vyos-1x.git/interface-definitions, branch fix/T8955-http-api-verify-tls

openvpn: T9364: default the MTU to 1420 when DCO is enabled

2026-09-29T21:33:24+00:00

The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU full sized packets get fragmented on the underlay. Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is present. Reject "mtu" together with such an option, below 100, and below 1280 when IPv6 runs inside the tunnel.

Merge pull request #5496 from vyos/T9338-l3vpn-multi-domain-switching

2026-09-29T05:11:42+00:00

T9338: add bgp mpls l3vpn-multi-domain-switching

ntp: T8882: add per-server poll interval, presend and extension field options

2026-09-28T18:30:00+00:00

Poll intervals were left entirely to the NTP daemon's built-in defaults, so an operator could not widen or narrow the polling range for an individual server, warm up authenticated associations before a poll, or ask a peer for the higher resolution timestamps it may be able to provide. Each configured server and pool now accepts a minimum and maximum poll exponent, defaulting to the values the daemon already used, plus an optional presend exponent and a switch for the F323 extension field. Existing configurations render the same associations as before. Co-authored-by: Christian Breunig

Merge pull request #5389 from ruben-herold/T9175-security-poll-suffix

2026-09-28T09:43:06+00:00

dns: T9175: make PowerDNS security status poll opt-in

Merge pull request #5453 from m-songer/T9274-add-telegraf-config

2026-09-25T14:03:20+00:00

T9274: Add more telegraf configuration

Merge pull request #5484 from haakonnore/feat/T9319-vxlan-gbp

2026-09-24T17:06:31+00:00

vxlan: T9319: add VXLAN-GBP support

T9274: Add more telegraf configuration- #5453

2026-09-24T16:00:38+00:00

Added the ability to make several agent values configurable instead of hardcoded.

T9338: add bgp mpls l3vpn-multi-domain-switching

2026-09-24T06:40:37+00:00

Add command set protocols bgp interface mpls l3vpn-multi-domain-switching that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under interface node.

vxlan: T9319: add VXLAN-GBP support

2026-09-22T23:13:09+00:00

Expose the Group Policy extension as a valueless gbp CLI node and pass it to iproute2 when creating VXLAN links. Recreate links when GBP changes and reject configurations combining GBP with GPE. Reject conflicting GBP settings on a shared UDP port, accounting for address families and underlay VRF socket bindings. Warn that external mode carries GBP in tunnel metadata instead of the packet mark. Add smoketest coverage for GBP creation, removal and re-enabling, retained interface settings, rejection without changing the running tunnel, shared ports, separate address families, and external mode.

ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers

2026-09-16T08:22:40+00:00

VyOS does not expose the strongSwan `connections..unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own.