VyOS - Blog

VyOS 1.4.0-rc3 release candidate

daniil@sentrium.io (Daniil Baturin) — Mon, 22 Jan 2024 07:11:13 GMT

Hello, Community!

VyOS 1.4.0-rc3 image is now available for everyone to download and test. We are grateful to everyone who helped us test previously release candidate images. Thanks to your bug reports and pull requests, we fixed many bugs, including two that could cause the system to lock up at startup or shut down! We also did a lot of internal refactoring in January, but this image still has quite a few new features, including support for obtaining certificates from ACME providers (such as Let's Encrypt), IPv6 segment routing, IS-IS fast reroute, and more. We are also taking the last chance to make configuration syntax changes that will make the config look cleaner and make it easier to implement new features, so please pay attention to the config syntax and behavior changes section of this post. There's one feature from the rolling release time that we decided to remove due to its design flaws and the fact that it doesn't fit the scope of a router OS well — HTTPS virtual host configuration support.

VyOS 1.4.0-rc1 release candidate

daniil@sentrium.io (Daniil Baturin) — Fri, 22 Dec 2023 05:18:48 GMT

Hello, community! Exactly two years ago we made the VyOS 1.3.0/Equuleus LTS release. Now, after two years of development, the upcoming 1.4.0/Sagitta release has taken its final shape and we are happy to announce the first release candidate. The 1.4.0-rc1 image is now available for everyone to download and test and will become the new LTS release when real-world testing proves that it's stable and free of unexpected regressions.

VyOS 1.3.0-epa3 release

daniil@sentrium.io (Daniil Baturin) — Fri, 05 Nov 2021 21:26:08 GMT

Hello!

VyOS 1.3.0-epa3 release is available now. The generic ISO image is available publicly, while subscribers can access additional flavors through the support portal. This release fixes a number of bugs found in earlier versions. If no serious bugs are found, it will also become the last "early production access" release and the next image will be the first official 1.3.0 LTS release.

VyOS 1.3.0-rc6, the last release candidate

daniil@sentrium.io (Daniil Baturin) — Tue, 24 Aug 2021 15:46:46 GMT

Hello Community!

VyOS 1.3.0-rc6 release candidate image is now available for download. Quite some time passed between 1.3.0-rc5 and this release, mostly due to an IPsec bug that prevented certain configs from being either loaded or deleted, but it's fixed now. This is also the last release candidate before we enter the "early production access" phase—the finish line of the LTS release stabilization process.

Read on for details!

VyOS 1.2.8 and VyOS 1.3.0-rc5 are available

daniil@sentrium.io (Daniil Baturin) — Tue, 06 Jul 2021 12:47:04 GMT

In this post, we announce not one, but two releases at once.

First, VyOS 1.2.8 LTS release is available to subscribers and everyone is welcome to build their own images.

Second, a VyOS 1.3.0-rc5 release candidate is also available for download for everyone, and we invite everyone to test it on lab VMs with your production configs.

VyOS 1.3.0-rc4 release candidate is available

daniil@sentrium.io (Daniil Baturin) — Mon, 03 May 2021 17:27:04 GMT

VyOS 1.3.0-rc4 release candidate is now officially available for free download. We invite everyone to test it and report any issues you may find. Remember that active testers are eligible for contributor subscriptions! This release mostly features bug fixes and release process refinements. Many people rightfully suggested that we should include detailed changelogs for each release candidates, so starting from this release we are doing it, read on for details!

VyOS 1.2.7-epa1 and 1.3.0-rc1 images are available

daniil@sentrium.io (Daniil Baturin) — Fri, 26 Feb 2021 11:56:06 GMT

VyOS 1.2.7-epa1

First, VyOS 1.2.7-epa1 is now available to subscribers, and everyone can build an equivalent image from our repositories. It's a rather big release, with multiple bug fixes and some backports from the 1.3/equuleus branch. We don’t expect any major issues with it, but we encourage everyone to test it on non-critical routers first. If no issues are found within a week or so, we will call if a 1.2.7 release.

