ALG Application level gateway - For CGNAT and other Stateful Firewall

General questions
1

I couldn’t find any information about ALGs in VyOS documentation.

ALGs exists in VyOS?
If existis, there is any documentation?
If it do not support any ALGs, there is any effort to support that?

The most common ALGs that exists in other vendors (opensource or proprietary) are:
FTP, TFTP, RTSP, PPTP, SIP, ICMP, H.323, ESP, MGCP, DNS.

2

See Conntrack — VyOS 1.5.x (circinus) documentation for documentation.

Greets,

Save

1 Like
3

My experience with the so called ALG’s are that they are mostly broken so dont use them.

They will also waste resources of your router.

So for example regarding FTP its better to correctly configure your server using passive ftp and adjust your ACL’s (if any) in your router for that.

4

If the client, not the ftp server, is on the Vyos site, active ftp won’t work without the helper.

5

Then dont use active ftp, its broken by design. Use passive ftp which is the correct way to deal with this.