vyos-1x.git/interface-definitions/include/firewall/common-rule-inet.xml.i, branch circinus-public-unmaintainedVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=circinus-public-unmaintained2024-05-15T17:09:16+00:00T3900: add support for raw table in firewall.2024-05-15T17:09:16+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-15T17:09:16+00:00urn:sha1:6871c5541c1962e63d7a9b75d2bb43df2a8d372bxml: T5738: use generic-disable-node building block for "disable" CLI nodes2024-03-05T19:20:27+00:00Christian Breunigchristian@breunig.cc2024-03-05T19:20:27+00:00urn:sha1:21b0bf0168697fdbe514ae49a4a28b39a91ec777
Make the code more uniform and maintainable.
T5977: firewall: remove ipsec options in output chain rule definitions, since it's not supported.2024-01-23T18:43:34+00:00Nicolas Fortnicolasfort1988@gmail.com2024-01-23T18:43:34+00:00urn:sha1:9d490ecf616eb9d019beee37a3802705c4109d9dfirewall: T5834: Improve log message and simplify log-option include2023-12-27T03:49:51+00:00Indrajit Raychaudhuriirc@indrajit.com2023-12-22T23:22:20+00:00urn:sha1:53a48f499ae9bcc2f657136bb7779b38aad1c242
`include/firewall/rule-log-options.xml.i` is now more aptly renamed to
`include/firewall/log-options.xml.i`.
T5729: firewall: switch to valueless in order to remove unnecessary <enable|disable> commands; log and state moved to new syntax.2023-11-10T19:26:35+00:00Nicolas Fortnicolasfort1988@gmail.com2023-11-10T19:26:35+00:00urn:sha1:c4409d6a4e11bf2acc7b5b96888e2c471c4559e5T5616: firewall: add option to be able to match firewall marks in firewall filter and in policy route.2023-09-29T11:15:59+00:00Nicolas Fortnicolasfort1988@gmail.com2023-09-27T17:41:14+00:00urn:sha1:2ae3de0848dee0f3da28727fc30e2beeecd412e1Merge pull request #2295 from sever-sever/T5217-synproxy2023-09-28T15:02:33+00:00Christian Breunigchristian@breunig.cc2023-09-28T15:02:33+00:00urn:sha1:852e9c3328e61f5d0b92a9efca376aec94533f2b
T5217: Add firewall synproxyfirewall: T5614: Add support for matching on conntrack helper2023-09-24T14:44:32+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2023-09-24T12:38:12+00:00urn:sha1:81dee963a9ca3224ddbd54767a36efae5851a001T5217: Add firewall synproxy2023-09-21T12:30:39+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-09-20T11:46:42+00:00urn:sha1:bdad4e046872e054ec7783b2f04b73a8a690a045
Add ability to SYNPROXY connections
It is useful to protect against TCP SYN flood attacks and port-scanners
set firewall global-options syn-cookies 'enable'
set firewall ipv4 input filter rule 10 action 'synproxy'
set firewall ipv4 input filter rule 10 destination port '22'
set firewall ipv4 input filter rule 10 inbound-interface interface-name 'eth1'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
conntrack: T5217: Add tcp flag matching to `system conntrack ignore`2023-09-18T18:26:51+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2023-09-18T18:24:22+00:00urn:sha1:fb3ef9af5e394aa25692003fb3c185bfedefe3cb
- Moves MSS node out of `tcp-flags.xml.i` and into `tcp-mss.xml.i`
- Update smoketest to verify TCP flag matching