Merge branch 'vyos:current' into current

117 files changed, 2303 insertions, 280 deletions

diff --git a/src/op_mode/accelppp.py b/src/op_mode/accelppp.py
index 67ce786d0..6f6fd4858 100755
--- a/src/op_mode/accelppp.py
+++ b/src/op_mode/accelppp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/bgp.py b/src/op_mode/bgp.py
index 096113cb4..011f39c1b 100755
--- a/src/op_mode/bgp.py
+++ b/src/op_mode/bgp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/bonding.py b/src/op_mode/bonding.py
index 07bccbd4b..0ceb65cff 100755
--- a/src/op_mode/bonding.py
+++ b/src/op_mode/bonding.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2016-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/bridge.py b/src/op_mode/bridge.py
index c4293a77c..2db462db8 100755
--- a/src/op_mode/bridge.py
+++ b/src/op_mode/bridge.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/cgnat.py b/src/op_mode/cgnat.py
index 9ad8f92f9..d53f6158b 100755
--- a/src/op_mode/cgnat.py
+++ b/src/op_mode/cgnat.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/clear_conntrack.py b/src/op_mode/clear_conntrack.py
index fec7cf144..2a4f19607 100755
--- a/src/op_mode/clear_conntrack.py
+++ b/src/op_mode/clear_conntrack.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/config_mgmt.py b/src/op_mode/config_mgmt.py
index 66de26d1f..fa2abec0e 100755
--- a/src/op_mode/config_mgmt.py
+++ b/src/op_mode/config_mgmt.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/connect_disconnect.py b/src/op_mode/connect_disconnect.py
index 8903f916a..117e65713 100755
--- a/src/op_mode/connect_disconnect.py
+++ b/src/op_mode/connect_disconnect.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,6 +18,7 @@ import os
 import argparse
 
 from psutil import process_iter
+from time import sleep
 
 from vyos.configquery import ConfigTreeQuery
 from vyos.utils.process import call
@@ -68,7 +69,7 @@ def connect(interface):
             if ( count % 60 == 0 ):
                 print(f'Commit still in progress after {count}s - waiting')
             count += 1
-            time.sleep(1)
+            sleep(1)
         call('/usr/libexec/vyos/conf_mode/qos.py')
 
 def disconnect(interface):
diff --git a/src/op_mode/conntrack.py b/src/op_mode/conntrack.py
index c379c3e60..ee1ae6174 100755
--- a/src/op_mode/conntrack.py
+++ b/src/op_mode/conntrack.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/conntrack_sync.py b/src/op_mode/conntrack_sync.py
index f3b09b452..0da5b3b0b 100755
--- a/src/op_mode/conntrack_sync.py
+++ b/src/op_mode/conntrack_sync.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/container.py b/src/op_mode/container.py
index 05f65df1f..2dc7ce4ec 100755
--- a/src/op_mode/container.py
+++ b/src/op_mode/container.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,8 +14,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import typing
 import json
 import sys
+import subprocess
 
 from vyos.utils.process import cmd
 from vyos.utils.process import rc_cmd
@@ -55,13 +57,14 @@ def add_image(name: str):
                     if rc != 0: raise vyos.opmode.InternalError(out)
 
     rc, output = rc_cmd(f'podman image pull {name}')
+    print(output)
     if rc != 0:
         raise vyos.opmode.InternalError(output)
 
     if do_logout:
         rc_cmd('podman logout --all')
 
-def delete_image(name: str):
+def delete_image(name: str, force: typing.Optional[bool] = False):
     from vyos.utils.process import rc_cmd
 
     if name == 'all':
@@ -71,9 +74,33 @@ def delete_image(name: str):
         if not name: return
         # replace newline with whitespace
         name = name.replace('\n', ' ')
-    rc, output = rc_cmd(f'podman image rm {name}')
-    if rc != 0:
-        raise vyos.opmode.InternalError(output)
+        # convert to list
+        name = name.split()
+    else:
+        # convert str -> list for further processing down the line
+        name = [name]
+
+    for image in name:
+        # convert the truncated image ID to a full image ID
+        rc, ancestor = rc_cmd(f'podman inspect {image} --format "{{{{.Id}}}}"')
+        if rc != 0:
+            raise vyos.opmode.InternalError(ancestor)
+        # check if the image ID is an ancestor of any running container
+        rc, in_use = rc_cmd(f'podman ps --filter ancestor={ancestor} -q')
+        if rc != 0:
+            raise vyos.opmode.InternalError(in_use)
+
+        if bool(in_use):
+            error = f'Cannot delete image "{image}" because it is currently '\
+                    f'being used by container "{in_use}"!'
+            raise vyos.opmode.InternalError(error)
+
+        tmp = f'podman image rm {image}'
+        if force: tmp += ' --force'
+
+        rc, output = rc_cmd(tmp)
+        if rc != 0:
+            raise vyos.opmode.InternalError(output)
 
 def show_container(raw: bool):
     command = 'podman ps --all'
@@ -109,6 +136,47 @@ def restart(name: str):
     print(f'Container "{name}" restarted!')
     return output
 
+def show_log(name: str, follow: bool = False, raw: bool = False):
+    """
+    Show or monitor logs for a specific container.
+    Use --follow to continuously stream logs.
+    """
+    from vyos.configquery import ConfigTreeQuery
+    conf = ConfigTreeQuery()
+    container = conf.get_config_dict(['container', 'name', name],  get_first_key=True, with_recursive_defaults=True)
+    log_type = container.get('log-driver')
+    if log_type == 'k8s-file':
+        if follow:
+            log_command_list = ['sudo', 'podman', 'logs', '--follow', '--names', name]
+        else:
+            log_command_list = ['sudo', 'podman', 'logs', '--names', name]
+    elif log_type == 'journald':
+        if follow:
+            log_command_list = ['journalctl', '--follow', '--unit', f'vyos-container-{name}.service']
+        else:
+            log_command_list = ['journalctl', '-e', '--no-pager', '--unit', f'vyos-container-{name}.service']
+    elif log_type == 'none':
+        print(f'Container "{name}" has disabled logs.')
+        return None
+    else:
+        raise vyos.opmode.InternalError(f'Unknown log type "{log_type}" for container "{name}".')
+
+    process = None
+    try:
+        process = subprocess.Popen(log_command_list,
+                                   stdout=sys.stdout,
+                                   stderr=sys.stderr)
+        process.wait()
+    except KeyboardInterrupt:
+        if process:
+            process.terminate()
+            process.wait()
+        return None
+    except Exception as e:
+        raise vyos.opmode.InternalError(f"Error starting logging command: {e} ")
+    return None
+
+
 if __name__ == '__main__':
     try:
         res = vyos.opmode.run(sys.modules[__name__])
diff --git a/src/op_mode/cpu.py b/src/op_mode/cpu.py
index 1a0f7392f..a8db16dfc 100755
--- a/src/op_mode/cpu.py
+++ b/src/op_mode/cpu.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2016-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/dhcp.py b/src/op_mode/dhcp.py
index 636d083e4..1cbbbe2e6 100755
--- a/src/op_mode/dhcp.py
+++ b/src/op_mode/dhcp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,6 +19,7 @@ import sys
 import typing
 
 from datetime import datetime
+from datetime import timezone
 from glob import glob
 from ipaddress import ip_address
 from tabulate import tabulate
@@ -81,19 +82,13 @@ ArgState = typing.Literal[
 ArgOrigin = typing.Literal['local', 'remote']
 
 
-def _utc_to_local(utc_dt):
-    return datetime.fromtimestamp(
-        (datetime.fromtimestamp(utc_dt) - datetime(1970, 1, 1)).total_seconds()
-    )
-
-
 def _get_raw_server_leases(
-    config, family='inet', pool=None, sorted=None, state=[], origin=None
+    config, family='inet', vrf='', pool=None, sorted=None, state=[], origin=None
 ) -> list:
     inet_suffix = '6' if family == 'inet6' else '4'
     pools = [pool] if pool else kea_get_dhcp_pools(config, inet_suffix)
 
-    mappings = kea_get_server_leases(config, inet_suffix, pools, state, origin)
+    mappings = kea_get_server_leases(config, inet_suffix, vrf, pools, state, origin)
 
     if sorted:
         if sorted == 'ip':
@@ -110,10 +105,12 @@ def _get_formatted_server_leases(raw_data, family='inet'):
             ipaddr = lease.get('ip')
             hw_addr = lease.get('mac')
             state = lease.get('state')
-            start = lease.get('start')
-            start = _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
-            end = lease.get('end')
-            end = _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S') if end else '-'
+            start = datetime.fromtimestamp(lease.get('start'), timezone.utc)
+            end = (
+                datetime.fromtimestamp(lease.get('end'), timezone.utc)
+                if lease.get('end')
+                else '-'
+            )
             remain = lease.get('remaining')
             pool = lease.get('pool')
             hostname = lease.get('hostname')
@@ -139,10 +136,14 @@ def _get_formatted_server_leases(raw_data, family='inet'):
             ipaddr = lease.get('ip')
             hw_addr = lease.get('mac')
             state = lease.get('state')
-            start = lease.get('last_communication')
-            start = _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
-            end = lease.get('end')
-            end = _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
+            start = datetime.fromtimestamp(
+                lease.get('last_communication'), timezone.utc
+            )
+            end = (
+                datetime.fromtimestamp(lease.get('end'), timezone.utc)
+                if lease.get('end')
+                else '-'
+            )
             remain = lease.get('remaining')
             lease_type = lease.get('type')
             pool = lease.get('pool')
@@ -167,9 +168,13 @@ def _get_formatted_server_leases(raw_data, family='inet'):
     return output
 
