summaryrefslogtreecommitdiff
path: root/src/conf_mode
AgeCommit message (Collapse)Author
2022-06-05firewall: T970: Maintain a domain state to fallback if resolution failssarthurdev
2022-05-28firewall: T970: Add firewall group domain-groupViacheslav Hletenko
Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } }
2022-05-13Merge pull request #1320 from sever-sever/T4408Christian Poessinger
sshguard: T4408: Add service ssh dynamic-protection
2022-05-12sshguard: T4408: Add service ssh dynamic-protectionViacheslav Hletenko
Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1
2022-05-12conntrack: T3535: use "reload-or-restart" from systemdChristian Poessinger
2022-05-12vrrp: T3944: use "reload-or-restart" over individual code pathsChristian Poessinger
systemd has its internal reload or restart logic - we do not need to programm it on our own.
2022-05-12container: T2216: use warning over exception when container image does not existChristian Poessinger
2022-05-12Revert "NHRP : T4399: fix issues restart nhrp when add or del tunnel"Viacheslav Hletenko
This reverts commit d1455f936ca721633fcc04d5c84169b4ccf2f447. New spokes can't register on hub with 'reload-or-restart' option And requires option 'restart' for opennhrp.service
2022-05-07vrf: T4419: support to disable IP forwarding within a given VRFChristian Poessinger
2022-05-06bgp: T4385: verify() peer-group in interface based neighborsChristian Poessinger
2022-05-05monitoring: T4410: Add telegraf output Plugin http for SplunkViacheslav Hletenko
Ability to send HTTP output to Splunk via telegraf set service monitoring telegraf splunk authentication insecure set service monitoring telegraf splunk authentication token 'xxx' set service monitoring telegraf splunk url 'https://x.x.x.x'
2022-05-03monitoring: T4315: Add telegraf output plugin prometheus-clientViacheslav Hletenko
Add output Plugin "prometheus-client" for telegraf: set service monitoring telegraf prometheus-client
2022-05-01accel-ppp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01http: api: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01system-logs: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01openconnect: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01syslog: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01igmp-proxy: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01pppoe: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01nhrp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01firewall: zone: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01lcd: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01vrrp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01firewall: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01system-options: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01ids: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01router-advert: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01mdns-repeater: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01ipsec: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01vrf: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01login: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01telegraf: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01serial-console: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01webproxy: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01flow-accounting: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01snmp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01lldp: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01tftp-server: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01container: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01conserver: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01conntrackd: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01conntrack: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-05-01bcast-relay: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-04-29T2216: containers need to be added via "add container image" in advance ↵Christian Poessinger
before using them
2022-04-28system-proxy: T1741: migrate to get_config_dict()Christian Poessinger
2022-04-28arp: T4397: change CLI syntax to support interface and VRF bound ARP entriesChristian Poessinger
* set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01
2022-04-27NHRP : T4399: fix issues restart nhrp when add or del tunnelfett0
2022-04-25vpn-ipsec: T4398: Fix unexpected passthrough policy for peerViacheslav Hletenko
Set default passtrough list to None to prevent unexpected policy for peers with not overplapped local and remote prefixes
2022-04-25vyos.configdict: T4391: enable get_interface_dict() ti be used with ↵Christian Poessinger
ConfigTreeQuery() When VyOS is booting and an interface is brought up (PPPoE) which requires a user callback script that is executed asynchronously when the interface is up we can not use Config(). The problem is, Config() is not available when the system starts and the initial commit is still processed. We need to move to ConfigTreeQuery() which was build for this exact same purpose. TO reduce side effects and also dependencies on the entire vyos.configdict library the set_level()/get_level() calls got eliminated from within the library. All calls to functions like: * get_removed_vlans() * is_node_changed() * leaf_node_changed() * is_mirror_intf() * ... Now require that the full config path to the node is passed.
2022-04-25arp: T4397: migrate to get_config_dict()Christian Poessinger
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-14 09:22:22 +0000