VyOS 1.2(Crux) EPA3 available to subscribers

yuriy@sentrium.io (Yuriy Andamasov) — Thu, 17 Jan 2019 07:00:00 GMT

The new VyOS 1.2.0-epa3 early is ready and available to subscribers

VyOS 1.2.0-rc11 is available for download

daniil@sentrium.io (Daniil Baturin) — Mon, 17 Dec 2018 23:20:06 GMT

VyOS 1.2.0-rc11 is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc11.

Last RC, Early Production Access, Educational and non-profit Access Subscriptions

yuriy@sentrium.io (Yuriy Andamasov) — Thu, 13 Dec 2018 13:05:24 GMT

Hello Community!

We were busy as always doing coding and some more useful stuff, but it’s time for an update.

VyOS 1.2.0-rc10 is available for download

daniil@sentrium.io (Daniil Baturin) — Tue, 04 Dec 2018 15:42:58 GMT

VyOS 1.2.0-rc10 is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc10

Resolved issues

The following issues have been fixed:

If you save your configuration on a system booted from a livecd, you will be offered to copy it to the installed image (T1047).
EFI GRUB can now be installed in a removable location (T1023).
The "run show vpn ipsec sa" command now works correctly for SAs with non-zero traffic counters (T956).
IPsec SA in/out traffic counters are not displayed in human-readable units (T956).

Issues that need testing

We have a bunch of issues that need testing. Please tell us if the following features work for you, or help us figure out a reproducing procedure! We need to make sure they are resolved before we make a stable 1.2.0 release, but we are either unable to reproduce them because they are hardware-specific and we don't have required hardware anywhere; or we cannot reproduce them using the provided procedure, which may mean either that the procedure is incomplete, or that the bug is already fixed.

Kernel crashed under (network) load with gen5 Mellanox cards (T1014).
Broken 6rd tunnel implementation (T1000).
Problem with Intel XL710 NICs (T961).
L2TPv3 interfaces sometimes not loaded on boot (T942).
OSPF process crashing on peer reboot (T922).
BGP process doesn't start on boot (T904).

Additionally, we would like to know if DMVPN and SNMP integration with routing protocols are working well for you. If you've seen any of those issues, or, to the contrary, you can confirm that you've never seen them, please let us know.

VyOS 1.2.0-rc9 is available for download

daniil@sentrium.io (Daniil Baturin) — Mon, 26 Nov 2018 20:40:14 GMT

We are getting closer and closer to the stable release. There are still bugs for a couple more release candidates, and some features we need to get in, but generally the time of spectatular updates in the 1.2.0/crux branch is almost over—all big things will be going on in the new 1.3.0/equuleus branch soon. The new release candidate is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc9

Software updates

The kernel has been updated to the most recent 4.19.4 release. It includes multiple fixes in drivers, so tasks related to drivers like this one about Mellanox card causing a crash under load (T1014), or those about Intel cards (T986, T961) should be re-tested.

This kernel also removes the original SPECTRE vulnerability mitigation code that had a big performance impact. We'd like to hear about your experience in this regard.

We have also included the Hyper-V daemons package. If you are running VyOS on a Hyper-V host, please let us know if it works well for you.

As usual, FRR has been updated to the latest master as well.

Bugfixes

The "protocols bgp ... address-family ipv4-unicast redistribute ospf" works again (T1034).
Set-time validation rules for OSPFv3 areas does not allow decimal notation anymore, since it was never allowed by Quagga or FRR (T981).
PPPoE server help strings and autocompletion have been improved.
The ofed-scripts package (a remnant of the official Mellanox drivers) is removed from the image since we are using kernel built-in drivers now.
Package lists for the image build now correctly include aptitude which is needed for the grub-efi package fetching, so you should be able to build images yourself without problems again. Sorry it's been broken for a while!

Contributor subscriptions

Since the moment we've published the pre-registration form, we have received a number of LTS subscription requests from our veteran contributors, and people who have joined VyOS recently. We are still working on the subscriber portal, but we'll make sure to send everyone a notification when the 1.2.0 LTS release, and the portal are ready. When the portal is ready, contributors will be able to register directly.

If you have been or are contributing to VyOS, you can find the form here.

Upd

Originally the image was accidentally uploaded with broken wireguard package, but the issue is resolved now, thanks to Kroy who identified the issue and notified us quickly.