 
-def _get_pool_size(pool, family='inet'):
+def _get_pool_size(pool, family='inet', vrf=''):
     v = 'v6' if family == 'inet6' else ''
-    base = f'service dhcp{v}-server shared-network-name {pool}'
+    # if vrf is set get the correct base for config
+    if vrf:
+        base = f'vrf name {vrf} service dhcp{v}-server shared-network-name {pool}'
+    else:
+        base = f'service dhcp{v}-server shared-network-name {pool}'
     size = 0
     subnets = config.list_nodes(f'{base} subnet')
     for subnet in subnets:
@@ -186,14 +191,14 @@ def _get_pool_size(pool, family='inet'):
     return size
 
 
-def _get_raw_server_pool_statistics(config, family='inet', pool=None):
+def _get_raw_server_pool_statistics(config, family='inet', vrf='', pool=None):
     inet_suffix = '6' if family == 'inet6' else '4'
     pools = [pool] if pool else kea_get_dhcp_pools(config, inet_suffix)
 
     stats = []
     for p in pools:
-        size = _get_pool_size(family=family, pool=p)
-        leases = len(_get_raw_server_leases(config, family=family, pool=p))
+        size = _get_pool_size(family=family, vrf=vrf, pool=p)
+        leases = len(_get_raw_server_leases(config, family=family, vrf=vrf, pool=p))
         use_percentage = round(leases / size * 100) if size != 0 else 0
         pool_stats = {
             'pool': p,
@@ -206,7 +211,7 @@ def _get_raw_server_pool_statistics(config, family='inet', pool=None):
     return stats
 
 
-def _get_formatted_server_pool_statistics(pool_data, family='inet'):
+def _get_formatted_server_pool_statistics(pool_data):
     data_entries = []
     for entry in pool_data:
         pool = entry.get('pool')
@@ -236,7 +241,7 @@ def _get_raw_server_static_mappings(config, family='inet', pool=None, sorted=Non
     return mappings
 
 
-def _get_formatted_server_static_mappings(raw_data, family='inet'):
+def _get_formatted_server_static_mappings(raw_data):
     data_entries = []
 
     for entry in raw_data:
@@ -246,10 +251,8 @@ def _get_formatted_server_static_mappings(raw_data, family='inet'):
         ip_addr = entry.get('ip', 'N/A')
         mac_addr = entry.get('mac', 'N/A')
         duid = entry.get('duid', 'N/A')
-        description = entry.get('description', 'N/A')
-        data_entries.append(
-            [pool, subnet, hostname, ip_addr, mac_addr, duid, description]
-        )
+        desc = entry.get('description', 'N/A')
+        data_entries.append([pool, subnet, hostname, ip_addr, mac_addr, duid, desc])
 
     headers = [
         'Pool',
@@ -272,11 +275,20 @@ def _verify_server(func):
     def _wrapper(*args, **kwargs):
         config = ConfigTreeQuery()
         family = kwargs.get('family')
+        vrf = kwargs.get('vrf')
         v = 'v6' if family == 'inet6' else ''
-        unconf_message = f'DHCP{v} server is not configured'
+
         # Check if config does not exist
-        if not config.exists(f'service dhcp{v}-server'):
-            raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        if vrf:
+            unconf_message = f'DHCP{v} server is not configured for VRF {vrf}'
+            if not config.exists(f'vrf name {vrf} service dhcp{v}-server'):
+                raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        else:
+            unconf_message = f'DHCP{v} server is not configured'
+            if not config.exists(f'service dhcp{v}-server'):
+                raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+
+        # return
         return func(*args, **kwargs)
 
     return _wrapper
@@ -306,35 +318,53 @@ def _verify_client(func):
 
 @_verify_server
 def show_server_pool_statistics(
-    raw: bool, family: ArgFamily, pool: typing.Optional[str]
+    raw: bool, family: ArgFamily, vrf: str, pool: typing.Optional[str]
 ):
     v = 'v6' if family == 'inet6' else ''
     inet_suffix = '6' if family == 'inet6' else '4'
 
-    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+    if vrf:
+        service = f'kea-dhcp{inet_suffix}-server@{vrf}.service'
+    else:
+        service = f'kea-dhcp{inet_suffix}-server.service'
+
+    if not is_systemd_service_running(service):
         Warning(stale_warn_msg)
 
     try:
-        active_config = kea_get_active_config(inet_suffix)
+        active_config = kea_get_active_config(inet_suffix, vrf)
     except Exception:
-        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
+        if vrf:
+            raise vyos.opmode.DataUnavailable(
+                f'Cannot fetch DHCP server configuration for VRF {vrf}'
+            )
+        else:
+            raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
 
     active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
 
     if pool and active_pools and pool not in active_pools:
-        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
+        if vrf:
+            raise vyos.opmode.IncorrectValue(
+                f'DHCP{v} pool "{pool}" does not exist for VRF {vrf}!'
+            )
+        else:
+            raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
 
-    pool_data = _get_raw_server_pool_statistics(active_config, family=family, pool=pool)
+    pool_data = _get_raw_server_pool_statistics(
+        active_config, family=family, vrf=vrf, pool=pool
+    )
     if raw:
         return pool_data
     else:
-        return _get_formatted_server_pool_statistics(pool_data, family=family)
+        return _get_formatted_server_pool_statistics(pool_data)
 
 
 @_verify_server
 def show_server_leases(
     raw: bool,
     family: ArgFamily,
+    vrf: str,
     pool: typing.Optional[str],
     sorted: typing.Optional[str],
     state: typing.Optional[ArgState],
@@ -343,18 +373,33 @@ def show_server_leases(
     v = 'v6' if family == 'inet6' else ''
     inet_suffix = '6' if family == 'inet6' else '4'
 
-    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+    if vrf:
+        service = f'kea-dhcp{inet_suffix}-server@{vrf}.service'
+    else:
+        service = f'kea-dhcp{inet_suffix}-server.service'
+
+    if not is_systemd_service_running(service):
         Warning(stale_warn_msg)
 
     try:
-        active_config = kea_get_active_config(inet_suffix)
+        active_config = kea_get_active_config(inet_suffix, vrf)
     except Exception:
-        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
+        if vrf:
+            raise vyos.opmode.DataUnavailable(
+                f'Cannot fetch DHCP server configuration for VRF {vrf}'
+            )
+        else:
+            raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
 
     active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
 
     if pool and active_pools and pool not in active_pools:
-        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
+        if vrf:
+            raise vyos.opmode.IncorrectValue(
+                f'DHCP{v} pool "{pool}" does not exist for VRF {vrf}!'
+            )
+        else:
+            raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
 
     sort_valid = sort_valid_inet6 if family == 'inet6' else sort_valid_inet
     if sorted and sorted not in sort_valid:
@@ -366,6 +411,7 @@ def show_server_leases(
     lease_data = _get_raw_server_leases(
         config=active_config,
         family=family,
+        vrf=vrf,
         pool=pool,
         sorted=sorted,
         state=state,
@@ -381,24 +427,40 @@ def show_server_leases(
 def show_server_static_mappings(
     raw: bool,
     family: ArgFamily,
+    vrf: str,
     pool: typing.Optional[str],
     sorted: typing.Optional[str],
 ):
     v = 'v6' if family == 'inet6' else ''
     inet_suffix = '6' if family == 'inet6' else '4'
 
-    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+    if vrf:
+        service = f'kea-dhcp{inet_suffix}-server@{vrf}.service'
+    else:
+        service = f'kea-dhcp{inet_suffix}-server.service'
+
+    if not is_systemd_service_running(service):
         Warning(stale_warn_msg)
 
     try:
-        active_config = kea_get_active_config(inet_suffix)
+        active_config = kea_get_active_config(inet_suffix, vrf)
     except Exception:
-        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
+        if vrf:
+            raise vyos.opmode.DataUnavailable(
+                f'Cannot fetch DHCP server configuration for VRF {vrf}'
+            )
+        else:
+            raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
 
     active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
 
     if pool and active_pools and pool not in active_pools:
-        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
+        if vrf:
+            raise vyos.opmode.IncorrectValue(
+                f'DHCP{v} pool "{pool}" does not exist for VRF {vrf}!'
+            )
+        else:
+            raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
 
     if sorted and sorted not in mapping_sort_valid:
         raise vyos.opmode.IncorrectValue(f'DHCP{v} sort "{sorted}" is invalid!')
@@ -409,24 +471,24 @@ def show_server_static_mappings(
     if raw:
         return static_mappings
     else:
-        return _get_formatted_server_static_mappings(static_mappings, family=family)
+        return _get_formatted_server_static_mappings(static_mappings)
 
 
-def _lease_valid(inet, address):
-    leases = kea_get_leases(inet)
+def _lease_valid(inet, vrf, address):
+    leases = kea_get_leases(inet, vrf)
     return any(lease['ip-address'] == address for lease in leases)
 
 
 @_verify_server
-def clear_dhcp_server_lease(family: ArgFamily, address: str):
+def clear_dhcp_server_lease(family: ArgFamily, vrf: str, address: str):
     v = 'v6' if family == 'inet6' else ''
     inet = '6' if family == 'inet6' else '4'
 
-    if not _lease_valid(inet, address):
+    if not _lease_valid(inet, vrf, address):
         print(f'Lease not found on DHCP{v} server')
         return None
 
-    if not kea_delete_lease(inet, address):
+    if not kea_delete_lease(inet, vrf, address):
         print(f'Failed to clear lease for "{address}"')
         return None
 
@@ -483,7 +545,7 @@ def _get_raw_client_leases(family='inet', interface=None):
     return lease_data
 
 
-def _get_formatted_client_leases(lease_data, family):
+def _get_formatted_client_leases(lease_data):
     from time import localtime
     from time import strftime
 
