vyos-1x.git/smoketest/scripts/cli/test_firewall.py, branch rolling

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

geoip: T5746: Add GeoIP ASN support

2026-06-04T14:18:29+00:00

Merge pull request #5100 from sarthurdev/T8446

2026-04-21T13:19:46+00:00

firewall: T8446: Prevent chain with offload rule on local zone

firewall: T8275: Resolve migration issue for 'weekdays' option from 1.3.8

2026-04-01T08:54:31+00:00

Fix error parsing for day of week while loading firewall configuration.

firewall: T8446: Prevent chain with offload rule on local zone

2026-03-31T21:09:09+00:00

* Add warning when defining `offload-target` without setting action to `offload`

T8387: smoketest: add add-address-to-group destination-address checks

2026-03-17T10:07:32+00:00

Merge pull request #4672 from apschultz/zone_default_firewall_ruleset

2025-11-24T19:48:07+00:00

firewall: T7739: Default ruleset for firewall zones

firewall: T7112: Default action drop fails

2025-11-05T07:30:31+00:00

Prevent `KeyError` by safely handling missing 'member' dict in zone config. Add smoketest to verify commit fails gracefully when zone has no interfaces.

T7849: ZBF allow to use wildcard interfaces as member

2025-10-31T15:31:58+00:00

Allow to use wildcard interfaces for zone-based firewall It should allow interfaces like ipoe*/pppoe*/l2tp*

firewall: T7739: Default ruleset for firewall zones

2025-10-21T23:46:37+00:00

In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax: set firewall zone default_firewall name set firewall zone default_firewall ipv6_name The proposed behavior is the following: local in: The default firewall ruleset for the local zone will be appended after all from configurations. local out: If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname forward: The default firewall ruleset for the zone will be appended after all from configurations To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset. The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules.