| Age | Commit message (Collapse) | Author |
|---|
|
|
|
WLB per-interface routing tables only contain a default route. When
LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes
it to these tables where internal destinations (BGP, connected, DNAT)
have no matching route and incorrectly exit via WAN.
Add ip rule with table main suppress_prefixlength 0 before each
per-interface table rule. This checks the main routing table first
for specific routes but suppresses the default route, so only
internet-bound traffic falls through to WLB per-interface tables.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
|
|
|
|
|
|
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
Write the health-status on the very first run of the script,
without waiting for any change in status, to show the current
state to the show command. In show command use the same api
to get the now timestamp as used in state change timestamp.
|
|
* wlb: T7196: Migrate interface wildcards to nftables format
* wlb: T7196: Fix exclude/interface verify check
* wlb: T7196: Extra sanity check on ipv4 address function
|
|
|