@@ -535,7 +597,7 @@ def show_client_leases(raw: bool, family: ArgFamily, interface: typing.Optional[
     if raw:
         return lease_data
     else:
-        return _get_formatted_client_leases(lease_data, family=family)
+        return _get_formatted_client_leases(lease_data)
 
 
 @_verify_client
diff --git a/src/op_mode/dns.py b/src/op_mode/dns.py
index 16c462f23..7c9f769f1 100755
--- a/src/op_mode/dns.py
+++ b/src/op_mode/dns.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/evpn.py b/src/op_mode/evpn.py
index cae4ab9f5..a6dee0b34 100644
--- a/src/op_mode/evpn.py
+++ b/src/op_mode/evpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2016-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/execute_bandwidth_test.sh b/src/op_mode/execute_bandwidth_test.sh
index a6ad0b42c..a7c7484d2 100755
--- a/src/op_mode/execute_bandwidth_test.sh
+++ b/src/op_mode/execute_bandwidth_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/execute_port-scan.py b/src/op_mode/execute_port-scan.py
index bf17d0379..47cd2f7c4 100644
--- a/src/op_mode/execute_port-scan.py
+++ b/src/op_mode/execute_port-scan.py
@@ -1,6 +1,6 @@
 #! /usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/file.py b/src/op_mode/file.py
index bf13bed6f..a0efdb5cb 100755
--- a/src/op_mode/file.py
+++ b/src/op_mode/file.py
@@ -1,6 +1,6 @@
 #!/usr/bin/python3
 
-# Copyright 2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/firewall.py b/src/op_mode/firewall.py
index c197ca434..6e9f8a01b 100755
--- a/src/op_mode/firewall.py
+++ b/src/op_mode/firewall.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,6 +18,7 @@ import argparse
 import ipaddress
 import json
 import re
+from signal import signal, SIGPIPE, SIG_DFL
 import tabulate
 import textwrap
 
@@ -25,6 +26,9 @@ from vyos.config import Config
 from vyos.utils.process import cmd
 from vyos.utils.dict import dict_search_args
 
+signal(SIGPIPE, SIG_DFL)
+
+
 def get_config_node(conf, node=None, family=None, hook=None, priority=None):
     if node == 'nat':
         if family == 'ipv6':
@@ -148,6 +152,38 @@ def get_nftables_group_members(family, table, name):
 
     return out
 
+def get_nftables_remote_group_members(family, table, name):
+    prefix = 'ip6' if family == 'ipv6' else 'ip'
+    out = []
+
+    try:
+        results_str = cmd(f'nft -j list set {prefix} {table} {name}')
+        results = json.loads(results_str)
+    except:
+        return out
+
+    if 'nftables' not in results:
+        return out
+
+    for obj in results['nftables']:
+        if 'set' not in obj:
+            continue
+
+        set_obj = obj['set']
+        if 'elem' in set_obj:
+            for elem in set_obj['elem']:
+                # search for single IP elements
+                if isinstance(elem, str):
+                    out.append(elem)
+                # search for prefix elements
+                elif isinstance(elem, dict) and 'prefix' in elem:
+                    out.append(f"{elem['prefix']['addr']}/{elem['prefix']['len']}")
+                # search for IP range elements
+                elif isinstance(elem, dict) and 'range' in elem:
+                    out.append(f"{elem['range'][0]}-{elem['range'][1]}")
+
+    return out
+
 def output_firewall_vertical(rules, headers, adjust=True):
     for rule in rules:
         adjusted_rule = rule + [""] * (len(headers) - len(rule)) if adjust else rule # account for different header length, like default-action
@@ -253,15 +289,17 @@ def output_firewall_name_statistics(family, hook, prior, prior_conf, single_rule
                     if not source_addr:
                         source_addr = dict_search_args(rule_conf, 'source', 'group', 'domain_group')
                         if not source_addr:
-                            source_addr = dict_search_args(rule_conf, 'source', 'fqdn')
+                            source_addr = dict_search_args(rule_conf, 'source', 'group', 'remote_group')
                             if not source_addr:
-                                source_addr = dict_search_args(rule_conf, 'source', 'geoip', 'country_code')
-                                if source_addr:
-                                    source_addr = str(source_addr)[1:-1].replace('\'','')
-                                    if 'inverse_match' in dict_search_args(rule_conf, 'source', 'geoip'):
-                                        source_addr = 'NOT ' + str(source_addr)
+                                source_addr = dict_search_args(rule_conf, 'source', 'fqdn')
                                 if not source_addr:
-                                    source_addr = 'any'
+                                    source_addr = dict_search_args(rule_conf, 'source', 'geoip', 'country_code')
+                                    if source_addr:
+                                        source_addr = str(source_addr)[1:-1].replace('\'','')
+                                        if 'inverse_match' in dict_search_args(rule_conf, 'source', 'geoip'):
+                                            source_addr = 'NOT ' + str(source_addr)
+                                    if not source_addr:
+                                        source_addr = 'any'
 
             # Get destination
             dest_addr = dict_search_args(rule_conf, 'destination', 'address')
@@ -272,15 +310,17 @@ def output_firewall_name_statistics(family, hook, prior, prior_conf, single_rule
                     if not dest_addr:
                         dest_addr = dict_search_args(rule_conf, 'destination', 'group', 'domain_group')
                         if not dest_addr:
-                            dest_addr = dict_search_args(rule_conf, 'destination', 'fqdn')
+                            dest_addr = dict_search_args(rule_conf, 'destination', 'group', 'remote_group')
                             if not dest_addr:
-                                dest_addr = dict_search_args(rule_conf, 'destination', 'geoip', 'country_code')
-                                if dest_addr:
-                                    dest_addr = str(dest_addr)[1:-1].replace('\'','')
-                                    if 'inverse_match' in dict_search_args(rule_conf, 'destination', 'geoip'):
-                                        dest_addr = 'NOT ' + str(dest_addr)
+                                dest_addr = dict_search_args(rule_conf, 'destination', 'fqdn')
                                 if not dest_addr:
-                                    dest_addr = 'any'
+                                    dest_addr = dict_search_args(rule_conf, 'destination', 'geoip', 'country_code')
+                                    if dest_addr:
+                                        dest_addr = str(dest_addr)[1:-1].replace('\'','')
+                                        if 'inverse_match' in dict_search_args(rule_conf, 'destination', 'geoip'):
+                                            dest_addr = 'NOT ' + str(dest_addr)
+                                    if not dest_addr:
+                                        dest_addr = 'any'
 
             # Get inbound interface
             iiface = dict_search_args(rule_conf, 'inbound_interface', 'name')
@@ -552,30 +592,8 @@ def show_firewall_group(name=None):
     header_tail = []
 
     for group_type, group_type_conf in firewall['group'].items():
-        ##
-        if group_type != 'dynamic_group':
-
-            for group_name, group_conf in group_type_conf.items():
-                if name and name != group_name:
-                    continue
-
-                references = find_references(group_type, group_name)
-                row = [group_name,  textwrap.fill(group_conf.get('description') or '', 50), group_type, '\n'.join(references) or 'N/D']
-                if 'address' in group_conf:
-                    row.append("\n".join(sorted(group_conf['address'])))
-                elif 'network' in group_conf:
-                    row.append("\n".join(sorted(group_conf['network'], key=ipaddress.ip_network)))
-                elif 'mac_address' in group_conf:
-                    row.append("\n".join(sorted(group_conf['mac_address'])))
-                elif 'port' in group_conf:
-                    row.append("\n".join(sorted(group_conf['port'])))
-                elif 'interface' in group_conf:
-                    row.append("\n".join(sorted(group_conf['interface'])))
-                else:
-                    row.append('N/D')
-                rows.append(row)
-
-        else:
+        # interate over dynamic-groups
+        if group_type == 'dynamic_group':
             if not args.detail:
                 header_tail = ['Timeout', 'Expires']
 
@@ -584,6 +602,9 @@ def show_firewall_group(name=None):
                 prefix = 'DA_' if dynamic_type == 'address_group' else 'DA6_'
                 if dynamic_type in firewall['group']['dynamic_group']:
                     for dynamic_name, dynamic_conf in firewall['group']['dynamic_group'][dynamic_type].items():
+                        if name and name != dynamic_name:
+                            continue
+
                         references = find_references(dynamic_type, dynamic_name)
                         row = [dynamic_name, textwrap.fill(dynamic_conf.get('description') or '', 50), dynamic_type + '(dynamic)', '\n'.join(references) or 'N/D']
 
@@ -622,6 +643,68 @@ def show_firewall_group(name=None):
                             header_tail += [""] * (len(members) - 1)
                             rows.append(row)
 
