Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VyOS 1.4 changed firewall rule 'recent time' to second/minute/hour from decimal (n seconds) #312

Open
athiedeilluminate opened this issue Apr 11, 2023 · 0 comments · May be fixed by #313
Open

Comments

@athiedeilluminate
Copy link

athiedeilluminate commented Apr 11, 2023

SUMMARY

The 'recent time' command for firewall rules has changed from a decimal to a choice of 'second/minute/hour'.
Documentation link and link to line in code where it should be changed.

ISSUE TYPE
  • Bug Report
COMPONENT NAME

vyos.vyos.vyos_firewall_rules

ANSIBLE VERSION
ansible [core 2.14.4]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.10.6 (main, Mar 10 2023, 10:55:28) [GCC 11.3.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True

COLLECTION VERSION
# /usr/lib/python3/dist-packages/ansible_collections
Collection Version
---------- -------
vyos.vyos  4.0.1  
CONFIGURATION
CONFIG_FILE() = /etc/ansible/ansible.cfg
OS / ENVIRONMENT

Ubuntu 22.04 running ansible to a vyos system running VyOS 1.4-rolling-202303170317 (current)

STEPS TO REPRODUCE

Run the following with vyos.vyos.vyos_config:

- name: Drop SSH if too many tries
  vyos.vyos.vyos_config:
    lines:
      - set firewall name EXTERNAL-LOCAL rule 30 action 'drop'
      - set firewall name EXTERNAL-LOCAL rule 30 destination port '22'
      - set firewall name EXTERNAL-LOCAL rule 30 protocol 'tcp'
      - set firewall name EXTERNAL-LOCAL rule 30 recent count '4'
      - set firewall name EXTERNAL-LOCAL rule 30 recent time minute
      - set firewall name EXTERNAL-LOCAL rule 30 state new 'enable

or attempt to add a rule with vyos.vyos.vyos_firewall_rule:

- name: Set EXTERNAL-LOCAL firewall rules
  vyos.vyos.vyos_firewall_rules:
    config:
    - afi: ipv4
      rule_sets:
      - name: EXTERNAL-LOCAL
        default_action: drop
        rules
        - number: 30
          description: deny SSH if too many times
          action: drop
          protocol: tcp
          destination:
            port: 22
          state:
            new: true
          recent:
            count: 4
            time: minute
EXPECTED RESULTS

Current version of vyos is able to use 'minute' as expected

ACTUAL RESULTS

I can't add a fireall rule with recent options

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant