VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp 2026-03-04T04:48:18+00:00 2026-03-04T04:48:18+00:00 Giga Murphy giga1699@gmail.com 2026-01-02T01:04:38+00:00 urn:sha1:673ec335b885ae1de8391dd8c48a5fe16b282db5 2025-08-12T09:11:05+00:00 Oleksandr Kuchmystyi o.kuchmystyi@vyos.io 2025-07-31T10:41:56+00:00 urn:sha1:c84c7cf16bf4a0222690f4ac2d93dafc88a7a0f7 This commit makes `set vpn ipsec disable-uniqreqids` work with the modern StrongSwan backend by setting `unique=never` in swanctl.conf for connections. This restores legacy behavior about multiple connections with the same identity. 2024-11-21T13:34:51+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2024-11-19T17:44:58+00:00 urn:sha1:5c7647bcc242d4b26cd9afdde1f084ef93916727 Add the ability to configure base64 encoded passwords for VPN IPSec site-to-site peers authentication psk PSK secret 'xxxxx==' authentication psk PSK secret-type <base64|plaintext> 2024-07-22T17:57:45+00:00 Lucas Christian lucas@lucasec.com 2023-12-29T06:26:56+00:00 urn:sha1:4d2c89dcd50d3c158dc76ac5ab843dd66105bc02 2023-01-26T11:28:03+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2023-01-17T11:04:08+00:00 urn:sha1:7ae0b404ad9fdefa856c7e450b224b47d854a4eb Rewrite strongswan IPsec authentication to reflect structure from swanctl.conf The most important change is that more than one local/remote ID in the same auth entry should be allowed replace: 'ipsec site-to-site peer <tag> authentication pre-shared-secret xxx' => 'ipsec authentication psk <tag> secret xxx' set vpn ipsec authentication psk <tag> id '192.0.2.1' set vpn ipsec authentication psk <tag> id '192.0.2.2' set vpn ipsec authentication psk <tag> secret 'xxx' set vpn ipsec site-to-site peer <tag> authentication local-id '192.0.2.1' set vpn ipsec site-to-site peer <tag> authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer <tag> authentication remote-id '192.0.2.2' Add template filter for Jinja2 'generate_uuid4' 2022-09-16T11:53:41+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2022-08-10T19:51:48+00:00 urn:sha1:bd4588827b563022ce5fb98b1345b787b9194176 Migration and Change boolean nodes "enable/disable" to disable-xxxx, enable-xxxx and just xxx for VPN IPsec configurations - IKE changes: - replace 'ipsec ike-group <tag> mobike disable' => 'ipsec ike-group <tag> disable-mobike' - replace 'ipsec ike-group <tag> ikev2-reauth yes|no' => 'ipsec ike-group <tag> ikev2-reauth' - ESP changes: - replace 'ipsec esp-group <tag> compression enable' => 'ipsec esp-group <tag> compression' - PEER changes: - replace: 'peer <tag> id xxx' => 'peer <tag> local-id xxx' - replace: 'peer <tag> force-encapsulation enable' => 'peer <tag> force-udp-encapsulation' - add option: 'peer <tag> remote-address x.x.x.x' Add 'peer <name> remote-address <name>' via migration script 2022-05-02T04:32:56+00:00 Christian Poessinger christian@poessinger.com 2022-05-02T04:32:53+00:00 urn:sha1:318f81cba207dc5f180b074c2a7cdb4a4217e5fc 2022-05-01T17:44:52+00:00 Christian Poessinger christian@poessinger.com 2022-05-01T17:44:52+00:00 urn:sha1:49b1afc25b73d9c5daae1c76edb88aab42afa83e