VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling 2026-07-30T17:21:51+00:00 2026-07-30T17:21:51+00:00 Lee Clements lclements0@gmail.com 2026-07-22T19:53:20+00:00 urn:sha1:6d8a3ad9a87857d5994ec33982dd3db9a04fb8bd After the migration from pmacct to the ipt_NETFLOW kernel module the "system flow-accounting vrf" node no longer had any effect on the export path. NetFlow is emitted by the kernel module, so there is no daemon left to wrap in "ip vrf exec" and the module socket was never bound to the VRF. A collector reachable only inside a VRF therefore never received any flows when the export was configured with a source-address. Bind the export socket to a device via the ipt_NETFLOW "%device" destination suffix: a per-server source-interface takes precedence, otherwise the global VRF device is used, reproducing the previous "ip vrf exec" behaviour. The module parses "@source-address" before "%device", so the source-address is now rendered first - the previous template emitted them in the opposite order, which only worked because the two options are mutually exclusive per server. Reject a source-interface that is used together with a VRF but is not a member of that VRF: the exported flows would otherwise silently leave via a different routing table. This mirrors the existing OSPF, OSPFv3, IS-IS and BGP checks. 2025-09-16T10:00:56+00:00 Kyrylo Yatsenko hedrok@gmail.com 2025-08-27T14:49:12+00:00 urn:sha1:e992fb4ec3d65674c794bdcb961b62485fec8d50 * Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'