+        # iterate over remote-groups
+        elif group_type == 'remote_group':
+            for remote_name, remote_conf in group_type_conf.items():
+                if name and name != remote_name:
+                    continue
+
+                references = find_references(group_type, remote_name)
+                row = [remote_name, textwrap.fill(remote_conf.get('description') or '', 50), group_type, '\n'.join(references) or 'N/D']
+                members = get_nftables_remote_group_members("ipv4", 'vyos_filter', f'R_{remote_name}')
+                members6 = get_nftables_remote_group_members("ipv6", 'vyos_filter', f'R6_{remote_name}')
+
+                if 'url' in remote_conf:
+                    # display only the url if no members are found for both views
+                    if not members and not members6:
+                        if args.detail:
+                            header_tail = ['IPv6 Members', 'Remote URL']
+                            row.append('N/D')
+                            row.append('N/D')
+                            row.append(remote_conf['url'])
+                        else:
+                            row.append(remote_conf['url'])
+                        rows.append(row)
+                    else:
+                        # display all table elements in detail view
+                        if args.detail:
+                            header_tail = ['IPv6 Members', 'Remote URL']
+                            if members:
+                                row.append(' '.join(members))
+                            else:
+                                row.append('N/D')
+                            if members6:
+                                row.append(' '.join(members6))
+                            else:
+                                row.append('N/D')
+                            row.append(remote_conf['url'])
+                            rows.append(row)
+                        else:
+                            row.append(remote_conf['url'])
+                            rows.append(row)
+
+        # catch the rest of the group types
+        else:
+            for group_name, group_conf in group_type_conf.items():
+                if name and name != group_name:
+                    continue
+
+                references = find_references(group_type, group_name)
+                row = [group_name,  textwrap.fill(group_conf.get('description') or '', 50), group_type, '\n'.join(references) or 'N/D']
+                if 'address' in group_conf:
+                    row.append("\n".join(sorted(group_conf['address'])))
+                elif 'network' in group_conf:
+                    row.append("\n".join(sorted(group_conf['network'], key=ipaddress.ip_network)))
+                elif 'mac_address' in group_conf:
+                    row.append("\n".join(sorted(group_conf['mac_address'])))
+                elif 'port' in group_conf:
+                    row.append("\n".join(sorted(group_conf['port'])))
+                elif 'interface' in group_conf:
+                    row.append("\n".join(sorted(group_conf['interface'])))
+                else:
+                    row.append('N/D')
+                rows.append(row)
+
     if rows:
         print('Firewall Groups\n')
         if args.detail:
diff --git a/src/op_mode/flow_accounting_op.py b/src/op_mode/flow_accounting_op.py
index 497ccafdf..f8aabc1ee 100755
--- a/src/op_mode/flow_accounting_op.py
+++ b/src/op_mode/flow_accounting_op.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/force_mtu_host.sh b/src/op_mode/force_mtu_host.sh
index c72fc243f..e3e24b57b 100755
--- a/src/op_mode/force_mtu_host.sh
+++ b/src/op_mode/force_mtu_host.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
diff --git a/src/op_mode/force_root-partition-auto-resize.sh b/src/op_mode/force_root-partition-auto-resize.sh
index b39e87560..e17f63a88 100755
--- a/src/op_mode/force_root-partition-auto-resize.sh
+++ b/src/op_mode/force_root-partition-auto-resize.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
diff --git a/src/op_mode/format_disk.py b/src/op_mode/format_disk.py
index dc3c96322..052c89105 100755
--- a/src/op_mode/format_disk.py
+++ b/src/op_mode/format_disk.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_interfaces_debug_archive.py b/src/op_mode/generate_interfaces_debug_archive.py
index 3059aad23..60b3ed691 100755
--- a/src/op_mode/generate_interfaces_debug_archive.py
+++ b/src/op_mode/generate_interfaces_debug_archive.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_ipsec_debug_archive.py b/src/op_mode/generate_ipsec_debug_archive.py
index ca2eeb511..de0f25bfd 100755
--- a/src/op_mode/generate_ipsec_debug_archive.py
+++ b/src/op_mode/generate_ipsec_debug_archive.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_openconnect_otp_key.py b/src/op_mode/generate_openconnect_otp_key.py
index 99b67d261..5cb1c6edf 100755
--- a/src/op_mode/generate_openconnect_otp_key.py
+++ b/src/op_mode/generate_openconnect_otp_key.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_ovpn_client_file.py b/src/op_mode/generate_ovpn_client_file.py
index 1d2f1067a..86d94b191 100755
--- a/src/op_mode/generate_ovpn_client_file.py
+++ b/src/op_mode/generate_ovpn_client_file.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_psk.py b/src/op_mode/generate_psk.py
index d51293712..816150dbf 100644
--- a/src/op_mode/generate_psk.py
+++ b/src/op_mode/generate_psk.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_public_key_command.py b/src/op_mode/generate_public_key_command.py
index 8ba55c901..1c1246742 100755
--- a/src/op_mode/generate_public_key_command.py
+++ b/src/op_mode/generate_public_key_command.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_service_rule-resequence.py b/src/op_mode/generate_service_rule-resequence.py
index 9333d6353..fd6354110 100755
--- a/src/op_mode/generate_service_rule-resequence.py
+++ b/src/op_mode/generate_service_rule-resequence.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_ssh_server_key.py b/src/op_mode/generate_ssh_server_key.py
index d6063c43c..459157afd 100755
--- a/src/op_mode/generate_ssh_server_key.py
+++ b/src/op_mode/generate_ssh_server_key.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -15,6 +15,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from sys import exit
+
+from vyos.defaults import directories
 from vyos.utils.io import ask_yes_no
 from vyos.utils.process import cmd
 from vyos.utils.commit import commit_in_progress
@@ -26,6 +28,8 @@ if commit_in_progress():
     print('Cannot restart SSH while a commit is in progress')
     exit(1)
 
+conf_mode_dir = directories['conf_mode']
+
 cmd('rm -v /etc/ssh/ssh_host_*')
 cmd('dpkg-reconfigure openssh-server')
-cmd('systemctl restart ssh.service')
+cmd(f'{conf_mode_dir}/service_ssh.py')
diff --git a/src/op_mode/generate_system_login_user.py b/src/op_mode/generate_system_login_user.py
index 1b328eae0..c0cb69708 100755
--- a/src/op_mode/generate_system_login_user.py
+++ b/src/op_mode/generate_system_login_user.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/generate_tech-support_archive.py b/src/op_mode/generate_tech-support_archive.py
index 41b53cd15..1d3f26d39 100755
--- a/src/op_mode/generate_tech-support_archive.py
+++ b/src/op_mode/generate_tech-support_archive.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/igmp-proxy.py b/src/op_mode/igmp-proxy.py
index 709e25915..d197e11f6 100755
--- a/src/op_mode/igmp-proxy.py
+++ b/src/op_mode/igmp-proxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ikev2_profile_generator.py b/src/op_mode/ikev2_profile_generator.py
index cf2bc6d5c..0db9ef545 100755
--- a/src/op_mode/ikev2_profile_generator.py
+++ b/src/op_mode/ikev2_profile_generator.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/image_info.py b/src/op_mode/image_info.py
index 56aefcd6e..119960a6f 100755
--- a/src/op_mode/image_info.py
+++ b/src/op_mode/image_info.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This file is part of VyOS.
 #
@@ -72,6 +72,14 @@ def _format_show_images_details(
 
     return tabulated
 
+def show_images_current(raw: bool) -> Union[image.BootDetails, str]:
+
+    images_summary = show_images_summary(raw=True)
+    if raw:
+        return {'image_running' : images_summary['image_running']}
+    else:
+        return images_summary['image_running']
+
 
 def show_images_summary(raw: bool) -> Union[image.BootDetails, str]:
     images_available: list[str] = grub.version_list()
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py
index 1da112673..e42d5b856 100755
--- a/src/op_mode/image_installer.py
+++ b/src/op_mode/image_installer.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This file is part of VyOS.
 #
@@ -19,12 +19,15 @@
 
 from argparse import ArgumentParser, Namespace
 from pathlib import Path
-from shutil import copy, chown, rmtree, copytree
+from shutil import copy, chown, rmtree, copytree, disk_usage
 from glob import glob
 from sys import exit
 from os import environ
 from os import readlink
-from os import getpid, getppid
+from os import getpid
+from os import getppid
+from json import loads
+from json import dumps
 from typing import Union
 from urllib.parse import urlparse
 from passlib.hosts import linux_context
@@ -32,21 +35,43 @@ from errno import ENOSPC
 
 from psutil import disk_partitions
 
+from vyos.base import Warning
 from vyos.configtree import ConfigTree
 from vyos.remote import download
-from vyos.system import disk, grub, image, compat, raid, SYSTEM_CFG_VER
+from vyos.system import disk
+from vyos.system import grub
+from vyos.system import image
+from vyos.system import compat
+from vyos.system import raid
+from vyos.system import SYSTEM_CFG_VER
+from vyos.system import grub_util
 from vyos.template import render
+from vyos.utils.auth import (
+    DEFAULT_PASSWORD,
+    EPasswdStrength,
+    evaluate_strength
+)
+from vyos.utils.dict import dict_search
 from vyos.utils.io import ask_input, ask_yes_no, select_entry
 from vyos.utils.file import chmod_2775
+from vyos.utils.file import read_file
+from vyos.utils.file import write_file
 from vyos.utils.process import cmd, run, rc_cmd
 from vyos.version import get_version_data
 
