From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001
From: David Vølker <david@voelker.dk>
Date: Mon, 1 Jun 2026 08:09:06 +0200
Subject: firewall: T8761: re-introduce VRF interface names in generated
 firewall config

This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.

Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
  over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2

Co-authored-by: Christian Breunig <christian@breunig.cc>
---
 src/conf_mode/firewall.py                    |  4 +++-
 src/conf_mode/interfaces_bonding.py          | 12 +++++++++++-
 src/conf_mode/interfaces_bridge.py           |  8 +++++++-
 src/conf_mode/interfaces_dummy.py            | 13 ++++++++++++-
 src/conf_mode/interfaces_ethernet.py         | 10 ++++++++--
 src/conf_mode/interfaces_geneve.py           |  9 +++++++--
 src/conf_mode/interfaces_l2tpv3.py           |  9 +++++++--
 src/conf_mode/interfaces_macsec.py           | 12 ++++++++++--
 src/conf_mode/interfaces_openvpn.py          | 10 ++++++++++
 src/conf_mode/interfaces_pppoe.py            | 13 +++++++++++++
 src/conf_mode/interfaces_pseudo-ethernet.py  |  9 +++++++--
 src/conf_mode/interfaces_sstpc.py            | 13 +++++++++++++
 src/conf_mode/interfaces_tunnel.py           | 12 ++++++++++++
 src/conf_mode/interfaces_virtual-ethernet.py |  9 +++++++--
 src/conf_mode/interfaces_vti.py              | 17 ++++++++++++++++-
 src/conf_mode/interfaces_vxlan.py            |  9 +++++++--
 src/conf_mode/interfaces_wireguard.py        |  6 ++++++
 src/conf_mode/interfaces_wireless.py         | 14 +++++++++++---
 src/conf_mode/interfaces_wwan.py             | 12 ++++++++++--
 19 files changed, 177 insertions(+), 24 deletions(-)

(limited to 'src')

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 4b6a4d272..29181b4ef 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -142,7 +142,9 @@ def get_config(config=None):
                 if 'vrf' in local_zone_member:
                     local_zone_conf['vrf_interfaces'] = {}
                     for vrf_name in local_zone_member['vrf']:
-                        local_zone_conf['vrf_interfaces'][vrf_name] = ','.join(get_vrf_members(vrf_name))
+                        local_zone_conf['vrf_interfaces'][vrf_name] = get_vrf_members(
+                            vrf_name
+                        )
                 continue
 
             local_zone_conf['from_local'] = {}
diff --git a/src/conf_mode/interfaces_bonding.py b/src/conf_mode/interfaces_bonding.py
index fc3c05d3e..0f5554145 100755
--- a/src/conf_mode/interfaces_bonding.py
+++ b/src/conf_mode/interfaces_bonding.py
@@ -19,6 +19,7 @@ from sys import exit
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import leaf_node_changed
 from vyos.configdict import is_member
 from vyos.configdict import is_source_interface
@@ -171,6 +172,11 @@ def get_config(config=None):
     if 'static_arp' in bond:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        bond.update({'vrf_changed': {}})
+        set_dependents('firewall', conf)
+
     bond['vpp_ifaces'] = cli_ifaces_list(conf)
 
     return bond
@@ -298,7 +304,11 @@ def apply(bond):
     else:
         b.update(bond)
 
-    if dict_search('member.interface_remove', bond) or 'static_arp' in bond:
+    if (
+        dict_search('member.interface_remove', bond)
+        or 'static_arp' in bond
+        or 'vrf_changed' in bond
+    ):
         try:
             call_dependents()
         except ConfigError:
diff --git a/src/conf_mode/interfaces_bridge.py b/src/conf_mode/interfaces_bridge.py
index 6b574639e..5e24b8961 100755
--- a/src/conf_mode/interfaces_bridge.py
+++ b/src/conf_mode/interfaces_bridge.py
@@ -18,6 +18,7 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import node_changed
 from vyos.configdict import is_member
 from vyos.configdict import is_source_interface
@@ -129,6 +130,11 @@ def get_config(config=None):
     if 'static_arp' in bridge:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        bridge.update({'vrf_changed': {}})
+        set_dependents('firewall', conf)
+
     bridge['vpp_ifaces'] = cli_ifaces_list(conf)
 
     return bridge
@@ -233,7 +239,7 @@ def apply(bridge):
         if iface.startswith(('vxlan', 'wlan')) and interface_exists(iface)
     ]
 
