config.txt (8.8 KB)
I have been trying to figure out how to enable IMCP on public IP, I did have it working in the past but this modem from Three Y5-210MU it would work then randomly stop working like all open ports wouldn’t work after had to migrate my vyos install to a virtual machine and moved it back then after setting a static route from dhcp-interface eth1 fixed it. is there any better way to do this also ?
icmp from where to where exactly?
rule 30 {
action "accept"
description "Allow ICMP."
protocol "icmp"
state "established"
state "related"
}
Remove the state and related. You should almost never match the state in specific rules unless you are really really sure you need it. State matching is done at the beginning of the chain or globally like you have configured in you config already.
the public facing IP attached to my connection.
@roedie has beaten me too it.
Sure They can be handled by the global options at the top. I was trying to figure out why NAT port forwarding broke after moved the install to a virtual machine temporarily as I had an issue with a larger size usb but that was due to the odd issues the modem has. So I had a different firewall layout I’ll post that shortly.
firewall {
flowtable FLOW-SW {
interface "eth0"
}
global-options {
state-policy {
established {
action "accept"
}
invalid {
action "drop"
}
related {
action "accept"
}
}
}
group {
interface-group LAN {
interface "eth0"
}
interface-group WAN {
interface "eth1"
}
network-group LAN-IPV4 {
network "10.0.0.0/23"
}
}
ipv4 {
forward {
filter {
rule 10 {
action "offload"
offload-target "FLOW-SW"
}
}
}
name LAN_OUT {
default-action "accept"
rule 10 {
action "accept"
}
}
name LOCAL {
default-action "accept"
rule 10 {
action "accept"
}
}
name WAN_IN {
default-action "drop"
rule 10 {
action "accept"
}
}
name WAN_LOCAL {
default-action "drop"
rule 10 {
action "accept"
}
rule 20 {
action "accept"
destination {
port "53"
}
protocol "tcp_udp"
}
}
}
}
This was my config the above one was changed just because nat wasn’t working but it required 2 static routes where it worked with just next-hop 192.168.0.1 but after temporarily moving it to a virtual machine and back to a dedicated system. it required a secondary static route for nat to work. though i am trying to enable imcp to enable he tunnel..
So this config does work but Three UK filter it on most IPv4 blocks I did get one that wasn’t filtered so it worked till got a new dynamic IP.
Don’t you hate ISPs that want to decide that is good for you…
Yep it is frustrating though at least if others want to enable IMCP on WAN IP they at least can find some parts of my config useful. i am suprised they allow you to open mail ports but sending any email is just rejected by most mail servers due to spamhaus blocking inbound mail on dynamic IP ranges.
it keeps allocating me this specific IP then it works without any problem but i at least found that its to do with ISP and not vyos config.
My config i attached at the start is just me changing it trying to figure out the reason why IMCP would not work i had copied parts of another old config i was using. here is my most recent config with some other changes. hopefully someone can make use of it.
firewall {
flowtable FLOW-SW {
interface "eth0"
}
global-options {
state-policy {
established {
action "accept"
}
invalid {
action "drop"
}
related {
action "accept"
}
}
}
group {
interface-group LAN {
interface "eth0"
}
interface-group WAN {
interface "eth1"
}
network-group LAN-IPV4 {
network "10.0.0.0/23"
}
}
ipv4 {
forward {
filter {
rule 10 {
action "offload"
offload-target "FLOW-SW"
}
}
}
name LAN_OUT {
default-action "accept"
}
name LOCAL {
default-action "accept"
}
name WAN_IN {
default-action "drop"
}
name WAN_LOCAL {
default-action "drop"
rule 10 {
action "accept"
protocol "icmp"
source {
address "192.168.0.1"
}
}
}
}
}