 # define text messages
 MSG_ERR_NOT_LIVE: str = 'The system is already installed. Please use "add system image" instead.'
 MSG_ERR_LIVE: str = 'The system is in live-boot mode. Please use "install image" instead.'
+MSG_ERR_NOT_ENOUGH_SPACE: str = 'Image upgrade requires at least 2GB of free drive space.'
 MSG_ERR_NO_DISK: str = 'No suitable disk was found. There must be at least one disk of 2GB or greater size.'
 MSG_ERR_IMPROPER_IMAGE: str = 'Missing sha256sum.txt.\nEither this image is corrupted, or of era 1.2.x (md5sum) and would downgrade image tools;\ndisallowed in either case.'
-MSG_ERR_ARCHITECTURE_MISMATCH: str = 'Upgrading to a different image architecture will break your system.'
+MSG_ERR_INCOMPATIBLE_IMAGE: str = 'Image compatibility check failed, aborting installation.'
+MSG_ERR_ARCHITECTURE_MISMATCH: str = 'The current architecture is "{0}", the new image is for "{1}". Upgrading to a different image architecture will break your system.'
+MSG_ERR_FLAVOR_MISMATCH: str = 'The current image flavor is "{0}", the new image is "{1}". Upgrading to a non-matching flavor can have unpredictable consequences.'
+MSG_ERR_MISSING_ARCHITECTURE: str = 'The new image version data does not specify architecture, cannot check compatibility (is it a legacy release image?)'
+MSG_ERR_MISSING_FLAVOR: str = 'The new image version data does not specify flavor, cannot check compatibility (is it a legacy release image?)'
+MSG_ERR_CORRUPT_CURRENT_IMAGE: str = 'Version data in the current image is malformed: missing flavor and/or architecture fields. Upgrade compatibility cannot be checked.'
+MSG_ERR_UNSUPPORTED_SIGNATURE_TYPE: str = 'Unsupported signature type, signature cannot be verified.'
 MSG_INFO_INSTALL_WELCOME: str = 'Welcome to VyOS installation!\nThis command will install VyOS to your permanent storage.'
 MSG_INFO_INSTALL_EXIT: str = 'Exiting from VyOS installation'
 MSG_INFO_INSTALL_SUCCESS: str = 'The image installed successfully; please reboot now.'
@@ -62,6 +87,7 @@ MSG_INPUT_CONFIG_FOUND: str = 'An active configuration was found. Would you like
 MSG_INPUT_CONFIG_CHOICE: str = 'The following config files are available for boot:'
 MSG_INPUT_CONFIG_CHOOSE: str = 'Which file would you like as boot config?'
 MSG_INPUT_IMAGE_NAME: str = 'What would you like to name this image?'
+MSG_INPUT_IMAGE_NAME_TAKEN: str = 'There is already an installed image by that name; please choose again'
 MSG_INPUT_IMAGE_DEFAULT: str = 'Would you like to set the new image as the default one for boot?'
 MSG_INPUT_PASSWORD: str = 'Please enter a password for the "vyos" user:'
 MSG_INPUT_PASSWORD_CONFIRM: str = 'Please confirm password for the "vyos" user:'
@@ -78,8 +104,10 @@ MSG_WARN_ROOT_SIZE_TOOBIG: str = 'The size is too big. Try again.'
 MSG_WARN_ROOT_SIZE_TOOSMALL: str = 'The size is too small. Try again'
 MSG_WARN_IMAGE_NAME_WRONG: str = 'The suggested name is unsupported!\n'\
 'It must be between 1 and 64 characters long and contains only the next characters: .+-_ a-z A-Z 0-9'
+
+MSG_WARN_CHANGE_PASSWORD: str = 'Default password used. Consider changing ' \
+    'it on next login.'
 MSG_WARN_PASSWORD_CONFIRM: str = 'The entered values did not match. Try again'
-MSG_WARN_FLAVOR_MISMATCH: str = 'The running image flavor is "{0}". The new image flavor is "{1}".\n' \
 'Installing a different image flavor may cause functionality degradation or break your system.\n' \
 'Do you want to continue with installation?'
 CONST_MIN_DISK_SIZE: int = 2147483648  # 2 GB
@@ -95,7 +123,7 @@ DIR_ISO_MOUNT: str = f'{DIR_INSTALLATION}/iso_src'
 DIR_DST_ROOT: str = f'{DIR_INSTALLATION}/disk_dst'
 DIR_KERNEL_SRC: str = '/boot/'
 FILE_ROOTFS_SRC: str = '/usr/lib/live/mount/medium/live/filesystem.squashfs'
-ISO_DOWNLOAD_PATH: str = '/tmp/vyos_installation.iso'
+ISO_DOWNLOAD_PATH: str = ''
 
 external_download_script = '/usr/libexec/vyos/simple-download.py'
 external_latest_image_url_script = '/usr/libexec/vyos/latest-image-url.py'
@@ -462,6 +490,73 @@ def setup_grub(root_dir: str) -> None:
     render(grub_cfg_menu, grub.TMPL_GRUB_MENU, {})
     render(grub_cfg_options, grub.TMPL_GRUB_OPTS, {})
 
+def get_cli_kernel_options(config_file: str) -> list:
+    config = ConfigTree(read_file(config_file))
+    config_dict = loads(config.to_json())
+    cmdline_options = []
+    kernel_options = dict_search('system.option.kernel', config_dict)
+    if kernel_options is None:
+        return cmdline_options
+
+    k_cpu_opts = kernel_options.get('cpu', {})
+    k_memory_opts = kernel_options.get('memory', {})
+
+    # XXX: This code path and if statements must be kept in sync with the Kernel
+    # option handling in system_options.py:generate(). This occurance is used
+    # for having the appropriate options passed to GRUB after an image upgrade!
+    if 'disable-mitigations' in kernel_options:
+        cmdline_options.append('mitigations=off')
+    if 'disable-power-saving' in kernel_options:
+        cmdline_options.append('intel_idle.max_cstate=0 processor.max_cstate=1')
+    if 'amd-pstate-driver' in kernel_options:
+        mode = kernel_options['amd-pstate-driver']
+        cmdline_options.append(
+            f'initcall_blacklist=acpi_cpufreq_init amd_pstate={mode}')
+    if 'quiet' in kernel_options:
+        cmdline_options.append('quiet')
+
+    if 'disable-hpet' in kernel_options:
+        cmdline_options.append('hpet=disable')
+
+    if 'disable-mce' in kernel_options:
+        cmdline_options.append('mce=off')
+
+    if 'disable-softlockup' in kernel_options:
+        cmdline_options.append('nosoftlockup')
+
+    # CPU options
+    isol_cpus = k_cpu_opts.get('isolate-cpus')
+    if isol_cpus:
+        cmdline_options.append(f'isolcpus={isol_cpus}')
+
+    nohz_full = k_cpu_opts.get('nohz-full')
+    if nohz_full:
+        cmdline_options.append(f'nohz_full={nohz_full}')
+
+    rcu_nocbs = k_cpu_opts.get('rcu-no-cbs')
+    if rcu_nocbs:
+        cmdline_options.append(f'rcu_nocbs={rcu_nocbs}')
+
+    if 'disable-nmi-watchdog' in k_cpu_opts:
+        cmdline_options.append('nmi_watchdog=0')
+
+    # Memory options
+    if 'disable-numa-balancing' in k_memory_opts:
+        cmdline_options.append('numa_balancing=disable')
+
+    default_hp_size = k_memory_opts.get('default-hugepage-size')
+    if default_hp_size:
+        cmdline_options.append(f'default_hugepagesz={default_hp_size}')
+
+    hp_sizes = k_memory_opts.get('hugepage-size')
+    if hp_sizes:
+        for size, settings in hp_sizes.items():
+            cmdline_options.append(f'hugepagesz={size}')
+            count = settings.get('hugepage-count')
+            if count:
+                cmdline_options.append(f'hugepages={count}')
+
+    return cmdline_options
 
 def configure_authentication(config_file: str, password: str) -> None:
     """Write encrypted password to config file
@@ -476,10 +571,7 @@ def configure_authentication(config_file: str, password: str) -> None:
     plaintext exposed
     """
     encrypted_password = linux_context.hash(password)
-
-    with open(config_file) as f:
-        config_string = f.read()
-
+    config_string = read_file(config_file)
     config = ConfigTree(config_string)
     config.set([
         'system', 'login', 'user', 'vyos', 'authentication',
@@ -501,7 +593,6 @@ def validate_signature(file_path: str, sign_type: str) -> None:
     """
     print('Validating signature')
     signature_valid: bool = False
-    # validate with minisig
     if sign_type == 'minisig':
         pub_key_list = glob('/usr/share/vyos/keys/*.minisign.pub')
         for pubkey in pub_key_list:
@@ -510,11 +601,8 @@ def validate_signature(file_path: str, sign_type: str) -> None:
                 signature_valid = True
                 break
         Path(f'{file_path}.minisig').unlink()
-    # validate with GPG
-    if sign_type == 'asc':
-        if run(f'gpg --verify ${file_path}.asc ${file_path}') == 0:
-            signature_valid = True
-        Path(f'{file_path}.asc').unlink()
+    else:
+        exit(MSG_ERR_UNSUPPORTED_SIGNATURE_TYPE)
 
     # warn or pass
     if not signature_valid:
@@ -524,21 +612,18 @@ def validate_signature(file_path: str, sign_type: str) -> None:
         print('Signature is valid')
 
 def download_file(local_file: str, remote_path: str, vrf: str,
-                  username: str, password: str,
                   progressbar: bool = False, check_space: bool = False):
-    environ['REMOTE_USERNAME'] = username
-    environ['REMOTE_PASSWORD'] = password
+    # Server credentials are implicitly passed in environment variables
+    # that are set by add_image
     if vrf is None:
         download(local_file, remote_path, progressbar=progressbar,
                  check_space=check_space, raise_error=True)
     else:
-        remote_auth = f'REMOTE_USERNAME={username} REMOTE_PASSWORD={password}'
         vrf_cmd = f'ip vrf exec {vrf} {external_download_script} \
                     --local-file {local_file} --remote-path {remote_path}'
-        cmd(vrf_cmd, auth=remote_auth)
+        cmd(vrf_cmd, env=environ)
 
 def image_fetch(image_path: str, vrf: str = None,
-                username: str = '', password: str = '',
                 no_prompt: bool = False) -> Path:
     """Fetch an ISO image
 
@@ -548,13 +633,17 @@ def image_fetch(image_path: str, vrf: str = None,
     Returns:
         Path: a path to a local file
     """
+    import os.path
+    from uuid import uuid4
+
+    global ISO_DOWNLOAD_PATH
+
     # Latest version gets url from configured "system update-check url"
     if image_path == 'latest':
         command = external_latest_image_url_script
         if vrf:
-            command = f'REMOTE_USERNAME={username} REMOTE_PASSWORD={password} \
-                        ip vrf exec {vrf} ' + command
-        code, output = rc_cmd(command)
+            command = f'ip vrf exec {vrf} {command}'
+        code, output = rc_cmd(command, env=environ)
         if code:
             print(output)
             exit(MSG_INFO_INSTALL_EXIT)
@@ -563,23 +652,25 @@ def image_fetch(image_path: str, vrf: str = None,
     try:
         # check a type of path
         if urlparse(image_path).scheme:
-            # download an image
+            # Download the image file
+            ISO_DOWNLOAD_PATH = os.path.join(os.path.expanduser("~"), '{0}.iso'.format(uuid4()))
             download_file(ISO_DOWNLOAD_PATH, image_path, vrf,
-                          username, password,
                           progressbar=True, check_space=True)
 
