summaryrefslogtreecommitdiff
path: root/interface-definitions
AgeCommit message (Collapse)Author
2025-05-21Merge pull request #4501 from c-po/boot-recovery-T1771Daniil Baturin
T1771: automatic reboot of system into previous image
2025-05-20Merge pull request #4499 from sever-sever/T7348Daniil Baturin
T7348: Add config CPU thread-count for accel-ppp services
2025-05-20Merge pull request #4511 from sever-sever/T7335Daniil Baturin
T7335: Fix typo for HAproxy help redirect-location path
2025-05-20xml: T7467: remove ^/$ wrapping from validation regexesDaniil Baturin
since the validation utility adds them implicitly
2025-05-20Merge pull request #4516 from dmbaturin/T7464-fix-snmp-community-regexChristian Breunig
snmp: T7464: fix the community string validation regex for compatibility with PCRE2
2025-05-20bonding: T7466: fix the 802.3ad regexDaniil Baturin
2025-05-20snmp: T7464: fix the community string validation regexDaniil Baturin
for compatibility with PCRE2
2025-05-17T1771: automatic reboot of system into previous imageChristian Breunig
If any part of the system boot fails, we set overall_status=1 in the vyos-router startup script. When an error during the image upgrade is detected, the system will automatically revert the default boot image to the previously used version, if the CLI option "system option reboot-on-upgrade-failure" is set. The user is informed via console messages: Booting failed, reverting to previous image Automatic reboot in 5 minutes Use "reboot cancel" to cancel The user has time to log in and run reboot cancel to remain in the faulty image for troubleshooting. Reboot timeout is defined by CLI: "system option reboot-on-upgrade-failure" Once the system boots into the previous image, the MOTD will display a persistent warning message - cleared during next reboot. WARNING: Image update to "VyOS 1.5.xxxx" failed Please check the logs: /usr/lib/live/mount/persistence/boot/NAME/rw/var/log Message is cleared on next reboot! Upgrade failure can be synthetically injected by booting with Kernel command line option: vyos-fail-migration
2025-05-16T7348: Add config CPU thread-count for accel-ppp servicesViacheslav Hletenko
Accel-ppp services should not use all CPU cores to process requests. At the moment accel-ppp services use all available CPU cores to process requests from the subscribers (establish/update session/etc). During mass connection of sessions, this can lead to the fact that it utilizes all CPU, and for other services like FRR, there is not enough CPU time to process their own stable work. services: - L2TP - SSTP - PPPoE - IPoE - PPtP Add this option configurable and use all cores if not set: ``` set service pppoe-server thread-count < all | half | x > ``` The defaultValue `all`
2025-05-16T7335: Fix typo for HAproxy help redirect-location pathViacheslav Hletenko
2025-05-13T7419: VPP ACL implementation (#31)Nataliia S.
CLI: ``` set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect> set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix> set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range> set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix> set vpp acl ip tag-name <tag-name> rule <nn> destination port <port> set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol> set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr> set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr> set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name> set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name> set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix> set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac> set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask> set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny> set vpp acl macip interface <interface_name> tag-name <tag-name> ``` OP mode ``` show vpp acl ip tag-name <tag_name> show vpp acl ip interface show vpp acl macip tag-name <tag_name> show vpp acl macip interface ```
2025-05-12Merge pull request #4483 from markh0338/remote-group-v6Christian Breunig
T7386: firewall: Allow IPv6 member in firewall remote-groups
2025-05-12Merge pull request #4494 from c-po/haproxy-loggingDaniil Baturin
haproxy: T7429: remove unsupported logging facility and log level
2025-05-09Merge pull request #4491 from sever-sever/T7423Viacheslav Hletenko
T7423: Add kernel boot options isolcpus, hugepages, numa_balancing
2025-05-08haproxy: T7429: remove unsupported logging facility and log levelChristian Breunig
VyOS 1.4.1 implemented support for logging facilities for HAProxy. The facilities got included from the syslog XML definition, which also added "virtual" or non existing facilities in HAProxy, namely: all, authpriv and mark. If any of the above facilities is set, HAProxy will not start. The XML definition for syslog also came with an arbitrary log-level "all" that is also unsupported in HAProxy. This commit adds a migration script removing the illegal CLI nodes.