-    if interfaces_need_update or 'static_arp' in bridge:
+    if interfaces_need_update or 'static_arp' in bridge or 'vrf_changed' in bridge:
         try:
             call_dependents()
         except ConfigError:
diff --git a/src/conf_mode/interfaces_dummy.py b/src/conf_mode/interfaces_dummy.py
index c35511199..adaf1958b 100755
--- a/src/conf_mode/interfaces_dummy.py
+++ b/src/conf_mode/interfaces_dummy.py
@@ -18,6 +18,9 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -37,7 +40,12 @@ def get_config(config=None):
     else:
         conf = Config()
     base = ['interfaces', 'dummy']
-    _, dummy = get_interface_dict(conf, base)
+    ifname, dummy = get_interface_dict(conf, base)
+
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return dummy
 
 def verify(dummy):
@@ -63,6 +71,9 @@ def apply(dummy):
     else:
         d.update(dummy)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/interfaces_ethernet.py b/src/conf_mode/interfaces_ethernet.py
index 3b8453780..1368f2c6e 100755
--- a/src/conf_mode/interfaces_ethernet.py
+++ b/src/conf_mode/interfaces_ethernet.py
@@ -24,6 +24,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import get_flowtable_interfaces
 from vyos.configverify import verify_address
 from vyos.configverify import verify_dhcpv6
@@ -196,6 +197,10 @@ def get_config(config=None):
     if 'static_arp' in ethernet:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return ethernet
 
 def verify_speed_duplex(ethernet: dict, ethtool: Ethtool):
@@ -442,8 +447,9 @@ def apply(ethernet):
         e.remove()
     else:
         e.update(ethernet)
-    if 'static_arp' in ethernet:
-        call_dependents()
+
+    # run the dependents
+    call_dependents()
 
     vpp_iface_config = dict_search(f'vpp.settings.interface.{ifname}', ethernet)
     if vpp_iface_config is not None and is_systemd_service_running('vpp.service'):
diff --git a/src/conf_mode/interfaces_geneve.py b/src/conf_mode/interfaces_geneve.py
index faaa7b848..2fc72568e 100755
--- a/src/conf_mode/interfaces_geneve.py
+++ b/src/conf_mode/interfaces_geneve.py
@@ -21,6 +21,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_bridge_delete
@@ -57,6 +58,10 @@ def get_config(config=None):
     if 'static_arp' in geneve:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return geneve
 
 def verify(geneve):
@@ -96,8 +101,8 @@ def apply(geneve):
         g = GeneveIf(**geneve)
         g.update(geneve)
 
-    if 'static_arp' in geneve:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_l2tpv3.py b/src/conf_mode/interfaces_l2tpv3.py
index 85438b6c5..5a9d34f89 100755
--- a/src/conf_mode/interfaces_l2tpv3.py
+++ b/src/conf_mode/interfaces_l2tpv3.py
@@ -20,6 +20,7 @@ from vyos.config import Config
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import leaf_node_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -62,6 +63,10 @@ def get_config(config=None):
     if 'static_arp' in l2tpv3:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return l2tpv3
 
 def verify(l2tpv3):
@@ -106,8 +111,8 @@ def apply(l2tpv3):
         l = L2TPv3If(**l2tpv3)
         l.update(l2tpv3)
 
-    if 'static_arp' in l2tpv3:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_macsec.py b/src/conf_mode/interfaces_macsec.py
index 3c043e11e..5aae52c02 100755
--- a/src/conf_mode/interfaces_macsec.py
+++ b/src/conf_mode/interfaces_macsec.py
@@ -23,6 +23,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import is_source_interface
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_address
@@ -84,6 +85,10 @@ def get_config(config=None):
     if 'static_arp' in macsec:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return macsec
 
 
@@ -187,6 +192,9 @@ def apply(macsec):
             if os.path.isfile(wpa_suppl_conf.format(**macsec)):
                 os.unlink(wpa_suppl_conf.format(**macsec))
 
+            # run the dependents
+            call_dependents()
+
             return None
 
     # It is safe to "re-create" the interface always, there is a sanity
@@ -199,8 +207,8 @@ def apply(macsec):
         if not is_systemd_service_running(systemd_service) or 'shutdown_required' in macsec:
             call(f'systemctl reload-or-restart {systemd_service}')
 