-            # download a signature
+            # Download the image signature
+            # VyOS only supports minisign signatures at the moment,
+            # but we keep the logic for multiple signatures
+            # in case we add something new in the future
             sign_file = (False, '')
-            for sign_type in ['minisig', 'asc']:
+            for sign_type in ['minisig']:
                 try:
                     download_file(f'{ISO_DOWNLOAD_PATH}.{sign_type}',
-                                  f'{image_path}.{sign_type}', vrf,
-                                  username, password)
+                                  f'{image_path}.{sign_type}', vrf)
                     sign_file = (True, sign_type)
                     break
                 except Exception:
-                    print(f'{sign_type} signature is not available')
-            # validate a signature if it is available
+                    print(f'Could not download {sign_type} signature')
+            # Validate the signature if it is available
             if sign_file[0]:
                 validate_signature(ISO_DOWNLOAD_PATH, sign_file[1])
             else:
@@ -701,30 +792,48 @@ def is_raid_install(install_object: Union[disk.DiskDetails, raid.RaidDetails]) -
     return False
 
 
-def validate_compatibility(iso_path: str) -> None:
+def validate_compatibility(iso_path: str, force: bool = False) -> None:
     """Check architecture and flavor compatibility with the running image
 
     Args:
         iso_path (str): a path to the mounted ISO image
     """
-    old_data = get_version_data()
-    old_flavor = old_data.get('flavor', '')
-    old_architecture = old_data.get('architecture') or cmd('dpkg --print-architecture')
+    current_data = get_version_data()
+    current_flavor = current_data.get('flavor')
+    current_architecture = current_data.get('architecture') or cmd('dpkg --print-architecture')
 
     new_data = get_version_data(f'{iso_path}/version.json')
-    new_flavor = new_data.get('flavor', '')
-    new_architecture = new_data.get('architecture', '')
+    new_flavor = new_data.get('flavor')
+    new_architecture = new_data.get('architecture')
 
-    if not old_architecture == new_architecture:
-        print(MSG_ERR_ARCHITECTURE_MISMATCH)
+    if not current_flavor or not current_architecture:
+        # This may only happen if someone modified the version file.
+        # Unlikely but not impossible.
+        print(MSG_ERR_CORRUPT_CURRENT_IMAGE)
         cleanup()
         exit(MSG_INFO_INSTALL_EXIT)
 
-    if not old_flavor == new_flavor:
-        if not ask_yes_no(MSG_WARN_FLAVOR_MISMATCH.format(old_flavor, new_flavor), default=False):
-            cleanup()
-            exit(MSG_INFO_INSTALL_EXIT)
+    success = True
 
+    if current_architecture != new_architecture:
+        success = False
+        if not new_architecture:
+            print(MSG_ERR_MISSING_ARCHITECTURE)
+        else:
+            print(MSG_ERR_ARCHITECTURE_MISMATCH.format(current_architecture, new_architecture))
+
+    if current_flavor != new_flavor:
+        if not force:
+            success = False
+        if not new_flavor:
+            print(MSG_ERR_MISSING_FLAVOR)
+        else:
+            print(MSG_ERR_FLAVOR_MISMATCH.format(current_flavor, new_flavor))
+
+    if not success:
+        print(MSG_ERR_INCOMPATIBLE_IMAGE)
+        cleanup()
+        exit(MSG_INFO_INSTALL_EXIT)
 
 def install_image() -> None:
     """Install an image to a disk
@@ -746,14 +855,25 @@ def install_image() -> None:
             break
         print(MSG_WARN_IMAGE_NAME_WRONG)
 
+    failed_check_status = [EPasswdStrength.WEAK, EPasswdStrength.ERROR]
     # ask for password
     while True:
         user_password: str = ask_input(MSG_INPUT_PASSWORD, no_echo=True,
                                        non_empty=True)
+
+        if user_password == DEFAULT_PASSWORD:
+            Warning(MSG_WARN_CHANGE_PASSWORD)
+        else:
+            result = evaluate_strength(user_password)
+            if result['strength'] in failed_check_status:
+                Warning(result['error'])
+
         confirm: str = ask_input(MSG_INPUT_PASSWORD_CONFIRM, no_echo=True,
                                  non_empty=True)
+
         if user_password == confirm:
             break
+
         print(MSG_WARN_PASSWORD_CONFIRM)
 
     # ask for default console
@@ -849,8 +969,7 @@ def install_image() -> None:
             for disk_target in l:
                 disk.partition_mount(disk_target.partition['efi'], f'{DIR_DST_ROOT}/boot/efi')
                 grub.install(disk_target.name, f'{DIR_DST_ROOT}/boot/',
-                             f'{DIR_DST_ROOT}/boot/efi',
-                             id=f'VyOS (RAID disk {l.index(disk_target) + 1})')
+                             f'{DIR_DST_ROOT}/boot/efi')
                 disk.partition_umount(disk_target.partition['efi'])
         else:
             print('Installing GRUB to the drive')
@@ -893,7 +1012,7 @@ def install_image() -> None:
 
 @compat.grub_cfg_update
 def add_image(image_path: str, vrf: str = None, username: str = '',
-              password: str = '', no_prompt: bool = False) -> None:
+              password: str = '', no_prompt: bool = False, force: bool = False) -> None:
     """Add a new image
 
     Args:
@@ -902,15 +1021,26 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
     if image.is_live_boot():
         exit(MSG_ERR_LIVE)
 
+    # Trying to upgrade with insufficient space can break the system.
+    # It's better to be on the safe side:
+    # our images are a bit below 1G,
+    # so one gigabyte to download the image plus one more to install it
+    # sounds like a sensible estimate.
+    if disk_usage('/').free < (2 * 1024**3):
+        exit(MSG_ERR_NOT_ENOUGH_SPACE)
+
+    environ['REMOTE_USERNAME'] = username
+    environ['REMOTE_PASSWORD'] = password
+
     # fetch an image
-    iso_path: Path = image_fetch(image_path, vrf, username, password, no_prompt)
+    iso_path: Path = image_fetch(image_path, vrf, no_prompt)
     try:
         # mount an ISO
         Path(DIR_ISO_MOUNT).mkdir(mode=0o755, parents=True)
         disk.partition_mount(iso_path, DIR_ISO_MOUNT, 'iso9660')
 
         print('Validating image compatibility')
-        validate_compatibility(DIR_ISO_MOUNT)
+        validate_compatibility(DIR_ISO_MOUNT, force=force)
 
         # check sums
         print('Validating image checksums')
@@ -936,8 +1066,12 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
                 f'Adding image would downgrade image tools to v.{cfg_ver}; disallowed')
 
         if not no_prompt:
+            versions = grub.version_list()
             while True:
                 image_name: str = ask_input(MSG_INPUT_IMAGE_NAME, version_name)
+                if image_name in versions:
+                    print(MSG_INPUT_IMAGE_NAME_TAKEN)
+                    continue
                 if image.validate_name(image_name):
                     break
                 print(MSG_WARN_IMAGE_NAME_WRONG)
@@ -959,8 +1093,14 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
             Path(target_config_dir).mkdir(parents=True)
             chown(target_config_dir, group='vyattacfg')
             chmod_2775(target_config_dir)
-            copytree('/opt/vyatta/etc/config/', target_config_dir,
+            copytree('/opt/vyatta/etc/config/', target_config_dir, symlinks=True,
                      copy_function=copy_preserve_owner, dirs_exist_ok=True)
+
+            # Record information from which image we upgraded to the new one.
+            # This can be used for a future automatic rollback into the old image.
+            tmp = {'previous_image' : image.get_running_image()}
+            write_file(f'{target_config_dir}/first_boot', dumps(tmp))
+
         else:
             Path(target_config_dir).mkdir(parents=True)
             chown(target_config_dir, group='vyattacfg')
@@ -992,6 +1132,12 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
         if set_as_default:
             grub.set_default(image_name, root_dir)
 
+        cmdline_options = get_cli_kernel_options(
+            f'{target_config_dir}/config.boot')
+        grub_util.update_kernel_cmdline_options(' '.join(cmdline_options),
+                                                root_dir=root_dir,
+                                                version=image_name)
+
     except OSError as e:
         # if no space error, remove image dir and cleanup
         if e.errno == ENOSPC:
@@ -1031,6 +1177,9 @@ def parse_arguments() -> Namespace:
     parser.add_argument('--image-path',
         help='a path (HTTP or local file) to an image that needs to be installed'
     )
+    parser.add_argument('--force', action='store_true',
+        help='Ignore flavor compatibility requirements.'
+    )
     # parser.add_argument('--image_new_name', help='a new name for image')
     args: Namespace = parser.parse_args()
     # Validate arguments
@@ -1047,7 +1196,8 @@ if __name__ == '__main__':
             install_image()
         if args.action == 'add':
             add_image(args.image_path, args.vrf,
-                      args.username, args.password, args.no_prompt)
+                      args.username, args.password,
+                      args.no_prompt, args.force)
 
         exit()
 
diff --git a/src/op_mode/image_manager.py b/src/op_mode/image_manager.py
index fb4286dbc..40668793e 100755
--- a/src/op_mode/image_manager.py
+++ b/src/op_mode/image_manager.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This file is part of VyOS.
 #
diff --git a/src/op_mode/install_mok.sh b/src/op_mode/install_mok.sh
new file mode 100755
index 000000000..29f78cd1f
--- /dev/null
+++ b/src/op_mode/install_mok.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if test -f /var/lib/shim-signed/mok/vyos-dev-2025-shim.der; then
+    mokutil --ignore-keyring --import /var/lib/shim-signed/mok/vyos-dev-2025-shim.der;
+else
+    echo "Secure Boot Machine Owner Key not found";
+fi
diff --git a/src/op_mode/interfaces.py b/src/op_mode/interfaces.py
index e7afc4caa..f238042a7 100755
--- a/src/op_mode/interfaces.py
+++ b/src/op_mode/interfaces.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,6 +21,7 @@ import sys
 import glob
 import json
 import typing
+import textwrap
 from datetime import datetime
 from tabulate import tabulate
 