VyOS 1.2.0-rc6 is available for download

daniil@sentrium.io (Daniil Baturin) — Tue, 06 Nov 2018 23:54:41 GMT

As usual, every week we make a new release candidate so that people interested in testing can test the changes quickly and people who reported bugs can confirm they are resolved or report further issues.

VyOS 1.2.0-rc6 is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc6

It includes a small but significant number of bugfixes and a couple of removed commands.

Package updates

VyOS 1.2.0-rc6 uses the Linux kernel 4.19.0. The 4.19 kernel will be the next LTS version, it should be a good kernel to stick with for the lifetime of the 1.2.0 release.

The 4.18 kernel was quite buggy, and 4.14.75 had annoying bugs with small packets causing packet loss in Xen that was solved in later versions.

This image also uses built-in drivers for Mellanox cards rather than those built from the official tarball, since they do not build for newer kernels yet. If you are using one of their fifth generation cards, let us know if it works for you.

Wireguard issues

Issues with creating multiple wireguard interfaces (T949) and with wireguard interfaces disappearing after reboot (T943) have been resolved.

Issues with removing long format IPv6 addresses from interfaces

It was always possible to use long format of IPv6 addresses, with leading zeroes, like 2001:db8:0:0:0:0:0:1/64 (T288), but it was impossible to delete them without rebooting the router because iproute2 does compacts addresses at set time and doesn't recognize the short and long forms as the same address. We've added a workaround for it and it should no longer be a problem.

Import route-map not set for IPv4 BGP peer groups

There was an issue with setting import route-map for IPv4 peer groups (T924). I have to admit I simply forgot to convert one of the commands to the new "address-family ipv4-unicast" syntax, so the path existed in the CLI, but was never passed to FRR correctly. Now it should work as expected.

New command for checking VyOS installation integrity

If you, like me, can never remember if you are running a stock image or a modified installation, this is for you.

dmbaturin@vyos:~$ show system-integrity

The following packages don't fit the image creation time:

build time:     2018-11-06 01:28:00

installed: 2018-11-06 01:44:28  vyos-1x

It only shows is any packages were installed on top of the image, and not whether any files were modified, but that's better than nothing.

Removed commands

The "run show vpn debug detail" operational mode command was removed because it was based on a script that StrongSWAN no longer provides, and reimplementing it is probably more trouble than it's worth since it just aggregates information already available in the logs and output of other commands.

We have also removed the "set service dhcp-relay relay-options port" command. The DHCP RFC nowhere says that servers or relays MAY use a port other than UDP/67, and almost no clients support alternative ports either, so this option hardly has any practical value. If you used to use it, it will disappear from your config. If you actually need it, please tell us about your use case.

VyOS 1.2.0-rc5 is available for download

daniil@sentrium.io (Daniil Baturin) — Mon, 29 Oct 2018 17:50:49 GMT

As the tradition dictates, the new weekly release candidate is available for download

Package updates

The following packages have been updated:

Linux kernel to 4.14.75
Mellanox network drivers to 4.4

Bug fixes

SNMP integration with routing protocols

The last bit configuration that is required for it to work is in now, and it should work as expected again. If it doesn't work for you, let us know!

VRRP not working in unicast mode when the RFC-compatible mode is selected

In T933 it was reported that if you configure VRRP in unicast mode and choose to use virtual MACs (RFC compatible mode), both nodes become masters. Now the config option required for this to work is inserted into keepalived config.

DHCP relay now handles the port option correctly

As reported in T938, DHCP relay would not handle the port option correctly. Now it does.

Tag nodes with whitespace

As reported in T253, it was possible to create a tag node with whitespace in its name (e.g. "set system login user "foo bar" authentication..."), but such configs would not be parsed correctly if you try to load them back.

In most cases attempts to create such nodes should be blocked at the syntax validation level, but since old configs with such nodes may exist, and it is impossible to disallow doing that completely at the set command level, we've added support for quoting such nodes properly in the code responsible for displaying and saving configs. Now such configs will load at least partially and produce more descriptive errors when disallowed by individual command syntax.

Commit archive problem with edit levels

As reported in T570, changing the edit level caused the commit archive feature to save only the config at that level to the remote server, for example, if you did "edit interfaces", the archived config would contain nothing but the interfaces subtree.

