Show Firewall Problem - VyOS 1.4-rolling-202209260217

Bugs
, , ,
1

Hehey

Since i updated the vyos, i can’t show firewall statistics and logs.

IPv6 Firewall "WAN-LOCAL"

Rule       Packets    Bytes  Action    Source     Destination
-------  ---------  -------  --------  ---------  -------------
50               0        0  accept    0.0.0.0/0  0.0.0.0/0
51               0        0  accept    0.0.0.0/0  0.0.0.0/0
100              0        0  accept    0.0.0.0/0  0.0.0.0/0
101              0        0  drop      0.0.0.0/0  0.0.0.0/0
default          0        0  drop      0.0.0.0/0  0.0.0.0/0

****@****:~$ sh log firewall name WAN-IN 
****@****:~$

Also show firewall looks strange:

IPv4 Firewall "CRITICAL-OUT"

Rule     Action    Protocol
-------  --------  ----------
50       drop      all
100      accept    all
101      drop      all
110      accept    tcp
120      accept    tcp
130      accept    tcp
150      accept    tcp
151      accept    tcp
153      accept    tcp
155      accept    tcp
156      accept    tcp
157      accept    tcp
160      accept    tcp
190      accept    tcp
default  drop      all

Theres no Interface showing…

But Blessing in disguise the firewall works:

****@****:~$ sudo nft list ruleset
...
	chain NAME6_WAN-IN {
		ct state { established, related } counter packets 0 bytes 0 return comment "WAN-IN-100"
		ct state invalid counter packets 0 bytes 0 drop comment "WAN-IN-101"
		meta l4proto ipv6-icmp counter packets 184 bytes 11040 return comment "WAN-IN-110"
		ip6 daddr ************* tcp dport 9001 counter packets 2092 bytes 194957 return comment "WAN-IN-130"
		tcp dport 587 counter packets 0 bytes 0 return comment "WAN-IN-150"
		ip6 daddr ************* tcp dport 993 counter packets 0 bytes 0 return comment "WAN-IN-152"
		ip6 daddr ************ tcp dport 25 counter packets 15 bytes 1140 return comment "WAN-IN-153"
		ip6 daddr ************ tcp dport 42420 counter packets 0 bytes 0 return comment "WAN-IN-190"
		ip6 daddr ************ tcp dport 23666 counter packets 0 bytes 0 return comment "WAN-IN-200"
		counter packets 0 bytes 0 drop comment "WAN-IN default-action drop"
...

Is there a setting that causing this?
/var/logs/messages or /var/log/kern.log not one of all my firewall log setting is showing.

2

Hi @yog,

the VyOS 1.4 Firewall code is currently under rewrite from iptables → nftables. You have hit a bug with the display of the filtered values.

We will take a look!

1 Like
3

thanks a lot. :ok_hand:
i thought vyos 1.4 uses already nftbales.

Edit:
moved from “General questions” to Bugs.

4

Ah… I was wondering as the set command:
set interfaces ethernet eth0 firewall
is not valid for:
vyos-1.4-rolling-202210010218

I rolled back to a working rolling version I had around
vyos-1.4-rolling-202209090217
And that worked.

5

Syntax was changed. It migrates during the update process:

set firewall interface eth0 local name FOO