VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling 2026-09-29T21:33:24+00:00 2026-09-29T21:33:24+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-28T14:02:20+00:00 urn:sha1:12d3aa212f35b8cdd9a0ccd849b45beea46ed94d The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU full sized packets get fragmented on the underlay. Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is present. Reject "mtu" together with such an option, below 100, and below 1280 when IPv6 runs inside the tunnel. 2026-09-29T18:40:44+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-24T14:32:15+00:00 urn:sha1:b6abe23ba2d2a5d5055afd203bc3e60ee20bf757 "failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults. 2026-09-28T11:40:44+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-24T14:29:37+00:00 urn:sha1:aaeb1dae0498468226fb7ffce3a501f5b1037ded "keep-alive interval 0" turns the keepalive off, but site-to-site renders "ping" and "ping-restart" unguarded. A zero interval leaves "ping 0" with the restart timer still armed, so an idle tunnel tears itself down instead of running without keepalive. Leave both directives out when the interval is zero, as T9334 does for the server-mode "keepalive". 2026-09-18T09:10:41+00:00 Berik Ashimov berik@ashimov.com 2026-09-18T09:10:41+00:00 urn:sha1:f931a8703c7b9d421ded01636cd201bc3c466da5 An interval of 0 is how the CLI turns keepalive off, and it rendered "keepalive 0 0" because OpenVPN skipped its own sanity checks on that pair. OpenVPN 2.7.6 dropped the exception and now refuses to start: "keepalive ping: Must be an integer between 1 and 86400, not 0". Leave the directive out of the file instead. Nothing then sets ping or ping-restart, which is the keepalive-off the interval asked for, and a saved configuration still commits untouched. 2026-09-12T21:53:49+00:00 Antonio Quartulli antonio@mandelbit.com 2026-08-30T00:06:54+00:00 urn:sha1:b51420a777a4e54e72c63d0962f60e92bc016412 The CLI already defaults to "subnet", so this only adds the directive for bridged servers, which are tap only and where OpenVPN ignores it. Keeps the daemon on the CLI value rather than an upstream default. 2026-09-12T21:53:49+00:00 Antonio Quartulli antonio@mandelbit.com 2026-08-30T00:06:11+00:00 urn:sha1:8389fca5c8733fb11198702a4d35056c38100da4 2.7 refuses --secret unless --allow-deprecated-insecure-static-crypto is given. Without this every shared-secret-key site-to-site tunnel fails to start after the upgrade. 2026-06-19T11:27:43+00:00 Nataliia Solomko natalirs1985@gmail.com 2026-06-19T11:10:56+00:00 urn:sha1:e6c87a4697e2e80f056f745c6321f3015e76ff1b Emit `client-config-dir` when `reject-unconfigured-clients` is set, even without server client entries, so OpenVPN does not crash-loop. 2026-01-12T13:44:32+00:00 Oleksandr Kuchmystyi o.kuchmystyi@vyos.io 2025-12-31T07:50:21+00:00 urn:sha1:61487b13da8dc270907633a3140bd0cc2aa0926a - Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces (used as fallback cipher in site-to-site mode) - Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces 2024-08-14T04:47:05+00:00 Lucas Christian lucas@lucasec.com 2024-08-12T06:06:02+00:00 urn:sha1:18ea3673a105d9d12699afb2607c81412dde441b 2024-08-02T14:10:51+00:00 fett0 fernando.gmaidana@gmail.com 2024-08-02T14:10:51+00:00 urn:sha1:d5ae708581d453e2205ad4cf8576503f42e262b6