Firewall Problem with 1.5

General questions
1

Hehey

i updated my vyos to the latest RR and alle works fine, except the firewall.
and if i want to load, there comes this error:

load /config/config.boot_bak
Loading configuration from '/config/config.boot_bak'
Traceback (most recent call last):
  File "/usr/libexec/vyos/vyos-load-config.py", line 86, in <module>
    virtual_migration.run()
  File "/usr/lib/python3/dist-packages/vyos/migrator.py", line 213, in run
    cfg_versions = self.read_config_file_versions()
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/migrator.py", line 65, in read_config_file_versions
    cfg_versions = component_version.from_file(cfg_file, vintage='vyos')
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/component_version.py", line 80, in from_file
    version_dict = from_string(line_in_config, vintage=vintage)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/component_version.py", line 57, in from_string
    raise ValueError(f"malformed configuration string: {string_line}")
ValueError: malformed configuration string: // vyos-config-version: "bgp@4:broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@4:firewall@10:flow-accounting@1:https@4:ids@1:interfaces@28:ipoe-server@1:ipsec@12:isis@3:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@2:openconnect@2:ospf@2:policy@5:pppoe-server@6:pptp@2:qos@2:quagga@11:rip@1:rpki@1:salt@1:snmp@3:ssh@2:sstp@4:system@26:vrf@3:vrrp@3:vyos-accel-ppp@2:wanloadbalance@3:webproxy@

My Version:

run sh ver
Version:          VyOS 1.5-rolling-202309111408
Release train:    current

Built by:         autobuild@vyos.net
Built on:         Mon 11 Sep 2023 15:32 UTC
Build UUID:       f033459c-25f8-48de-8728-3d0fc6eb43fe
Build commit ID:  0f75e12dd1af2f

Architecture:     x86_64
Boot via:         installed image
System type:      bare metal

Hardware vendor:  System manufacturer
Hardware model:   System Product Name
Hardware S/N:     System Serial Number
Hardware UUID:    9f50865a-799b-ffe1-532e-f02f745226c5

Copyright:        VyOS maintainers and contributors
[edit]

I tried to just load the firewall section:

Migration script error: /opt/vyatta/etc/config-migrate/migrate/firewall/7-to-8: [Errno 1] failed to run command: ['/opt/vyatta/etc/config-migrate/migrate/firewall/7-to-8', '/tmp/tmpe9dy4wft']
returned: 
exit code: 1.
2

How does the last few lines look in your config.boot_bak file?

Also try the latest 1.5-rolling which currently is: 1.5-rolling-202309170024

3

The last line:

 vyos-config-version: "bgp@4:broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@4:firewall@10:flow-accounting@1:https@4:ids@1:interfaces@28:ipoe-server@1:ipsec@12:isis@3:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@2:openconnect@2:ospf@2:policy@5:pppoe-server@6:pptp@2:qos@2:quagga@11:rip@1:rpki@1:salt@1:snmp@3:ssh@2:sstp@4:system@26:vrf@3:vrrp@3:vyos-accel-ppp@2:wanloadbalance@3:webproxy@
4

i tried first 1.5-rolling-202309170024 then i tried this older version, but same error.

5

Do you have other backups of the config from about the same time?

Because that last line is broken when it ends with “webproxy@”.

There should exist some number after that last “@”.

Here is for example how it currently looks like in the 1.5-rolling from 230917:

// Warning: Do not remove the following line.
// vyos-config-version: "bgp@4:broadcast-relay@1:cluster@1:config-management@1:conntrack@4:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-dynamic@1:dns-forwarding@4:firewall@11:flow-accounting@1:https@4:ids@1:interfaces@30:ipoe-server@1:ipsec@12:isis@3:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@3:openconnect@2:ospf@2:policy@5:pppoe-server@6:pptp@2:qos@2:quagga@11:rip@1:rpki@1:salt@1:snmp@3:ssh@2:sstp@4:system@26:vrf@3:vrrp@4:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2"
// Release version: 1.5-rolling-202309170024

I dont however know when the version for webproxy section bumped to 2 so if possible try to add a “2” to the end of your line and see how things goes?

If it still fails then change that to a “1”.

1 Like
6 
"bgp@4:broadcast:xxxxx:webproxy@

There is no webproxy version at the end.
There is no double quote at the end.

Did you manually change the configuration file?

7

ok sorry i’ve to show in a few hours i did a mistake and now my router is unreachable.
it can be that the config is cuted at the end.

when i’m at home i will show and post the conf here. it was a update from 1.4 to 1.5.

8

Here is the end EOF:

****@****:~$ cat /config/config.boot_bak
// Warning: Do not remove the following line.
// vyos-config-version: "bgp@4:broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@4:firewall@10:flow-accounting@1:https@4:ids@1:interfaces@28:ipoe-server@1:ipsec@12:isis@3:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@2:openconnect@2:ospf@2:policy@5:pppoe-server@6:pptp@2:qos@2:quagga@11:rip@1:rpki@1:salt@1:snmp@3:ssh@2:sstp@4:system@26:vrf@3:vrrp@3:vyos-accel-ppp@2:wanloadbalance@3:webproxy@
****@****:~$
9

it works, but also in the original config file was no version and no ".

10

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.