vyos-1x.git/data/templates/firewall, branch rolling

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

T8478: Fix typo in the firewall template bridge chain name

2026-04-13T14:00:29+00:00

Internal typo/cosmitic bug, no functional changes

T8410: Fix typos and mistakes for operational and configuration commands

2026-03-24T17:02:56+00:00

Fix typos and mistakes in the commands and comments No functional changes

T8383: fix extra space in nftables ipv6 output chain

2026-03-14T08:20:45+00:00

geoip: T7926: Refactor geoip handling

2026-01-21T10:52:29+00:00

* Move core logic to separate vyos.geoip module * Use a sqlite database for storing and querying address ranges by country * Remove downloaded geoip ranges once loaded into sqlite db * No longer rebuild geoip sets on each commit unless necessary * Allows for extensibility using other geoip data vendors

firewall: T7739: Default ruleset for firewall zones

2025-10-21T23:46:37+00:00

In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax: set firewall zone default_firewall name set firewall zone default_firewall ipv6_name The proposed behavior is the following: local in: The default firewall ruleset for the local zone will be appended after all from configurations. local out: If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname forward: The default firewall ruleset for the zone will be appended after all from configurations To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset. The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules.

Merge pull request #4698 from l0crian1/fw-disable-conntrack

2025-09-22T12:55:15+00:00

firewall: T7475: Add an option to disable conntrack for individual firewall chaisn

firewall: T7475: Remove redundant if statement in jinja template

2025-09-13T10:29:40+00:00

Firewall: T7475: Disable conntrack per firewall chain

2025-09-05T20:37:19+00:00

- Added command to disable conntrack per firewall chain - Added test_disable_conntrack_per_chain function to smoketest

firewall: T7452: update rule generation for Zone-based firewall

2025-06-30T06:28:40+00:00