Hello, community!
@e added new firewall options, improved NAT66, brought IPv4 network mapping back, and fixed a whole bunch of bugs, and rewrote multiple operational mode commands in the new format. Read on for details!
It's now possible to force AnyConnect/OpenConnect VPN clients to use DNS servers provided by the OpenConnect server for certain domains using this command:
set vpn openconnect network-settings split-dns <domain>In many setups, monitoring and management services run in a dedicated VRF, but there was no way to specify VRF in the Telegraf monitoring agent settings. Now there is:
set service monitoring telegraf vrf MyVRFBy default, all MTU configuration nodes contained a value of 1500. After any change of interface, MTU was back to the default value. But MTU can be set from other sources: dynamically by DHCP client or manually via custom scripts.
Now there is an option to receive the MTU from a DHCP server:
set interfaces ethernet eth0 dhcp-options mtuIt's now possible to specify the IP address to use in the NAS-IP-Address RADIUS attribute for L2TP.
Example:
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius nas-ip-address '192.0.2.1'
set vpn l2tp remote-access authentication radius server 192.0.2.2 key 'foo'
set vpn l2tp remote-access client-ip-pool subnet '100.64.24.0/24'
VyOS once supported 1-to-1 network address translation for IPv4, but when we first migrated the NAT implementation from iptables to nftables, that functionality was missing in the Linux kernel and from nftables. Thus if someone wanted to map an internal network to an external network of the same size, they'd have to create a rule for every address. That would result in very large configs that are hard to maintain. Now network mapping is supported again — just set both destination address and translation address to network prefixes of the same size.
For example:
set nat static rule 20 destination address '203.0.113.0/24'
set nat static rule 20 inbound-interface 'eth0'
set nat static rule 20 translation address '192.0.2.0/24'
Initial support for NAT66 was already covered in previous releases. However, we added more features to it in August per requests from users.
It's now possible to:
Example:
set nat66 destination rule 10 inbound-interface 'eth1'
set nat66 destination rule 10 destination address '2001:db8::1'
set nat66 destination rule 10 source address 'fc00::01'
set nat66 destination rule 10 source port !22
set nat66 destination rule 10 protocol tcp
set nat66 destination rule 10 exclude
The more firewall options there are, the easier it is to write a ruleset to match your needs. In August we added quite a few more.
It's now possible to match the proposed TCP MSS size in new TCP connections.
Example:
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 protocol 'tcp'
set firewall name FOO rule 10 tcp flags syn
set firewall name FOO rule 10 tcp mss '1-500'
For example:
set firewall name FOO rule 20 action 'accept'
set firewall name FOO rule 20 packet-length '1500'
We will cover it in a post of its own, but now we'll say — a GraphQL API for operational mode is here and already used in the web GUI prototype that is in progress!
If you missed the post about the new operational mode command implementation approach, make sure to read it! That's the part that makes a GraphQL API for the operational mode effortless and also makes new operational mode scripts much easier to write, since all command-line options and subcommands are automatically generated from function names and argument type annotations.
After T2719 was merged, many op-mode commands were rewritten in the new format. Among them:
show container
show container network
show container image
show vpn ipsec sa
show openconnect-server sessions
show nat66 <source|destination> rules
show <nat|nat66> translation
show conntrack statistics
However, we also added new commands for monitoring logs for different subsystems:
show monitor log vpn <all|ipsec|l2tp|pptp|sstp>
show vrf correctly handles unconfigured VRF names (T4562)show system cpu has been broken since July the 30th but now works again (T4581)restart dhcp relay-agent now correctly restarts the DHCP relay agent instead of the DHCP server (T4601).systemctl restart command that used a value from config instead converted to ttyUSBX and moved systemd units from /etc/ to /run/ (T4646).