It was caused by erroneous omission of the option that makes cli-shell-api output the entire config regardless of the edit level and should be fixed now.

The "run monitor traffic interface ... filter" commands now has full support for tcpdump filters

As reported in T931, commands like "run monitor traffic interface eth0 filter ''src 192.0.2.1 or dst 203.0.113.10" would fail. Now the simple mistake that caused it is fixed and such commands should work again.

Compatibility notes

Username restrictions

Related to the whitespace issue, some commands had overly permissive syntax. The "system login user" username format has been restricted to the POSIX portable characters and length below 100 now (that's alphanumeric characters, underscores, hyphens, and dots). If usernames do not conform to the undeniably portable format (alphanumeric and underscores/hyphens only), you will receive a warning.

There may be old configs with unusual usernames, and they now may fail to load. If you run into issues with that restrictions, let us know.

The "inspect" action in firewall rules no longer exists

The "inspect" action was once used for the IPS/IDS functionality, but the IDS (it was Snort) was removed long before VyOS was forked from Vyatta. The now useless action, however, persisted.

Now we have removed it. We think the chance to see it in a real config is very low, and this should have no impact, but if you run into problems, leave a note in T59, and we'll make a migration script.

In other news

The 1.2.0/Crux repositories are now fully separated from the "current" branch repositories, in preparation for the LTS release. This reopens the "current" branch for experimental and potentially unsafe changes so that we can start working on new big rewrites, migration to newer Debian and other things required for the future 1.3.0 release.

VyOS 1.2.0-rc4 is available for download

daniil@sentrium.io (Daniil Baturin) — Thu, 25 Oct 2018 14:18:45 GMT

VyOS 1.2.0-rc4 release candidate is available for download from here

The release includes multiple bug fixes and a few small features.

You can view the complete changelog here.

Here are some highlights:

Bugfix: SNMP and routing protocols

Due to a change in FRR compared to our old Quagga, SNMP support for routing protocols had been broken for a while. Now it should work again.

Bugfix: BGP community lists

Due to another change in FRR, we've had an annoying bug that made it impossible to edit BGP community list rules after creation (T799).

For now it was fixed using a dirty hack that may slow down community list editing operations somewhat, and the root cause was reported to FRR maintainers. Once they fix it, we can remove the hack easily.

Feature: BGP extended community lists

Support for extended community lists was supposed to be there for a long time, but in reality the commands were broken (T64).
The bug in community lists editing helped us discover that issue, and the commands were fixed.

Here is an example of that feature's syntax:

# show policy extcommunity-list ExctcommunityExample

 rule 10 {

     action permit

     regex 100000:999

 }

 rule 30 {

     action deny

     regex ^$

 }

[edit]

# show policy route-map ExtcommunityExample

 rule 10 {

     action permit

     match {

         extcommunity ExctcommunityExample

     }

 }

Please test is and tell us if it works fine for you.

SSH allow-root option

The "service ssh allow-root" is no longer supported. It will be automatically removed from configs first time the upgrade image boots.

It's a common wisdom that logging in as root is not a good idea. We believe this change is going to have a very limited impact at best. One objection was that automation tools may need it, but all modern tools such as ansible are capable of elevating privileges properly with sudo.

However, if your automation setup is using it, please take it into account. You still have time to do it before 1.2.0 LTS is released.

New drivers and utilities

VyOS now includes updated firmware packages, in particular, new firmware for Broadcom cards that were reported not to work in T708.

The image also includes a few popular diagnostic tools by default, such as htop, atop, and iotop.

VyOS 1.2.0-rc3 is available for download, with BGP large communities and new bugfixes

daniil@sentrium.io (Daniil Baturin) — Mon, 15 Oct 2018 14:18:56 GMT

VyOS 1.2.0-rc3 release candidate is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc3

Thanks to all people testing release candidates, more bugs were uncovered and fixed. But this release also includes a new feature, that was made possible by migration away from our outdated Quagga, namely:

BGP large communities

Since we are using FRR rather than an outdated Quagga version now, we could finally add CLI support for a long requested feature: large communities. Now that RIRs are out of 32-bit AS numbers, it's more relevant than ever.

