VyOS 1.2.2
I have an interface based firewall defined inbound. I’m using the default:
set firewall name eth0_in default-action drop
Through all my testing this results in packets being rejected instead of dropped. It seems there is no difference in functionality between the two. I’m unsure if this is intended based on anything else in my configuration, but it doesn’t seem like it should behave in this manner.
This is my whole firewall config for reference with one IP obscured:
broadcast-ping disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name eth0_in {
default-action drop
rule 1 {
action accept
destination {
port 22
}
protocol tcp
}
rule 2 {
action accept
destination {
port 25
}
protocol tcp
}
rule 3 {
action accept
destination {
port 80
}
protocol tcp
}
rule 4 {
action accept
destination {
port 443
}
protocol tcp
}
rule 5 {
action accept
destination {
port 587
}
protocol tcp
}
rule 6 {
action accept
destination {
port 993
}
protocol tcp
}
rule 7 {
action accept
destination {
port 3389
}
protocol tcp
source {
address x.x.x.x
}
}
rule 8 {
action accept
destination {
port 32400
}
protocol tcp
}
}
receive-redirects disable
send-redirects disable
source-validation loose
state-policy {
established {
action accept
}
invalid {
action reject
}
related {
action accept
}
}