It looks like nftables were replaced with iptables due to T3781 in VyOS 1.3 Equuleus (1.3.0-epa1).
I now consistently experience broken pipes (disconnections) while copying large files over ssh from inside-LAN client to outside server through vyos NAT in between.
I have a very typical setup: 192.168.0.0/24 local subnet (LAN) and vyos router (1.3.0-epa1) with masquerade SNAT and one external WAN ip. The problem is that a client residing in the LAN subnet cannot copy large files over ssh to the external (cloud) server: connection randomly disconnects with “disconnect: Broken pipe” in the logs. Though copying itself goes smoothly until the very disconnect moment: it’s clearly visible on the server side with iotop. Disconnect randomly happens in 7 to 50 minutes. I never could complete the copy (it takes about 5 hours normally given the file size and link speed). If I boot to previous image (1.3-rolling-20210813) with exactly same config everything works fine, and ssh never disconnects.
I double checked conntrack settings, timeouts - everything is identical between epa1 image and 1.3-rolling-20210813. The only difference is that version of Aug 13 has nftables instead of iptables in epa1. ServerAliveInterval in client’s ssh config doesn’t help either.
Does anybody know how to fix this?
Thanks a lot.