The syntax is very simple and similar to that of community-lists:

set policy large-community-list Foo rule 10 action permit
set policy large-community-list Foo rule 10 regex 4000000:33333:4444
set policy large-community-list Foo rule 20 action deny
set policy large-community-list Foo rule 20 regex '^$'

set policy route-map Bar rule 10 action permit
set policy route-map Bar rule 10 match large-community large-community-list Foo

set policy route-map Quux rule 10 action permit
set policy route-map Quux rule 10 set large-community 90000:555:111

Note that there are no well-known communities such as "no-export" here, unlike in the classic communities. I also decided not to implement support for "standard" (numbered) large-community-lists and only include "expanded" (named) lists.

Now to the bug fixes.

Directly connected interface-routes

Some hosting providers, for example, Online.net, use an unusual configuration with /32 host addresses, where you are supposed to create an interface-based route to the default gateway address and then create a default route via that address.

While this configuration is against the classic networking common sense, and I'm not a fan of it, it's technically perfectly valid and increasingly common. The Linux kernel network stack uses a "you asked for it, you get it" approach and allows you to do any crazy things, which sometimes turn out surprisingly useful. Our old Quagga, however, would treat such routes as unreachable because the next hop address is not from the same network as assigned on the interface — sound reasoning, but in this situation it was wrong.

The only way to make it work was to add an iproute2 command to the postconfig script, which is cumbesome. Migration to FRR seems to have resolved that issue though. This configuration appears to work fine in my lab:

set interfaces ethernet eth1 address 192.0.0.2.10/32

set protocols static interface-route 203.0.113.1/32 next-hop-interface eth1

set protocols static route 0.0.0.0/0 next-hop 203.0.113.1

This is what the route table looks like: the 203.0.113.1/32 route is treated as directly connected.

vyos@vyos# run show ip route

...

S>  0.0.0.0/0 [1/0] via 203.0.113.1 (recursive), 00:00:03

  *                   via 203.0.113.1, eth1 onlink, 00:00:03

C>* 192.0.2.10/32 is directly connected, eth1, 00:00:03

S>* 203.0.113.1/32 [1/0] is directly connected, eth1, 00:00:03

And this is what it looks like in the kernel:

vyos@vyos# run show ip route forward

default via 203.0.113.1 dev eth1 proto static metric 20 onlink

192.168.56.0/24 dev eth0 proto kernel scope link src 192.168.56.13

203.0.113.1 dev eth1 proto static metric 20

If you are using online.net or another hosting provider that uses this scheme, please test it and tell us if it works for you without workarounds.

Fixes in bridging and tunnels

Thanks to Kroy from the forum, we tracked down and fixed a few bridging bugs that had been there for a long time but no one noticed.

The first bug was that the system allowed you to remove a bridge that still has active members (T898). Even with that bug fixed, you still could not remove a tunnel interface from a bridge because its own script was faulty (T900).

Both are now fixed, but there are still issues in that script: STP cost and priority options are not functional. We may fix it in the next release candidate.

Additionally, OpenVPN interfaces could not be added to bridges due to a brctl syntax change, as reported by afics in T884. This should also be fixed now.

Image signature check failure confirmation

Armin Fisslthaler (afics) noticed a particularly embarassing bug: when the installer fails to verify image GPG signature (due to missing key or otherwise), it asks if you want to proceed, and suggests that the default option is "No", but if you just hit Enter, it proceeds instead of exiting ( T885).

Ewald van Geffen took the time to fix that conditional and now it should no longer haunt us.

Missing release key in the image

Speaking of which, the VyOS release key is now included in the image and signature check should no longer fail.

More fixes

Corrected the syntax for deleting IPv6 next-hop (T800, fix suggested by Merjin).

IPv6 next-hop local value is now validated at set rather than commit time (T897).

Known issues

VyOS 1.2.0-rc2 is available for download, with fixes to wireguard and PBR

daniil@sentrium.io (Daniil Baturin) — Tue, 09 Oct 2018 19:15:42 GMT

The second release candiate is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc2

We are happy to see so many people test the release candidates! Some bugs were already found and fixed, and we are working on some more bugs found since the release of 1.2.0-rc1. To make already completed fixed available, we are making the second release candidate.

Resolved issues

Wireguard module not loading (T881).
PBR routes leaking into other tables (T882).
Unhandled exception in the wireguard op mode (T883).