-    if 'static_arp' in macsec:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
index f2a49327a..ec5840369 100755
--- a/src/conf_mode/interfaces_openvpn.py
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -32,7 +32,10 @@ from vyos.base import DeprecationWarning
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdiff import get_config_diff
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_mirror_redirect
@@ -181,6 +184,10 @@ def get_config(config=None):
     else:
         openvpn['protocol_modifier'] = ''
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return openvpn
 
 def is_ec_private_key(pki, cert_name):
@@ -855,6 +862,9 @@ def apply(openvpn):
     o = VTunIf(**openvpn)
     o.update(openvpn)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 
diff --git a/src/conf_mode/interfaces_pppoe.py b/src/conf_mode/interfaces_pppoe.py
index 1a405e6b6..610811ceb 100755
--- a/src/conf_mode/interfaces_pppoe.py
+++ b/src/conf_mode/interfaces_pppoe.py
@@ -21,6 +21,9 @@ from sys import exit
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_authentication
 from vyos.configverify import verify_source_interface
 from vyos.configverify import verify_vrf
@@ -72,6 +75,10 @@ def get_config(config=None):
         if 'mru' not in pppoe:
             pppoe['mru'] = pppoe['mtu']
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return pppoe
 
 def verify(pppoe):
@@ -119,6 +126,9 @@ def apply(pppoe):
             p = PPPoEIf(ifname)
             p.remove()
         call(f'systemctl stop ppp@{ifname}.service')
+        
+        # run the dependents and return
+        call_dependents()
         return None
 
     # reconnect should only be necessary when certain config options change,
@@ -140,6 +150,9 @@ def apply(pppoe):
             p = PPPoEIf(ifname)
             p.update(pppoe)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/interfaces_pseudo-ethernet.py b/src/conf_mode/interfaces_pseudo-ethernet.py
index 12019d3e6..cb0f7e7d0 100755
--- a/src/conf_mode/interfaces_pseudo-ethernet.py
+++ b/src/conf_mode/interfaces_pseudo-ethernet.py
@@ -22,6 +22,7 @@ from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_source_interface
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -66,6 +67,10 @@ def get_config(config=None):
     if 'static_arp' in peth:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return peth
 
 def _verify_anycast_gateway(peth: dict):
@@ -131,8 +136,8 @@ def apply(peth):
         p = MACVLANIf(**peth)
         p.update(peth)
 
-    if 'static_arp' in peth:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_sstpc.py b/src/conf_mode/interfaces_sstpc.py
index 50d3d1cb3..0231b9952 100755
--- a/src/conf_mode/interfaces_sstpc.py
+++ b/src/conf_mode/interfaces_sstpc.py
@@ -20,6 +20,9 @@ from sys import exit
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_authentication
 from vyos.configverify import verify_vrf
 from vyos.ifconfig import SSTPCIf
@@ -57,6 +60,10 @@ def get_config(config=None):
             # bail out early - no need to further process other nodes
             break
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return sstpc
 
 def verify(sstpc):
@@ -107,6 +114,9 @@ def apply(sstpc):
             p = SSTPCIf(ifname)
             p.remove()
         call(f'systemctl stop ppp@{ifname}.service')
+
+        # run the dependents and return
+        call_dependents()
         return None
 
     # reconnect should only be necessary when specific options change,
@@ -128,6 +138,9 @@ def apply(sstpc):
             p = SSTPCIf(ifname)
             p.update(sstpc)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/interfaces_tunnel.py b/src/conf_mode/interfaces_tunnel.py
index 6e50d778a..a86a2fa84 100755
--- a/src/conf_mode/interfaces_tunnel.py
+++ b/src/conf_mode/interfaces_tunnel.py
@@ -18,6 +18,9 @@ import ipaddress
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_source_interface
@@ -78,6 +81,10 @@ def get_config(config=None):
     if 'encapsulation' in tunnel and tunnel['encapsulation'] not in ['erspan', 'ip6erspan']:
         del tunnel['parameters']['erspan']
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return tunnel
 
 def verify(tunnel):
@@ -218,11 +225,16 @@ def apply(tunnel):
             tmp = Interface(interface)
             tmp.remove()
         if 'deleted' in tunnel:
+            # run the dependents and return
+            call_dependents()
             return None
 
     tun = TunnelIf(**tunnel)
     tun.update(tunnel)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/interfaces_virtual-ethernet.py b/src/conf_mode/interfaces_virtual-ethernet.py
index 00fc9cce9..7896ddf07 100755
--- a/src/conf_mode/interfaces_virtual-ethernet.py
+++ b/src/conf_mode/interfaces_virtual-ethernet.py
@@ -22,6 +22,7 @@ from vyos.config import Config
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_vrf
@@ -54,6 +55,10 @@ def get_config(config=None):
     if 'static_arp' in veth:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return veth
 
 
@@ -108,8 +113,8 @@ def apply(veth):
         p = VethIf(**veth)
         p.update(veth)
 
