There would never be a large failsafe config. It would always just be the minimal config needed to gain access to VyOS to remediate whatever caused the main firewall config to fail to load. Generally a single rule would be enough. But you need to account for all user’s environments. Most people will only need a single input rule, but some will need input and forward.
And of course if they only want the default actions, they’d be able to do that as well.
This would completely lock out the user if the firewall config fails to load. There’s 2 issues
that need to be addressed.
- The insecure decision to allow traffic before the firewall is configured.
- Ensuring any solution won’t lock users out of their router in the event the firewall config fails to load, which is what was behind the insecure decision.
The issue won’t really be the interfaces coming up, but the interfaces being configured via their respective conf_mode scripts. This is the current priorities of those scripts:
root@vyos:/usr/libexec/vyos# python3 priority.py | grep -E "interfaces|firewall"
300 interfaces_dummy.py ['interfaces', 'dummy']
300 interfaces_loopback.py ['interfaces', 'loopback']
300 interfaces_virtual-ethernet.py ['interfaces', 'virtual-ethernet']
310 interfaces_bridge.py ['interfaces', 'bridge']
310 interfaces_input.py ['interfaces', 'input']
318 interfaces_ethernet.py ['interfaces', 'ethernet']
318 interfaces_wireless.py ['interfaces', 'wireless']
320 interfaces_bonding.py ['interfaces', 'bonding']
321 interfaces_pseudo-ethernet.py ['interfaces', 'pseudo-ethernet']
322 interfaces_pppoe.py ['interfaces', 'pppoe']
350 interfaces_wwan.py ['interfaces', 'wwan']
379 interfaces_wireguard.py ['interfaces', 'wireguard']
380 interfaces_tunnel.py ['interfaces', 'tunnel']
381 interfaces_vti.py ['interfaces', 'vti']
460 interfaces_geneve.py ['interfaces', 'geneve']
460 interfaces_openvpn.py ['interfaces', 'openvpn']
460 interfaces_sstpc.py ['interfaces', 'sstpc']
460 interfaces_vxlan.py ['interfaces', 'vxlan']
461 interfaces_macsec.py ['interfaces', 'macsec']
485 interfaces_l2tpv3.py ['interfaces', 'l2tpv3']
489 firewall.py ['firewall']
The ideal place to apply any solution would be in the vyos-router script, which is the same place where the vyos-firewall-init.conf config is already applied and happens before all conf_mode scripts.
So basically when you configure the failsafe config, it’ll use the normal firewall.py conf_mode script, but won’t actually apply anything. It’ll just put the config in the config object so it can be grabbed when the system boots. This means the solution is very simple because you already have all of code needed to add it.
When the system boots and vyos-router is setting up everything before any conf_mode scripts are loaded, a separate firewall_failsafe.py would be run, that would pull the config from the config object. It would then apply a failsafe table with that simple failsafe config. When the main firewall.py script is run, it would just destroy that table.
