Have to delete firewall global-options state-policy invalid after upgrading to 1.5-stream-2025-Q1

Bugs
1

I was still using 1.4 in my home lab but with Stream getting launched I figured it’s a good time to jump to 1.5.
After reboot the router was not accessible over the network, so I went into the console. There were no migration errors. In fact the only migrations that caused changes were related to DHCP.
But I could not even ping the IP address of the eth1 LAN interface from the console itself.

By the process of elimination I found that deleting the invalid global state-policy, the network would come back online.

delete firewall global-options state-policy invalid

My global options were:

firewall {
    global-options {
        state-policy {
            established {
                action accept
            }
            invalid {
                action drop
            }
            related {
                action accept
            }
        }
    }
}

and is now

firewall {
    global-options {
        state-policy {
            established {
                action accept
            }
            related {
                action accept
            }
        }
    }
}

And I’m not seeing any other issues. I have not tried to reproduce this on other hardware, but my hardware is pretty generic, an Atom D525 CPU with e1000e NICs.

Anyone else experience this, or is there something I should look at to determine the cause?

2

Do you use “bridges” ?

3

Nope, my interfaces include ethernet, vifs, veth0 for a container, and several wireguard interfaces.

Don’t have any bridges configured.

4

I had that issue and several other ones, too. (No bridges here, either. I am running a 4-port APU4 for hardware.)

  • I tried several times to import a config from 1.5rolling, and it consistently lost all firewall settings (“show conf commands” would start its listing with “set interfaces ethernet…”, without showing any “set firewall…” statements.) Note, if I did a “cat /config/config.boot”, the firewall statements were there, they just weren’t picked up as part of the running config or displayed when I ran “show conf commands”.

  • It lost zone interfaces. I had to go in and add back the physical interfaces for each of my zones (except the self zone). Once I did that and “committed”, the “show conf commands” showed all the “set firewall” statements again.

  • And like you, I lost network connectivity. [Edit - DHCP worked - I still got an IPv4 address - but I couldn’t SSH into or ping the router.] (Fortunately my serial port kept working.) Your suggestion to “delete firewall global-options state-policy” seems to have fixed that. Thank you for that!

I had already reinstalled the latest 1.5rolling before I read your note. 1.5 Stream seems to be working now. My rules all have “default-actions” and a “drop” action for any “invalid” state, so I think I’m okay in terms of firewall behavior (though I’ll go back and review, to be sure).

5

Good to know I’m not the only one :slight_smile:
My ingress firewall has a jump that applies to the WAN interface, and otherwise accepts all traffic. So it’s odd that the global state policy is blocking the local interfaces.

I haven’t spent the time to compare the generated nftables rules with an older install yet.

6

I tried it again on different hardware (a basic 2-port SuperMicro J1900-based board) and had basically the same issues. My steps were a bit different between my two trials, but bottom line, after migrating from 1.5-rolling, I had to remove the troublesome firewall global state policy and add back in my two zones’ physical interfaces.

As an experiment, I tried adding that set firewall global-options state-policy invalid action 'drop' statement back in. The instant I entered commit I lost SSH access to the router. I could still surf the web through the router, I just couldn’t manage it. I hit the power button for a graceful shutdown, and since I hadn’t saved my commit, it was fine when it booted back up.

[Edited for clarity]

7

Just wanted to add on to this as I had the same problem/solution.

  • Have a virtual instance of VyOS running on Proxmox, virtio NICs
  • 1.5-rolling was running fine, upgraded to 1.5-stream, no packets
  • Removed global firewall options for state est/rel, packets started flowing again.
8

Can you try this thing?
Replace the 89 line via “vi or nano”, and add changes

sudo nano -c +89 /usr/share/vyos/templates/firewall/nftables.j2

restart service and reconfigure firewall

sudo systemctl restart vyos-configd
1 Like
9

@Viacheslav I just tested this and it appears to have solved the issue.

10

@Viacheslav this change only works for IPv4. Just realized that my IPv6 router advertisements weren’t working, and turns out it’s being caused by the same issue so that table needs the same change.

11

Same issue here. After upgrading to vyos-1.5-stream-2025-Q1outgoing traffic originating from the firewall itself is marked as invalid. Forwarded traffic works fine tough, even with bridges.

The suggested fix works (it removes the state check from VYOS_OUTPUT_raw):
Before:

	chain VYOS_OUTPUT_raw {
		type filter hook output priority raw; policy accept;
		jump VYOS_STATE_POLICY
		counter accept comment "OUT-raw default-action accept"
	}

After:

	chain VYOS_OUTPUT_raw {
		type filter hook output priority raw; policy accept;
		counter accept comment "OUT-raw default-action accept"
	}

@artooro If you want to apply the fix for IPv6 you can apply it the same way:
On Line 242 (chain VYOS_IPV6_OUTPUT_) replace this line:
{% if global_options.state_policy is vyos_defined %}
with:
{% if global_options.state_policy is vyos_defined and prior == 'filter' %}

1 Like