summaryrefslogtreecommitdiff
path: root/src/etc/sysctl.d
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-11-20 10:13:21 +0100
committerChristian Breunig <christian@breunig.cc>2023-11-20 17:17:25 +0100
commitf5e43b1361fb59a9c260739bdb28729d5119507c (patch)
treefcf6a04f62744cb34c7ce57b5b4c98c386f3c69e /src/etc/sysctl.d
parente92667504e0c503b7c0d125d89d8795d6b6d5876 (diff)
downloadvyos-1x-f5e43b1361fb59a9c260739bdb28729d5119507c.tar.gz
vyos-1x-f5e43b1361fb59a9c260739bdb28729d5119507c.zip
http: T5762: api: make API socket backend communication the one and only default
Why: Smoketests fail as they can not establish IPv6 connection to uvicorn backend server. https://github.com/vyos/vyos-1x/pull/2481 added a bunch of new smoketests. While debugging those failing, it was uncovered, that uvicorn only listens on IPv4 connections vyos@vyos# netstat -tulnp | grep 8080 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN - As the CLI already has an option to move the API communication from an IP to a UNIX domain socket, the best idea is to make this the default way of communication, as we never directly talk to the API server but rather use the NGINX reverse proxy.
Diffstat (limited to 'src/etc/sysctl.d')
-rw-r--r--src/etc/sysctl.d/30-vyos-router.conf8
1 files changed, 8 insertions, 0 deletions
diff --git a/src/etc/sysctl.d/30-vyos-router.conf b/src/etc/sysctl.d/30-vyos-router.conf
index 1c9b8999f..67d96969e 100644
--- a/src/etc/sysctl.d/30-vyos-router.conf
+++ b/src/etc/sysctl.d/30-vyos-router.conf
@@ -105,3 +105,11 @@ net.core.rps_sock_flow_entries = 32768
net.core.default_qdisc=fq_codel
net.ipv4.tcp_congestion_control=bbr
+# VRF - Virtual routing and forwarding
+# When net.vrf.strict_mode=0 (default) it is possible to associate multiple
+# VRF devices to the same table. Conversely, when net.vrf.strict_mode=1 a
+# table can be associated to a single VRF device.
+#
+# A VRF table can be used by the VyOS CLI only once (ensured by verify()),
+# this simply adds an additional Kernel safety net
+net.vrf.strict_mode=1