Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

VyOS 1.4 changed firewall rule 'recent time' to second/minute/hour from decimal (n seconds) #312

Closed
athiedeilluminate opened this issue Apr 11, 2023 · 1 comment · May be fixed by #313
Closed

VyOS 1.4 changed firewall rule 'recent time' to second/minute/hour from decimal (n seconds) #312

athiedeilluminate opened this issue Apr 11, 2023 · 1 comment · May be fixed by #313

Comments

@athiedeilluminate
Copy link

athiedeilluminate commented Apr 11, 2023 •
edited
Loading

SUMMARY

The 'recent time' command for firewall rules has changed from a decimal to a choice of 'second/minute/hour'.
Documentation link and link to line in code where it should be changed.

ISSUE TYPE
  • Bug Report
COMPONENT NAME

vyos.vyos.vyos_firewall_rules

ANSIBLE VERSION
ansible [core 2.14.4]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.10.6 (main, Mar 10 2023, 10:55:28) [GCC 11.3.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True
COLLECTION VERSION
# /usr/lib/python3/dist-packages/ansible_collections
Collection Version
---------- -------
vyos.vyos  4.0.1
CONFIGURATION
CONFIG_FILE() = /etc/ansible/ansible.cfg
OS / ENVIRONMENT

Ubuntu 22.04 running ansible to a vyos system running VyOS 1.4-rolling-202303170317 (current)

STEPS TO REPRODUCE

Run the following with vyos.vyos.vyos_config:

- name: Drop SSH if too many tries
  vyos.vyos.vyos_config:
    lines:
      - set firewall name EXTERNAL-LOCAL rule 30 action 'drop'
      - set firewall name EXTERNAL-LOCAL rule 30 destination port '22'
      - set firewall name EXTERNAL-LOCAL rule 30 protocol 'tcp'
      - set firewall name EXTERNAL-LOCAL rule 30 recent count '4'
      - set firewall name EXTERNAL-LOCAL rule 30 recent time minute
      - set firewall name EXTERNAL-LOCAL rule 30 state new 'enable

or attempt to add a rule with vyos.vyos.vyos_firewall_rule:

- name: Set EXTERNAL-LOCAL firewall rules
  vyos.vyos.vyos_firewall_rules:
    config:
    - afi: ipv4
      rule_sets:
      - name: EXTERNAL-LOCAL
        default_action: drop
        rules
        - number: 30
          description: deny SSH if too many times
          action: drop
          protocol: tcp
          destination:
            port: 22
          state:
            new: true
          recent:
            count: 4
            time: minute
EXPECTED RESULTS

Current version of vyos is able to use 'minute' as expected

ACTUAL RESULTS

I can't add a fireall rule with recent options
@athiedeilluminate athiedeilluminate mentioned this issue Apr 11, 2023
Open
@gaige
Copy link
Contributor

gaige commented Nov 16, 2024

Closing this as it was fixed in #352 ; time was fixed to str for 1.4+

@gaige gaige closed this as completed Nov 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

change firewall recent.time to string as per VyOS 1.4 athiedeilluminate/vyos.vyos
2 participants
@gaige @athiedeilluminate