Global state policy + flowtable offload 1.5

https://docs.vyos.io/en/latest/configuration/firewall/flowtables.html
https://docs.vyos.io/en/latest/quick-start.html

when using option#1 (global state policy) from quick start documentation, ipv4 flow offload from the documentation will not hit

set firewall global-options state-policy established action accept
set firewall global-options state-policy related action accept
set firewall global-options state-policy invalid action drop

set firewall ipv4 forward filter rule 10 action ‘offload’
set firewall ipv4 forward filter rule 10 offload-target ‘FT01’
set firewall ipv4 forward filter rule 10 state ‘established’
set firewall ipv4 forward filter rule 10 state ‘related’

i’m particuarly confused by this sentence in quick-start, referring to global state policy:
“Most installations would choose this option, and will contain:”

so in order to use flow offloading we cannot use global state policy?

Seems like you can’t use global state policy.
To verify, review generated nftables rules, to show rule order .
Global state policy should be still useable for drop invalid and accept related.

1 Like