vyos-1x.git/src/migration-scripts/firewall, branch rollingVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling2026-04-07T12:50:06+00:00Merge pull request #5103 from alexandr-san4ez/T8281-current2026-04-07T12:50:06+00:00Daniil Baturindaniil@vyos.io2026-04-07T12:50:06+00:00urn:sha1:b7d191cd3053a736fa14ebfefe7a95093b0fcacd
firewall: T8281: Normalize network prefixes in rule configurationfirewall: T8281: Normalize network prefixes in rule configuration2026-04-06T12:18:12+00:00Oleksandr Kuchmystyio.kuchmystyi@vyos.io2026-04-02T12:31:32+00:00urn:sha1:227699e62146c71c3a0d3923650edd247b20ef16
Convert non-canonical IPv4 and IPv6 prefixes in 'source/destination address'
fields to proper network addresses (e.g. 10.10.10.1/30 -> 10.10.10.0/30).
This prevents invalid configurations and ensures consistent prefix handling.
firewall: T8282: Normalize invalid network-group names during migration2026-04-03T13:03:33+00:00Oleksandr Kuchmystyio.kuchmystyi@vyos.io2026-04-03T12:14:39+00:00urn:sha1:fc33a96dd2394c0c6bb109f8e5a2d0c379aa1508
Replace unsupported characters (e.g. `,`, `+`) with `_` when migrating
from 1.3.x and handle name collisions safely to prevent commit failures.
Merge pull request #5082 from sever-sever/T84102026-03-25T19:15:35+00:00Christian Breunigchristian@breunig.cc2026-03-25T19:15:35+00:00urn:sha1:210547f31ef45e6bb42b44bdaa8a8864179a8bbc
T8410: Fix typos and mistakes for operational and configuration commandsfirewall: T8277: Resolve migration issue when using `port-group` with protocol 'all'2026-03-25T14:32:31+00:00Oleksandr Kuchmystyio.kuchmystyi@vyos.io2026-03-25T14:32:31+00:00urn:sha1:f8c5643b36bd0df630453d8b6e5e25c6df984ec4
Updated the migration script to ensure that when migrating firewall rules,
if a `port-group` exists, the protocol will be set to 'tcp_udp' only
when its previous value is 'all'.
T8410: Fix typos and mistakes for operational and configuration commands2026-03-24T17:02:56+00:00Viacheslav Hletenkov.gletenko@vyos.io2026-03-20T16:41:24+00:00urn:sha1:bb2aee1e58c1cd30087b935798060e6bf3c698c8
Fix typos and mistakes in the commands and comments
No functional changes
T7366: Firewall rules allow empty nodes2025-09-04T20:10:22+00:00l0crian1ryan.claridge13@gmail.com2025-08-07T17:44:01+00:00urn:sha1:abf12142d52abfd586081a1fa45a37143c23a25b
Added checks in the verify_rule() function of firewall.py for empty nodes.
Added migration script 19-to-20 to remove empty nodes from the config.
T7591: remove copyright years from source files2025-06-28T21:16:52+00:00Christian Breunigchristian@breunig.cc2025-06-28T18:51:21+00:00urn:sha1:1478516ae437f19ebeb7d6ff9b83dd74f8e76758
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
firewall: T6951: Add a configuration command for ethertypes that bridge firewalls should always accept2025-06-17T15:16:51+00:00Nataliia Solomkonatalirs1985@gmail.com2025-06-13T09:20:40+00:00urn:sha1:8dbc3c5e67cc1fd043a78dd3446a1a733ebd814fT6841: firewall: migrate existing VRF in zone based firewall2025-01-06T11:05:22+00:00Christian Breunigchristian@breunig.cc2025-01-06T10:56:53+00:00urn:sha1:dda428fc42c44decb3e661a7b6ba4e55b178dc4f
VRF support was introduced in VyOS 1.4.0. If a VRF is added as an interface in
the zone based firewall, it will be migrated to the new syntax.
OLD:
set firewall zone FOO interface RED
set firewall zone FOO interface eth0
NEW:
set firewall zone FOO member vrf RED
set firewall zone FOO member interface eth0