@@ -28,9 +29,13 @@ import vyos.opmode
 from vyos.ifconfig import Section
 from vyos.ifconfig import Interface
 from vyos.ifconfig import VRRP
+from vyos.utils.dict import dict_set_nested
+from vyos.utils.network import get_interface_vrf
+from vyos.utils.network import interface_exists
 from vyos.utils.process import cmd
 from vyos.utils.process import rc_cmd
 from vyos.utils.process import call
+from vyos.configquery import op_mode_config_dict
 
 def catch_broken_pipe(func):
     def wrapped(*args, **kwargs):
@@ -38,7 +43,7 @@ def catch_broken_pipe(func):
             func(*args, **kwargs)
         except (BrokenPipeError, KeyboardInterrupt):
             # Flush output to /dev/null and bail out.
-            os.dup2(os.open(os.devnull, os.O_WRONLY), sys.stdout.fileno())
+            os.dup2(os.open(os.devnull, os.O_WRONLY), sys.stdout.fileno()) # pylint: disable = no-member
     return wrapped
 
 # The original implementation of filtered_interfaces has signature:
@@ -84,6 +89,18 @@ def filtered_interfaces(ifnames: typing.Union[str, list],
 
         yield interface
 
+def is_interface_has_mac(interface_name):
+    interface_no_mac = ('tun', 'wg')
+    return not any(interface_name.startswith(prefix) for prefix in interface_no_mac)
+
+def detailed_output(dataset, headers):
+    for data in dataset:
+        adjusted_rule = data + [""] * (len(headers) - len(data)) # account for different header length, like default-action
+        transformed_rule = [[header, adjusted_rule[i]] for i, header in enumerate(headers) if i < len(adjusted_rule)] # create key-pair list from headers and rules lists; wrap at 100 char
+
+        print(tabulate(transformed_rule, tablefmt="presto"))
+        print()
+
 def _split_text(text, used=0):
     """
     take a string and attempt to split it to fit with the width of the screen
@@ -236,10 +253,6 @@ def _get_summary_data(ifname: typing.Optional[str],
         iftype = ''
     ret = []
 
-    def is_interface_has_mac(interface_name):
-        interface_no_mac = ('tun', 'wg')
-        return not any(interface_name.startswith(prefix) for prefix in interface_no_mac)
-
     for interface in filtered_interfaces(ifname, iftype, vif, vrrp):
         res_intf = {}
 
@@ -296,6 +309,140 @@ def _get_counter_data(ifname: typing.Optional[str],
 
     return ret
 
+def _get_kernel_data(raw, ifname = None, detail = False,
+                     statistics = False):
+    if ifname:
+        # Check if the interface exists
+        if not interface_exists(ifname):
+            raise vyos.opmode.IncorrectValue(f"{ifname} does not exist!")
+        int_name = f'dev {ifname}'
+    else:
+        int_name = ''
+
+    kernel_interface = json.loads(cmd(f'ip -j -d -s address show {int_name}'))
+
+    # Return early if raw
+    if raw:
+        return kernel_interface, None
+
+    # Format the kernel data
+    kernel_interface_out = _format_kernel_data(kernel_interface, detail, statistics)
+
+    return kernel_interface, kernel_interface_out
+
+def _format_kernel_data(data, detail, statistics):
+    output_list = []
+    podman_vrf = {}
+    tmpInfo = {}
+
+    # Sort interfaces by name
+    for interface in sorted(data, key=lambda x: x.get('ifname', '')):
+        interface_name = interface.get('ifname', '')
+
+        # Skip VRF interfaces
+        if interface.get('linkinfo', {}).get('info_kind') == 'vrf':
+            continue
+        # Skip spawned interfaces
+        elif interface_name.startswith(('tunl', 'gre', 'erspan', 'pim6reg')):
+            continue
+
+        master = interface.get('master', 'default')
+        vrf = get_interface_vrf(interface)
+
+        # Get the device model; ex. Intel Corporation Ethernet Controller I225-V
+        dev_model = interface.get('parentdev', '')
+        if 'parentdev' in interface:
+            parentdev = interface['parentdev']
+            if re.match(r'^[0-9a-fA-F]{4}:', parentdev):
+                dev_model = cmd(f'lspci -nn -s {parentdev}').split(']:')[1].strip()
+
+        # Get the IP addresses on interface
+        ip_list = []
+        has_global = False
+
+        for ip in interface['addr_info']:
+            if ip.get('scope') in ('global', 'host'):
+                has_global = True
+                local = ip.get('local', '-')
+                prefixlen = ip.get('prefixlen', '')
+                ip_list.append(f"{local}/{prefixlen}")
+
+        # If no global IP address, add '-'; indicates no IP address on interface
+        if not has_global:
+            ip_list.append('-')
+
+        # Generate a mapping of podman interfaces to their VRF
+        if interface_name.startswith('pod-'):
+            dict_set_nested(f'{interface_name}.vrf', master, podman_vrf)
+
+        # If the veth interface's master is a podman interface, the VRF is the VRF of the podman interface
+        if master.startswith('pod-'):
+            vrf = podman_vrf.get(master).get('vrf', 'default')
+
+        rx_stats = interface.get('stats64', {}).get('rx')
+        tx_stats = interface.get('stats64', {}).get('tx')
+
+        sl_status = ('A' if not 'UP' in interface['flags'] else 'u') + '/' + ('D' if interface['operstate'] == 'DOWN' else 'u')
+
+        # Generate temporary dict to hold data
+        tmpInfo['ifname'] = interface_name
+        tmpInfo['ip'] = ip_list
+        tmpInfo['mac'] = interface.get('address', 'n/a') if is_interface_has_mac(interface_name) else 'n/a'
+        tmpInfo['mtu'] = interface.get('mtu', '')
+        tmpInfo['vrf'] = vrf
+        tmpInfo['status'] = sl_status
+        tmpInfo['description'] = "\n".join(textwrap.wrap(interface.get('ifalias', ''), width=50))
+        tmpInfo['device'] = dev_model
+        tmpInfo['alternate_names'] = interface.get('altnames', '')
+        tmpInfo['minimum_mtu'] = interface.get('min_mtu', '')
+        tmpInfo['maximum_mtu'] = interface.get('max_mtu', '')
+        tmpInfo['rx_packets'] = rx_stats.get('packets', "")
+        tmpInfo['rx_bytes'] = rx_stats.get('bytes', "")
+        tmpInfo['rx_errors'] = rx_stats.get('errors', "")
+        tmpInfo['rx_dropped'] = rx_stats.get('dropped', "")
+        tmpInfo['rx_over_errors'] = rx_stats.get('over_errors', '')
+        tmpInfo['multicast'] = rx_stats.get('multicast', "")
+        tmpInfo['tx_packets'] = tx_stats.get('packets', "")
+        tmpInfo['tx_bytes'] = tx_stats.get('bytes', "")
+        tmpInfo['tx_errors'] = tx_stats.get('errors', "")
+        tmpInfo['tx_dropped'] = tx_stats.get('dropped', "")
+        tmpInfo['tx_carrier_errors'] = tx_stats.get('carrier_errors', "")
+        tmpInfo['tx_collisions'] = tx_stats.get('collisions', "")
+
+        # Order the stats based on 'detail' or 'statistics'
+        if detail:
+            stat_keys = [
+                "rx_packets", "rx_bytes", "rx_errors", "rx_dropped",
+                "rx_over_errors", "multicast",
+                "tx_packets", "tx_bytes", "tx_errors", "tx_dropped",
+                "tx_carrier_errors", "tx_collisions",
+            ]
+        elif statistics:
+            stat_keys = [
+                "rx_packets", "rx_bytes", "tx_packets", "tx_bytes",
+                "rx_dropped", "tx_dropped", "rx_errors", "tx_errors",
+            ]
+        else:
+            stat_keys = []
+
+        stat_list = [tmpInfo.get(k, "") for k in stat_keys]
+
+        # Generate output list; detail adds more fields
+        output_list.append([tmpInfo['ifname'],
+                            *(['\n'.join(tmpInfo['ip'])] if not statistics else []),
+                            *([tmpInfo['mac']] if not statistics else []),
+                            *([tmpInfo['vrf']] if not statistics else []),
+                            *([tmpInfo['mtu']] if not statistics else []),
+                            *([tmpInfo['status']] if not statistics else []),
+                            *([tmpInfo['description']] if not statistics else []),
+                            *([tmpInfo['device']] if detail else []),
+                            *(['\n'.join(tmpInfo['alternate_names'])] if detail else []),
+                            *([tmpInfo['minimum_mtu']] if detail else []),
+                            *([tmpInfo['maximum_mtu']] if detail else []),
+                            *(stat_list if any([detail, statistics]) else [])])
+
+    return output_list
+
 @catch_broken_pipe
 def _format_show_data(data: list):
     unhandled = []
@@ -445,6 +592,34 @@ def _format_show_counters(data: list):
     print (output)
     return output
 