2025-05-08T7423: Add kernel boot options isolcpus, hugepages, numa_balancingViacheslav Hletenko
Add kernel options which apply during the boot: - isolcpus - nohz_full - rcu_nocbs - default_hugepagesz - hugepages - hugepagesz - numa_balancing - hpet - mce - nosoftlockup - nmi_watchdog CLI: ``` set system option kernel cpu disable-nmi-watchdog set system option kernel cpu isolate-cpus '1,2,4-5' set system option kernel cpu nohz-full '1,2,4-5' set system option kernel cpu rcu-no-cbs '1,2,4-5' set system option kernel disable-hpet set system option kernel disable-mce set system option kernel disable-softlockup set system option kernel memory default-hugepage-size '2M' set system option kernel memory disable-numa-balancing set system option kernel memory hugepage-size 1G hugepage-count '2' set system option kernel memory hugepage-size 2M hugepage-count '512' ```
2025-05-08Merge pull request #4484 from ryanzuwala/T7051Daniil Baturin
nat66: T7051: snat group as destination
2025-05-07T7386: firewall: allow mix of IPv4 and IPv6 addresses/prefixes/ranges in ↵Mark Hayes
remote groups
2025-05-06Merge pull request #4480 from c-po/T7122-pkiDaniil Baturin
T7122: pki: unable to switch from custom cert to ACME when HAProxy service is running with 'redirect-http-to-https' option
2025-05-05Bridge: T7430: Add BPDU Guard and Root Guard supportl0crian1
This will add support for BPDU Guard and Root Guard to the bridge interface. Verification will come from: show log spanning-tree
2025-05-04xml: T7122: it is spelled HAProxyChristian Breunig
2025-05-02Merge pull request #4481 from yzguy/T7412Daniil Baturin
T7412: Allow privileged containers
2025-05-01T7390: VPP CGNAT implementation (#30)Nataliia S.
CLI: ``` set vpp nat cgnat interface outside <interface> # multi set vpp nat cgnat interface inside <interface> # multi set vpp nat cgnat rule <rule> outside-prefix <prefix> set vpp nat cgnat rule <rule> inside-prefix <prefix> set vpp nat cgnat timeout udp <sec> # default 300 set vpp nat cgnat timeout tcp-established <sec> # default 7440 set vpp nat cgnat timeout tcp-transitory <sec> # default 240 set vpp nat cgnat timeout icmp <sec> # default 60 ``` OP mode: ``` show vpp nat cgnat interfaces show vpp nat cgnat mappings show vpp nat cgnat sessions clear vpp cgnat inside-address <address> port <port> external-address <address> port <port> ```
2025-04-29nat66: T7051: add group config nodeRyan Zuwala
Add CLI config node for "group" when configuring NAT66 source Ensure there is only one group in NAT66 source rule config Add smoketest to cover new group usage in source NAT66 rules
2025-04-29Merge pull request #4464 from nvollmar/T7382Daniil Baturin
T7382: adds podman log driver configuration option
2025-04-29T7412: Allow privileged containersAdam Smith
2025-04-26T7397: add "system kernel option quiet" to suppress boot messagesChristian Breunig
Add option to limit the number of messages that are displayed on the console during the boot process and to persist this setting with image upgrades. set system option kernel quiet
2025-04-25Merge pull request #4457 from l0crian1/t7358-add-offload-to-global-stateViacheslav Hletenko
firewall: T7358: add offload option to global state policy
2025-04-25T7181: VPP Static and dynamic NATNataliia Solomko
New CLI for static and dynamic NAT: ``` set vpp nat44 interface outside <interface> # multi set vpp nat44 interface inside <interface> # multi set vpp nat44 address-pool translation interface <interface> # multi set vpp nat44 address-pool translation address <address> # multi set vpp nat44 address-pool twice-nat interface <interface> # multi set vpp nat44 address-pool twice-nat address <address> # multi set vpp nat44 static rule <rule> external address <address> set vpp nat44 static rule <rule> external port <port> set vpp nat44 static rule <rule> local address <address> set vpp nat44 static rule <rule> local port <port> set vpp nat44 static rule <rule> protocol <protocol> set vpp nat44 static rule <rule> options twice-nat set vpp nat44 static rule <rule> options self-twice-nat set vpp nat44 static rule <rule> options out-to-in-only set vpp nat44 static rule <rule> options twice-nat-address <address> set vpp nat44 exclude rule <rule> protocol <protocol> set vpp nat44 exclude rule <rule> local-port <port> set vpp nat44 exclude rule <rule> local-address <address> set vpp nat44 exclude rule <rule> external-interface <interface> ``` Settings: ``` set vpp settings nat44 session-limit <limit> # default 64512 set vpp settings nat44 timeout udp <sec> # default 300 set vpp settings nat44 timeout tcp-established <sec> # default 7440 set vpp settings nat44 timeout tcp-transitory <sec> # default 240 set vpp settings nat44 timeout icmp <sec> # default 60 set vpp settings nat44 workers <list> set vpp settings nat44 no-forwarding ```
2025-04-23router-advert: T7380: Implement auto-ignore-prefix syntax for router ↵Ryan Zuwala
advertisements (#4463)
2025-04-23interface: T4627: not every interface type supports IPv6 interface-identifiersChristian Breunig
Turns out commit b124f0b3b ("interface: T4627: support IPv6 Interface Identifier (token) for SLAAC") uncovered a wrong assumption in VyOS that every interface type in use always supports SLAAC and IPv6-ND (neighbor discovery). This is not true for WireGuard, Tunnel and VTI interfaces, thus do not provide that CLI option. In addition SLAAC support should be removed for those interface types in a future PR.