Known issues

Fail to add an OpenVPN to a bridge group if cost is not specified (T884, let us know if you also see it).
commit-confirm doesn't cancel reboot properly (T870).
The GPG key for release builds is not included in the image

Stay tuned for the rc3!

First VyOS 1.2.0 release candidate is available for download

daniil@sentrium.io (Daniil Baturin) — Mon, 08 Oct 2018 16:49:00 GMT

This month, the VyOS project turns five years old. In these five years, VyOS has been through highs and lows, up to speculation that the project is dead. Past year has been full of good focused work by the core team and community contributors, but the only way to make use of that work was to use nightly builds, and nightly builds are like a chocolate box a box of WWI era shells—you never know if it blows up when handled or not. Now the codebase has stabilized, and we are ready to present a release candidate. While it has some rough edges, a number of people, including us, are already using recent builds of VyOS 1.2.0 in production, and now it's time to make it public.

VyOS 1.2.0-rc1 is available for download from https://downloads.vyos.io/?dir=testing/1.2.0-rc1

VyOS 1.2.0 (Crux) is the feature expansion release based on Debian Jessie. The release candidate will be the basis for the future long term support release. You can read the full release notes at https://wiki.vyos.net/wiki/1.2.0/release_notes

New features include:

Wireguard support
PPPoE server
mDNS repeater and broadcast relay
Support for IPv6 VRRP and unicast VRRP operation
NPTv6
Standards-compliant QinQ ethertype option
Python APIs for accessing the running config and writing migration scripts (replacements of the Perl Vyatta::Config and XorpConfigParser)
New XML-based command definitions
New build system that makes it easy to create custom builds with additional repositories and packages
SR-IOV support for Intel and Mellanox cards

The following features have been removed:

Telnet server
p2p filtering

While the base system if Debian Jessie, multiple packages have been updated to much newer versions, for example, the 4.14.65 kernel, StrongSWAN 5.6, and keepalived 2.0.5.

Additionally, our old Quagga has been replaced with FRR, which opens a way to adding support for many more protocols, including multicast routing.

Known issues

Some people reported issues with DMVPN in hub mode (T848).

Some people report an issue with routers responding to all ARP requests when VTI is enabled (T852).

If you use DMVPN or VTI, you may either help with testing and debugging those issues, or wait until the issues are confirmed to be resolved.

What's next

VyOS 1.2.0 will become the LTS release after one or more release
candidates.

We are preparing a release model change that will involve
splitting VyOS into an LTS branch a (roughly) monthly rolling release made from the latest
code from the current branch. Both branches will be entirely open source, but while the rolling release builds will be available free of charge to everyone, the LTS ISO image builds will be only available to those who either contribute to VyOS (code, documentation, and community activities all count) or purchase a subscription. There will always be an option to build the LTS image entirely from source or using package repositories at dev.packages.vyos.net, though commercial support will only be provided for official builds, or by special arrangement.

We are also working on new commercial support plans and pricing models.

The current branch will now be used for developing 1.3.0. Top priorities for 1.3.0 include migration to the next Debian release and rewriting more legacy code to enable better testing and easier addition of new features.

In a sense, VyOS 1.2.0 was a test whether the project can exist
independently or not. While 1.1.x was an incremental expansion of the
last Vyatta Core release, development of 1.2.0 coincided with mainstream
Linux distributions switching to systemd, many packages such as
StrongSWAN making big incompatible changes, and parts of VyOS itself
reaching the point when bugs could no longer be fixed without a complete
rewrite. The build system also had to be rewritten from scratch.

A lot of work went into developing the new infrastructure for Python rewrites, including the new system of command definitions and required libraries. By now a a few components including SSH, SNMP, cron, and DNS forwarding have been rewritten in the new way, and the rewrite movement is gaining momentum.

Let's test and polish the 1.2.0 release, and keep working on making VyOS a better, more easily maintainable platform in the future 1.3.0 release.

1.1.1 release candidate

daniil@sentrium.io (Daniil Baturin) — Mon, 24 Nov 2014 10:48:00 GMT

I have prepared a 1.1.1 release candidate image. Please test it and tell us if it works for you so we know if we can call it a release.