Hello All,
I’m getting an error when I try to load firewall rules into a 1.4 rolling VyOS router running as an LXC virtual machine. I’m attempting to use ansible to configure it using the vyos_command ansible module to delete the current firewall rule configuration, commit, then load in the updated firewall rule configuration. To keep it as simple as possible I’m trying to start by loading the rules of the firewall set before loading the zones into the firewall. These rules came from my configured VyOS router that is currently working without issue.
VyOS version is 1.4 built on April 10th, 2023 (I build them myself).
I keep running into the error: "Migration script error: /opt/vyatta/etc/config-migrate/migrate/firewall/7-to-8: [Errno 1] failed to run command: [‘/opt/vyatta/etc/config-migrate/migrate/firewall/7-to-8’, ‘/tmp/tmpqj70wj71’]
returned:
exit code: 1.
"
The config I’m trying to merge in is:
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
group {
address-group HAProxy {
address 10.0.30.150
address 10.0.30.10
address 10.0.30.11
address 10.0.30.12
description "HAProxy Hosts"
}
}
ipv6-name default-relatedestablished-6 {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name DMZ-DNSDHCP {
default-action drop
rule 10 {
action accept
destination {
port 53
}
protocol tcp_udp
}
}
name DMZ-GenDev {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
}
name DMZ-Infra {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 10 {
action accept
source {
group {
address-group HAProxy
}
}
}
}
name DMZ-RouterLocal {
default-action drop
description "DMZ to Router Address"
rule 1 {
action accept
destination {
address 10.0.30.0/24
}
disable
}
}
name DMZ-WAN {
default-action accept
}
name DNSDHCP-GenDev {
default-action accept
}
name DNSDHCP-Infra {
default-action accept
}
name DNSDHCP-RouterLocal {
default-action accept
}
name DNSDHCP-WAN {
default-action accept
}
name GenDev-DMZ {
default-action accept
}
name GenDev-DNSDHCP {
default-action accept
}
name GenDev-IOT {
default-action accept
}
name GenDev-Infra {
default-action accept
}
name GenDev-RouterLocal {
default-action accept
description "GenDev to Router Address"
}
name GenDev-WAN {
default-action accept
}
name Guest-RouterLocal {
default-action drop
description "Guest to Router Address"
rule 1 {
action accept
destination {
address 10.0.110.0/24
}
disable
}
}
name Guest-WAN {
default-action accept
}
name IOT-GenDev {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
}
name IOT-Infra {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
}
name IOT-RouterLocal {
default-action drop
description "IOT to Router Address"
rule 1 {
action accept
destination {
address 10.0.20.0/24
}
disable
}
}
name IOT-WAN {
default-action drop
rule 10 {
action accept
disable
source {
address 10.0.20.10-10.0.20.19
}
}
}
name Infra-DMZ {
default-action accept
}
name Infra-DNSDHCP {
default-action accept
}
name Infra-GenDev {
default-action accept
}
name Infra-IOT {
default-action accept
}
name Infra-RouterLocal {
default-action accept
description "Infrastructure to Router Address"
}
name Infra-WAN {
default-action accept
}
name RouterLocal-DNSDHCP {
default-action accept
}
name RouterLocal-GenDev {
default-action accept
}
name WAN-DMZ {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 10 {
action accept
destination {
address 10.0.30.10
port 80,443
}
protocol tcp_udp
state {
new enable
}
}
rule 11 {
action accept
destination {
address 10.0.30.151
port 19132
}
protocol udp
}
}
name WAN-IOT {
default-action drop
rule 10 {
action accept
destination {
address 10.0.20.10-10.0.20.19
}
disable
state {
established enable
related enable
}
}
}
name WAN-Infra {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 10 {
action accept
destination {
address 10.0.0.58
port 1194
}
protocol tcp_udp
state {
new enable
}
}
rule 20 {
action accept
destination {
address 10.0.0.60
port 1194
}
protocol tcp_udp
state {
new enable
}
}
rule 30 {
action accept
destination {
address 10.0.0.53
port 51820
}
protocol tcp_udp
state {
new enable
}
}
}
name WAN-Local {
default-action drop
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 3 {
action accept
protocol icmp
}
rule 10 {
action accept
description WireGuard
destination {
port 36730
}
log enable
protocol udp
}
}
name default-relatedestablished {
default-action drop
description "Drops traffic not related/established"
rule 1 {
action accept
state {
established enable
related enable
}
}
}
name local-Guest {
default-action accept
}
name local-Infra {
default-action accept
}
name local-WAN {
default-action accept
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}