2025-04-22Merge pull request #4419 from sskaje/T5636Daniil Baturin
geoip: T5636: Add geoip for policy route/route6
2025-04-22Merge pull request #4392 from symysak/T4627Daniil Baturin
interface: T4627: support setting of IPv6 Interface Identifier(Token)
2025-04-22T6773: RFC-2136 support for Kea DHCP4 server (#4153)Alex Bukharov
2025-04-21T7382: adds podman log driver configuration optionNicolas Vollmar
2025-04-18interface: T4627: support IPv6 Interface Identifier (token) for SLAACYoshiaki Suyama
Add common IPv6 CLI option (use ethernet as example): set interfaces ethernet eth0 ipv6 address interface-identifier Co-authored-by: Christian Breunig <christian@breunig.cc>
2025-04-17Merge pull request #4446 from sever-sever/T7343Daniil Baturin
T7343: IPsec add traffic-selector handling for VTI interfaces
2025-04-17T7343: IPsec add traffic-selector handling for VTI interfacesViacheslav Hletenko
Allow to set traffic-selector for VTI interfaces We can set several local and remote IPv4 and IPv6 prefixes ``` set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix 0.0.0.0/0 set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix :/0 set vpn ipsec site-to-site peer P1 vti traffic-selector remote prefix 192.0.2.0/24 ```
2025-04-16firewall: T7358: add offload option to global state policyl0crian1
Since the jump to the global state chain is inserted before all rules, it wasn't possible to use offload with the global state policies This commit adds a new chain for offloaded traffic in the forward chain and jumps to that chain. Please enter the commit message for your changes. Lines starting
2025-04-15Merge pull request #4412 from sarthurdev/kea_2.6Daniil Baturin
kea: T7281: Add ping-check, use built-in option for classless static routes
2025-04-15Merge pull request #4214 from dmbaturin/T6919-good-bye-fastnetmonDaniil Baturin
ids: T7241: remove Fastnetmon from the base system
2025-04-14kea: T7310: add support for RFC-5417 (option 138) (#4430)David Vølker
* dhcp-server: T7310: add support for option 138 CAPWAP AC to KEA * kea: T7310: Update data/templates/dhcp-server/kea-dhcp4.conf.j2 Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com> * kea: T7310: Update python/vyos/kea.py Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com> * kea: T7310: add smoketest for capwap-ac-v4 * kea: T7310: Update python/vyos/kea.py Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com> --------- Co-authored-by: David Vølker <davvol@davvol.dk> Co-authored-by: Simon <965089+sarthurdev@users.noreply.github.com>
2025-04-14ids: T7241: remove Fastnetmon from the base systemDaniil Baturin
It will eventually be moved to an addon
2025-04-14kea: T7281: Add support for ping-check in Keasarthurdev
2025-04-08T7315: Change CLI fot VPP NAT (#25)Nataliia S.
New CLI ``` set vpp nat44 static rule 10 outside-interface 'eth0' set vpp nat44 static rule 10 inside-interface 'eth1' set vpp nat44 static rule 10 external address 192.168.122.10 set vpp nat44 static rule 10 external port 6545 # optional set vpp nat44 static rule 10 protocol tcp|udp|icmp|all # optional, defaults to "all" set vpp nat44 static rule 10 local address 100.64.0.10 set vpp nat44 static rule 10 local port 64010 # optional ```
2025-04-01T7283: VPP add static NAT support (#24)Nataliia S.
* T7283: VPP add static NAT support Add static mapping NAT implementation ``` set vpp nat44 static rule 10 outbound-interface 'eth0' set vpp nat44 static rule 10 inbound-interface 'eth1' set vpp nat44 static rule 10 destination address 192.168.122.10 # optional, if not set outbound interface ip address is used set vpp nat44 static rule 10 destination port 6545 # optional set vpp nat44 static rule 10 protocol tcp|udp|icmp|all # optional, defaults to "all" set vpp nat44 static rule 10 translation address 100.64.0.10 set vpp nat44 static rule 10 translation port 64010 # optional ``` * Improve help strings (Daniil Baturin) --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2025-03-31Merge pull request #4420 from c-po/veth-mtuChristian Breunig
virtual-ethernet: T7293: add support to define interface MTU
2025-03-29Merge pull request #4409 from woodsb02/patch-2Christian Breunig
syslog: T7270: fix typos in rsyslog.conf
2025-03-29T7286: Add CLI option to disable LDP establish packetsViacheslav Hletenko
If a router has not formed an LDP neighbor adjacency yet, it answers all received LDP Hello packets from non-neighbors with new Hello packets. This leads to flooding LDP packets to all routers for each LDP incoming packet. Add configuration option to disable this behavior ``` set protocols mpls ldp interface eth0 disable-establish-hello ```
2025-03-29virtual-ethernet: T7293: add support to define interface MTUChristian Breunig
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-15 09:58:09 +0000