-    if 'static_arp' in veth:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_vti.py b/src/conf_mode/interfaces_vti.py
index b4652d727..916543caf 100755
--- a/src/conf_mode/interfaces_vti.py
+++ b/src/conf_mode/interfaces_vti.py
@@ -18,6 +18,9 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_mirror_redirect
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_mtu_ipv6
@@ -36,7 +39,12 @@ def get_config(config=None):
     else:
         conf = Config()
     base = ['interfaces', 'vti']
-    _, vti = get_interface_dict(conf, base)
+    ifname, vti = get_interface_dict(conf, base)
+
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return vti
 
 def verify(vti):
@@ -52,11 +60,18 @@ def apply(vti):
     # Remove macsec interface
     if 'deleted' in vti:
         VTIIf(**vti).remove()
+
+        # run the dependents
+        call_dependents()
+
         return None
 
     tmp = VTIIf(**vti)
     tmp.update(vti)
 
+    # run the dependents
+    call_dependents()
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/interfaces_vxlan.py b/src/conf_mode/interfaces_vxlan.py
index 86e885807..1dab47b4a 100755
--- a/src/conf_mode/interfaces_vxlan.py
+++ b/src/conf_mode/interfaces_vxlan.py
@@ -23,6 +23,7 @@ from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import leaf_node_changed
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import node_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -89,6 +90,10 @@ def get_config(config=None):
     if 'static_arp' in vxlan:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return vxlan
 
 def verify(vxlan):
@@ -257,8 +262,8 @@ def apply(vxlan):
         v = VXLANIf(**vxlan)
         v.update(vxlan)
 
-    if 'static_arp' in vxlan:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_wireguard.py b/src/conf_mode/interfaces_wireguard.py
index 4cb544b72..44ee70d27 100755
--- a/src/conf_mode/interfaces_wireguard.py
+++ b/src/conf_mode/interfaces_wireguard.py
@@ -22,6 +22,7 @@ from sys import exit
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import is_source_interface
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
@@ -87,6 +88,10 @@ def get_config(config=None):
         wireguard['prev_fwmark'] = prev.get('fwmark')
         wireguard['prev_vrf'] = prev.get('vrf')
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return wireguard
 
 
@@ -206,6 +211,7 @@ def apply(wireguard):
             domain_action = 'stop'
     call(f'systemctl {domain_action} vyos-domain-resolver.service')
 
+    # run the dependents
     call_dependents()
 
     return None
diff --git a/src/conf_mode/interfaces_wireless.py b/src/conf_mode/interfaces_wireless.py
index f7d4cd7c9..1ad16e816 100755
--- a/src/conf_mode/interfaces_wireless.py
+++ b/src/conf_mode/interfaces_wireless.py
@@ -25,6 +25,7 @@ from vyos.config import Config
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_vrf_changed
 from vyos.configdict import dict_merge
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -92,7 +93,7 @@ def get_config(config=None):
         conf = Config()
     base = ['interfaces', 'wireless']
 
-    _, wifi = get_interface_dict(conf, base)
+    ifname, wifi = get_interface_dict(conf, base)
 
     # retrieve global Wireless regulatory domain setting
     if conf.exists(country_code_path):
@@ -145,6 +146,10 @@ def get_config(config=None):
     if 'static_arp' in wifi:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return wifi
 
 def verify(wifi):
@@ -318,6 +323,9 @@ def apply(wifi):
 
     if 'deleted' in wifi:
         WiFiIf(**wifi).remove()
+
+        # run the dependents and return
+        call_dependents()
         return None
 
     while (is_systemd_service_running(f'hostapd@{interface}.service') or \
@@ -393,8 +401,8 @@ def apply(wifi):
         elif wifi['type'] == 'station':
             call(f'systemctl start wpa_supplicant@{interface}.service')
 
-    if 'static_arp' in wifi:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
diff --git a/src/conf_mode/interfaces_wwan.py b/src/conf_mode/interfaces_wwan.py
index ad6c806ad..0fe67508a 100755
--- a/src/conf_mode/interfaces_wwan.py
+++ b/src/conf_mode/interfaces_wwan.py
@@ -24,6 +24,7 @@ from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_vrf_changed
 from vyos.configverify import verify_authentication
 from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_mirror_redirect
@@ -93,6 +94,10 @@ def get_config(config=None):
     if 'static_arp' in wwan:
         set_dependents('static_arp', conf)
 
+    # Check vrf membership, to ensure firewall is updated
+    if is_vrf_changed(conf, ifname):
+        set_dependents('firewall', conf)
+
     return wwan
 
 def verify(wwan):
@@ -170,6 +175,9 @@ def apply(wwan):
             if os.path.exists(cron_script):
                 os.unlink(cron_script)
 
+        # run the dependents
+        call_dependents()
+
         return None
 
     if 'shutdown_required' in wwan or (not is_wwan_connected(wwan['ifname'])):
@@ -192,8 +200,8 @@ def apply(wwan):
 
     w.update(wwan)
 
-    if 'static_arp' in wwan:
-        call_dependents()
+    # run the dependents
+    call_dependents()
 
     return None
 
-- 
cgit v1.2.3