From 3bc71de15887bfdae0c9ab6b11c09ce4076657bd Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Wed, 19 Aug 2026 16:11:26 -0700
Subject: [PATCH] fix(vyos): allow transit gateway health checks

---
 tests/test_policy.py       | 13 +++++++++++++
 vyos/gw01/config.boot.tmpl |  8 ++++++++
 2 files changed, 21 insertions(+)

diff --git a/tests/test_policy.py b/tests/test_policy.py
index e8f9231..1e58643 100644
--- a/tests/test_policy.py
+++ b/tests/test_policy.py
@@ -18,6 +18,19 @@ def test_tracked_template_satisfies_source_policy() -> None:
     validate_assets_present()
 
 
+def test_rtr01_gateway_health_probe_is_allowed() -> None:
+    from networking_vyos.render import load_template
+
+    assert """rule 5 {
+                action accept
+                description "Allow rtr01 gateway health checks"
+                protocol icmp
+                source {
+                    address 10.0.0.1
+                }
+            }""" in load_template()
+
+
 def test_invented_footer_is_rejected() -> None:
     with pytest.raises(ToolError, match="must not invent"):
         validate_template(VALID_TEMPLATE + '\n// vyos-config-version: "guessed@1"\n')
diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl
index 5de0684..f845cd0 100644
--- a/vyos/gw01/config.boot.tmpl
+++ b/vyos/gw01/config.boot.tmpl
@@ -451,6 +451,14 @@ firewall {
             default-action drop
             default-log
             description "Local services from transit"
+            rule 5 {
+                action accept
+                description "Allow rtr01 gateway health checks"
+                protocol icmp
+                source {
+                    address 10.0.0.1
+                }
+            }
             rule 10 {
                 action accept
                 description "Allow ICMP from home"