Hello, Community!
Quite a lot of things have happened since the last update we posted in April. In particular, we added the last bit of functionality that we considered a hard requirement for the VPP-based accelerated dataplane: support for VPP firewall. This marks the point when we consider the minimal viable product complete and we plan to ship it in a VyOS Stream release later this year, likely in Q3 — although you don't have to wait for it to play around with it, since it's already in the rolling release.
We are also making a very good progress towards replacing the legacy config backend — that work is still in the development phase and has no visible effects, and will take a while longer to complete, but it's underway.
When it comes to bugs, there are more than twenty recent fixes, including a fix for the nasty bug that led to routing protocol configuration loss if a protocol daemon crashed. Another important fix contributed by a community member makes VMware VMs suspend and resume correctly. Last but not least, the login prompt is no longer displayed in a bold font — that one took more time to track down than anyone hoped, and turned out to be caused by a truncated Systemd service name (ANSI control codes do not reset themselves on word boundaries, you know...).
There are multiple improvements in the base system as well. There's a new set ystem option reboot-on-upgrade-failure command that makes the system automatically reboot into the previous image if the configuration fails to load after upgrade. We hope it will help multiple people avoid unplanned trips to remove places — of course there should be out-of-band management everywhere for this case, but we all know that the real world is not perfect.
Other recently added features include support for IPv6 address in the datasets for firewall remote groups, BPDU guard and root guard supports for bridges, a new option to limit BRAS services (IPoE, PPPoE, and friends) to a specific number of CPU cores to avoid system overload, and more — read on for details!
set load-balancing reverse-proxy global-parameters logging facility command is removed because the option is not actually supported by HAProxy. Migration scripts remove it automatically, no need to take any action (T7429).clear session <tty> is now reset session <tty> since clear is a name reserved for completely non-disruptive commands (T6696).set firewall global-options state-policy offload offload-target <flowtable> (T7358).set system kernel option quiet (T7397).privileged option (T7412).show interfaces kernel (T7268).set nat66 source rule 10 destination group network-group <name> (T7051).set interfaces bridge brX member interface <intf> <bpdu-guard|root-guard> (T7430).remote-group lists now allow both IPv4 and IPv6 addresses (T7386).set service pppoe-server thread-count <all|half|N> (T7348).set system option reboot-on-upgrade-failure [timeout <min>] (T1771).set system option kernel cpu disable-nmi-watchdog
set system option kernel cpu isolate-cpus '1,2,4-5'
set system option kernel cpu nohz-full '1,2,4-5'
set system option kernel cpu rcu-no-cbs '1,2,4-5'
set system option kernel disable-hpet
set system option kernel disable-mce
set system option kernel disable-softlockup
set system option kernel memory default-hugepage-size '2M'
set system option kernel memory disable-numa-balancing
set system option kernel memory hugepage-count '256'
set system option kernel memory hugepage-size '2M'renew operational mode commands (T7395).system option subtree (T7394).set service https api now correctly applies listen-address and no longer listens on all addresses (T7393).redirect-location now correctly says it's a path rather than a URL (T7335).803-3ad at set time rather than at commit time (T7466).giaddr is configured. In 1.4 it's a warning, in later versions — a commit failure (T7472).That's all for now but stay tuned for updates — we are preparing the VyOS Stream 2025-Q2 now and will share it when the image is ready!