). IS-IS addresses are called :abbr:`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are generally 10 bytes long. The tree database that is created with IS-IS is similar to the one that is created with OSPF in that the paths chosen should be similar. Comparisons to OSPF are inevitable and often are reasonable ones to make in regards to the way a network will respond with either IGP." msgstr ":abbr:`IS-IS (Intermediate System to Intermediate System)` is a link-state interior gateway protocol (IGP) which is described in ISO10589, :rfc:`1195`, :rfc:`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) algorithm to create a database of the network’s topology, and from that database to determine the best (that is, lowest cost) path to a destination. The intermediate systems (the name for routers) exchange topology information with their directly conencted neighbors. IS-IS runs directly on the data link layer (Layer 2). IS-IS addresses are called :abbr:`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are generally 10 bytes long. The tree database that is created with IS-IS is similar to the one that is created with OSPF in that the paths chosen should be similar. Comparisons to OSPF are inevitable and often are reasonable ones to make in regards to the way a network will respond with either IGP." -#: ../../configuration/vrf/index.rst:363 +#: ../../configuration/vrf/index.rst:399 msgid ":abbr:`L3VPN VRFs ( Layer 3 Virtual Private Networks )` bgpd supports for IPv4 RFC 4364 and IPv6 RFC 4659. L3VPN routes, and their associated VRF MPLS labels, can be distributed to VPN SAFI neighbors in the default, i.e., non VRF, BGP instance. VRF MPLS labels are reached using core MPLS labels which are distributed using LDP or BGP labeled unicast. bgpd also supports inter-VRF route leaking." msgstr ":abbr:`L3VPN VRFs ( Layer 3 Virtual Private Networks )` bgpd supports for IPv4 RFC 4364 and IPv6 RFC 4659. L3VPN routes, and their associated VRF MPLS labels, can be distributed to VPN SAFI neighbors in the default, i.e., non VRF, BGP instance. VRF MPLS labels are reached using core MPLS labels which are distributed using LDP or BGP labeled unicast. bgpd also supports inter-VRF route leaking." @@ -19096,7 +19223,7 @@ msgstr "``ikev2-reauth`` whether rekeying of an IKE_SA should also reauthenticat msgid "``ikev2`` use IKEv2 for Key Exchange;" msgstr "``ikev2`` use IKEv2 for Key Exchange;" -#: ../../configuration/firewall/general-legacy.rst:748 +#: ../../configuration/firewall/general-legacy.rst:751 msgid "``in``: Ruleset for forwarded packets on an inbound interface" msgstr "``in``: Ruleset for forwarded packets on an inbound interface" @@ -19184,7 +19311,7 @@ msgstr "``local-as`` - Well-known communities value NO_EXPOR msgid "``local-id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;" msgstr "``local-id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;" -#: ../../configuration/firewall/general-legacy.rst:750 +#: ../../configuration/firewall/general-legacy.rst:753 msgid "``local``: Ruleset for packets destined for this router" msgstr "``local``: Ruleset for packets destined for this router" @@ -19352,7 +19479,7 @@ msgstr "``ospf`` - Open Shortest Path First (OSPFv2)" msgid "``ospfv3`` - Open Shortest Path First (IPv6) (OSPFv3)" msgstr "``ospfv3`` - Open Shortest Path First (IPv6) (OSPFv3)" -#: ../../configuration/firewall/general-legacy.rst:749 +#: ../../configuration/firewall/general-legacy.rst:752 msgid "``out``: Ruleset for forwarded packets on an outbound interface" msgstr "``out``: Ruleset for forwarded packets on an outbound interface" @@ -19554,6 +19681,10 @@ msgstr "``static`` - Statically configured routes" msgid "``station`` - Connects to another access point" msgstr "``station`` - Connects to another access point" +#: ../../configuration/firewall/general.rst:354 +msgid "``synproxy``: synproxy the packet." +msgstr "``synproxy``: synproxy the packet." + #: ../../configuration/system/sysctl.rst:9 msgid "``sysctl`` is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/." msgstr "``sysctl`` is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/." @@ -19693,7 +19824,7 @@ msgstr "alert" msgid "all" msgstr "all" -#: ../../configuration/vrf/index.rst:390 +#: ../../configuration/vrf/index.rst:426 msgid "an RD / RTLIST" msgstr "an RD / RTLIST" @@ -19963,7 +20094,7 @@ msgstr "host: single host IP address to match." msgid "https://access.redhat.com/sites/default/files/attachments/201501-perf-brief-low-latency-tuning-rhel7-v2.1.pdf" msgstr "https://access.redhat.com/sites/default/files/attachments/201501-perf-brief-low-latency-tuning-rhel7-v2.1.pdf" -#: ../../configuration/interfaces/openvpn.rst:623 +#: ../../configuration/interfaces/openvpn.rst:675 msgid "https://community.openvpn.net/openvpn/wiki/DataChannelOffload/Features" msgstr "https://community.openvpn.net/openvpn/wiki/DataChannelOffload/Features" |