From 272b6e646d64651af0b5e8e726021e4fb09cd872 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 20:54:54 +0200 Subject: wlb: T9472: make inbound-interface "any" match traffic "inbound-interface any", offered by completion, was rendered as an interface literally named "any" and matched no packet, so the rule never balanced anything. It now matches traffic entering on any interface except the WAN interfaces themselves. Matching those as well would also restore the routing mark on replies arriving from an ISP and send them straight back to that ISP. --- python/vyos/wanloadbalance.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'python') diff --git a/python/vyos/wanloadbalance.py b/python/vyos/wanloadbalance.py index 05ae6b536..1dc9a8081 100644 --- a/python/vyos/wanloadbalance.py +++ b/python/vyos/wanloadbalance.py @@ -24,7 +24,13 @@ dhclient_lease = 'dhclient_{0}.lease' def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight=None, health_state=None, action=None, restore_mark=False): output = [] - if 'inbound_interface' in rule_conf: + if rule_conf.get('inbound_interface') == 'any': + # any interface but the WAN interfaces - matching replies arriving + # from an ISP would route them back to that ISP + wan_interfaces = ', '.join(f'"{ifname}"' for ifname in rule_conf.get('wan_interfaces', [])) + if wan_interfaces and not local: + output.append(f'iifname != {{ {wan_interfaces} }}') + elif 'inbound_interface' in rule_conf: ifname = rule_conf['inbound_interface'] if local and not exclude: output.append(f'oifname != "{ifname}"') -- cgit v1.2.3