summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-05-28firewall: T970: Add firewall group domain-groupViacheslav Hletenko
Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } }
2022-05-16Merge pull request #1290 from sever-sever/T4373Christian Poessinger
ppppoe-server: T4373: Add option multiplier for correct shaping
2022-05-16pppoe-server: T4373: Add option multiplier for correct shapingViacheslav Hletenko
Multiplier option is required by some vendors for correct shaping For RADIUS based rate-limits edit service pppoe-server set authentication radius rate-limit multiplier '0.001'
2022-05-13smoketest: add sshguard allow-from caseChristian Poessinger
2022-05-13sshguard: T4408: rename whitelist-address -> allow-fromChristian Poessinger
We do not only allow individual host addresses but also prefixes.
2022-05-13Debian: T4408: add missing sshguard dependencyChristian Poessinger
2022-05-13Merge pull request #1320 from sever-sever/T4408Christian Poessinger
sshguard: T4408: Add service ssh dynamic-protection
2022-05-12sshguard: T4408: Add service ssh dynamic-protectionViacheslav Hletenko
Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1
2022-05-12vrrp: T4417: bugfix service startup priorityChristian Poessinger
2022-05-12conntrack: T3535: use "reload-or-restart" from systemdChristian Poessinger
2022-05-12vrrp: T3944: use "reload-or-restart" over individual code pathsChristian Poessinger
systemd has its internal reload or restart logic - we do not need to programm it on our own.
2022-05-12container: T2216: use warning over exception when container image does not existChristian Poessinger
2022-05-12Merge pull request #1323 from sever-sever/T4399Christian Poessinger
Revert "NHRP : T4399: fix issues restart nhrp when add or del tunnel"
2022-05-12Merge pull request #1325 from sever-sever/T4424Christian Poessinger
policy: T4424: Fix incorrect format for IPv6 prefixes
2022-05-12policy: T4424: Fix incorrect format for IPv6 prefixesViacheslav Hletenko
2022-05-12Revert "NHRP : T4399: fix issues restart nhrp when add or del tunnel"Viacheslav Hletenko
This reverts commit d1455f936ca721633fcc04d5c84169b4ccf2f447. New spokes can't register on hub with 'reload-or-restart' option And requires option 'restart' for opennhrp.service
2022-05-11Merge pull request #1321 from sever-sever/T4405Christian Poessinger
T4405: Fix administrative distance of DHCP routes
2022-05-10T4405: Fix administrative distance of DHCP routesDmitri Toubelis
- Default dhclient script only uses value of `$IF_MERIC` envvar for default route recived via `router` option. - This variable has no effect on rotes received via `rfc3442-classless-static-routes` option - Considering that Vyos overrrides `ip` command originating from `dhclient` this can be easily fixed in `iptovtysh()` function by using the `$IF_METRIC` envvar directly in the dhclient hook. (cherry picked from commit 0c00e7bf8b6e68814607fde4ff0cd70ce9f4b486)
2022-05-09Merge pull request #1279 from nicolas-fort/T990Christian Poessinger
Firewall: T990: Add snat and dnat connection status on firewall
2022-05-08container: T4000: use unique storage for container imageChristian Poessinger
Do no longer store container images which are pulled from any registry to /config/containers. Instead save them to a unified location that is the same accross all images on the system: /usr/lib/live/mount/persistence/container/storage Reason for this change is, while living under /config/containers a VyOS image upgrade copied all downloaded container images to the new image - doubling the used space per image on every upgrade. With the new location the images are all the same for every VyOS image running. Container userdata can still be stored under /config and copied to a newer image making rollbacks still efficient.
2022-05-08container: op-mode: T3852: use XML inline podman commandsChristian Poessinger
Reduce bloat of containers_op.py wrapper script. All commands can be passed directly to podman via the XML script. This also makes the execution faster, as no Python environment needs to be build up.
2022-05-08container: T4353: fix conf-mode script nameChristian Poessinger
2022-05-08smoketest: policy-route: use setUpClass()Christian Poessinger
2022-05-08policy: evpn: T3739: support "set evpn gateway-ip"Christian Poessinger
2022-05-07vrf: T4419: support to disable IP forwarding within a given VRFChristian Poessinger
2022-05-06ocserv: T4231: XML OTP support must not be added globally - only for openconnectChristian Poessinger
2022-05-06ipsec: T4353: use "" quotes on road-warrior idChristian Poessinger
2022-05-06bgp: T4385: verify() peer-group in interface based neighborsChristian Poessinger
2022-05-06Merge pull request #1316 from srividya0208/T4381Christian Poessinger
openvpn: T4381: Add tunnel ip column for status command
2022-05-06openvpn: T4381: Add tunnel ip column for status commandsrividya0208
Added the tunnel ip column to see the assigned ip address in server mode
2022-05-05op-mode: T4416: Rewrite 'traceroute' op-command and expand available options ↵3roin
using python
2022-05-05Merge pull request #1312 from sever-sever/T4410Christian Poessinger
monitoring: T4410: Add telegraf output Plugin http for Splunk
2022-05-05smoketest: do not auto-load big firewall config on smoketestChristian Poessinger
This takes a very long time, but keep the config for manual runs
2022-05-05policy: T4414: add support for route-map "as-path prepend last-as x"Christian Poessinger
2022-05-05monitoring: T4410: Add telegraf output Plugin http for SplunkViacheslav Hletenko
Ability to send HTTP output to Splunk via telegraf set service monitoring telegraf splunk authentication insecure set service monitoring telegraf splunk authentication token 'xxx' set service monitoring telegraf splunk url 'https://x.x.x.x'
2022-05-03Merge pull request #1310 from sever-sever/T4315Christian Poessinger
monitoring: T4315: Add telegraf output plugin prometheus-client
2022-05-03monitoring: T4315: Add telegraf output plugin prometheus-clientViacheslav Hletenko
Add output Plugin "prometheus-client" for telegraf: set service monitoring telegraf prometheus-client
2022-05-02ipsec: T4353: bugfix template extensionChristian Poessinger
2022-05-02T2216: file is called container.pyChristian Poessinger
2022-05-01accel-ppp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01http: api: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01system-logs: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01openconnect: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01syslog: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01igmp-proxy: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01pppoe: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01nhrp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01firewall: zone: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01lcd: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01vrrp: T4353: fix Jinja2 linting errorsChristian Poessinger
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-15 01:49:50 +0000