+def show_kernel(raw: bool, intf_name: typing.Optional[str],
+                detail: bool, statistics: bool):
+    raw_data, data = _get_kernel_data(raw, intf_name, detail, statistics)
+
+    # Return early if raw
+    if raw:
+        return raw_data
+
+    if detail:
+        # Detail headers; ex. show interfaces kernel detail; show interfaces kernel eth0 detail
+        detail_header = ['Interface', 'IP Address', 'MAC', 'VRF', 'MTU', 'S/L', 'Description',
+                        'Device', 'Alternate Names','Minimum MTU', 'Maximum MTU', 'RX_Packets',
+                        'RX_Bytes', 'RX_Errors', 'RX_Dropped', 'Receive Overrun Errors', 'Received Multicast',
+                        'TX_Packets', 'TX_Bytes', 'TX_Errors', 'TX_Dropped', 'Transmit Carrier Errors',
+                        'Transmit Collisions']
+    elif statistics:
+        # Statistics headers; ex. show interfaces kernel statistics; show interfaces kernel eth0 statistics
+        headers = ['Interface', 'Rx Packets', 'Rx Bytes', 'Tx Packets', 'Tx Bytes', 'Rx Dropped', 'Tx Dropped', 'Rx Errors', 'Tx Errors']
+    else:
+        # Normal headers; ex. show interfaces kernel; show interfaces kernel eth0
+        print('Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down')
+        headers = ['Interface', 'IP Address', 'MAC', 'VRF', 'MTU', 'S/L', 'Description']
+
+
+    if detail:
+        detailed_output(data, detail_header)
+    else:
+        print(tabulate(data, headers))
 
 def _show_raw(data: list, intf_name: str):
     if intf_name is not None and len(data) <= 1:
@@ -489,6 +664,72 @@ def show_counters(raw: bool, intf_name: typing.Optional[str],
         return _show_raw(data, intf_name)
     return _format_show_counters(data)
 
+def show_vlan_to_vni(raw: bool, intf_name: typing.Optional[str], vid: typing.Optional[str], detail: bool):
+    if not interface_exists(intf_name):
+        raise vyos.opmode.UnconfiguredObject(f"Interface {intf_name} does not exist\n")
+
+    if not vid:
+        vid = "all"
+
+    tunnel_data = json.loads(cmd(f"bridge -j vlan tunnelshow dev {intf_name} vid {vid}"))
+
+    if not tunnel_data:
+        if vid == "all":
+            raise vyos.opmode.UnconfiguredObject(f"No VLAN-to-VNI mapping found for interface {intf_name}\n")
+        else:
+            raise vyos.opmode.UnconfiguredObject(f"No VLAN-to-VNI mapping found for VLAN {vid}\n")
+
+    statistics_data = json.loads(cmd(f"bridge -j -s vlan tunnelshow dev {intf_name} vid {vid}"))[0]
+
+    mapping_config = op_mode_config_dict(['interfaces', 'vxlan', intf_name, 'vlan-to-vni'],
+                        get_first_key=True)
+
+    raw_data = {intf_name: {}}
+    output_list = []
+
+    for tunnel in tunnel_data[0].get("tunnels", []):
+        tunnel_id = tunnel.get("tunid")
+        tunnel_dict = raw_data[intf_name][tunnel_id] = {}
+
+        for vlan in statistics_data.get("vlans", []):
+            if vlan.get("vid") == tunnel.get("vlan"):
+                vlan_id = str(vlan.get("vid"))
+                description = mapping_config.get(vlan_id, {}).get("description", "")
+
+                if raw:
+                    tunnel_dict["vlan"] = vlan_id
+                    tunnel_dict["rx_bytes"] = vlan.get("rx_bytes")
+                    tunnel_dict["tx_bytes"] = vlan.get("tx_bytes")
+                    tunnel_dict["rx_packets"] = vlan.get("rx_packets")
+                    tunnel_dict["tx_packets"] = vlan.get("tx_packets")
+                    tunnel_dict["description"] = description
+                else:
+                    #Generate output list; detail adds more fields
+                    output_list.append([
+                        *([intf_name] if not detail else []),
+                        vlan_id,
+                        tunnel_id,
+                        description,
+                        *([vlan.get("rx_bytes")] if detail else []),
+                        *([vlan.get("tx_bytes")] if detail else []),
+                        *([vlan.get("rx_packets")] if detail else []),
+                        *([vlan.get("tx_packets")] if detail else [])
+                    ])
+
+    if raw:
+        return raw_data
+
+    if detail:
+        # Detail headers; ex. show interfaces vxlan vxlan1 vlan-to-vni detail
+        detail_header = ['VLAN', 'VNI', 'Description', 'Rx Bytes', 'Tx Bytes', 'Rx Packets', 'Tx Packets']
+        print('-' * 35)
+        print(f"Interface: {intf_name}\n")
+        detailed_output(output_list, detail_header)
+    else:
+        # Normal headers; ex. show interfaces vxlan vxlan1 vlan-to-vni
+        headers = ['Interface', 'VLAN', 'VNI', 'Description']
+        print(tabulate(output_list, headers))
+
 def clear_counters(intf_name: typing.Optional[str],
                    intf_type: typing.Optional[str],
                    vif: bool, vrrp: bool):
diff --git a/src/op_mode/interfaces_wireguard.py b/src/op_mode/interfaces_wireguard.py
index 627af0579..3c63d83ff 100644
--- a/src/op_mode/interfaces_wireguard.py
+++ b/src/op_mode/interfaces_wireguard.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/interfaces_wireless.py b/src/op_mode/interfaces_wireless.py
index bf6e462f3..5a708ad27 100755
--- a/src/op_mode/interfaces_wireless.py
+++ b/src/op_mode/interfaces_wireless.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ipoe-control.py b/src/op_mode/ipoe-control.py
index b7d6a0c43..f2934458e 100755
--- a/src/op_mode/ipoe-control.py
+++ b/src/op_mode/ipoe-control.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ipsec.py b/src/op_mode/ipsec.py
index 1ab50b105..4ff035416 100755
--- a/src/op_mode/ipsec.py
+++ b/src/op_mode/ipsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -230,17 +230,25 @@ def _get_parent_sa_state(connection_name: str, data: list) -> str:
     return ike_state
 
 
-def _get_child_sa_state(connection_name: str, tunnel_name: str, data: list) -> str:
+def _get_child_sa_state(
+    connection_name: str, tunnel_name: str, data: list, mode: str
+) -> str:
     """Get child SA state by connection and tunnel name
 
     Args:
         connection_name (str): Connection name
         tunnel_name (str): Tunnel name
         data (list): List of current SAs from vici
+        mode (str): Mode of child from vici list_connections
 
     Returns:
-        str: `up` if child SA state is 'installed' otherwise `down`
+        str: `up` if child SA state is 'installed' or child is passthrough
+             otherwise `down`
     """
+    # passthrough child (trap mode) has 'PASS' mode and is always up,
+    # but has no sa, so is not present in list_sas (data)
+    if mode == 'PASS':
+        return 'up'
     child_sa = 'down'
     if not data:
         return child_sa
@@ -330,7 +338,8 @@ def _get_raw_data_connections(list_connections: list, list_sas: list) -> list:
             base_list['children'] = []
             children = conn_conf['children']
             for tunnel, tun_options in children.items():
-                state = _get_child_sa_state(connection, tunnel, list_sas)
+                mode = tun_options.get('mode')
+                state = _get_child_sa_state(connection, tunnel, list_sas, mode)
                 local_ts = tun_options.get('local-ts')
                 remote_ts = tun_options.get('remote-ts')
                 dpd_action = tun_options.get('dpd_action')
diff --git a/src/op_mode/kernel_modules.py b/src/op_mode/kernel_modules.py
index e381a1df7..5475158aa 100755
--- a/src/op_mode/kernel_modules.py
+++ b/src/op_mode/kernel_modules.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/lldp.py b/src/op_mode/lldp.py
index fac622b81..6d77db5bc 100755
--- a/src/op_mode/lldp.py
+++ b/src/op_mode/lldp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/load-balancing_haproxy.py b/src/op_mode/load-balancing_haproxy.py
index ae6734e16..3ea016677 100755
--- a/src/op_mode/load-balancing_haproxy.py
+++ b/src/op_mode/load-balancing_haproxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/load-balancing_wan.py b/src/op_mode/load-balancing_wan.py
new file mode 100755
index 000000000..6f1d00dcd
--- /dev/null
+++ b/src/op_mode/load-balancing_wan.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+import re
+import sys
+
+from datetime import datetime
+
+from vyos.config import Config
+from vyos.utils.process import cmd
+
+import vyos.opmode
+
+wlb_status_file = '/run/wlb_status.json'
+
+status_format = '''Interface: {ifname}
+Status: {status}
+Last Status Change: {last_change}
+Last Interface Success: {last_success}
+Last Interface Failure: {last_failure}
+Interface Failures: {failures}
+'''
+
+def _verify(func):
+    """Decorator checks if WLB config exists"""
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = Config()
+        if not config.exists(['load-balancing', 'wan']):
+            unconf_message = 'WAN load-balancing is not configured'
+            raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        return func(*args, **kwargs)
+    return _wrapper
+
+def _get_raw_data():
+    with open(wlb_status_file, 'r') as f:
+        data = json.loads(f.read())
+        if not data:
+            return {}
+        return data
+
+def _get_formatted_output(raw_data):
+    from time import time
+
+    for ifname, if_data in raw_data.items():
+        latest_change = if_data['last_success'] if if_data['last_success'] > if_data['last_failure'] else if_data['last_failure']
+
+        change_dt = datetime.fromtimestamp(latest_change) if latest_change > 0 else None
+        success_dt = datetime.fromtimestamp(if_data['last_success']) if if_data['last_success'] > 0 else None
+        failure_dt = datetime.fromtimestamp(if_data['last_failure']) if if_data['last_failure'] > 0 else None
+        now = datetime.fromtimestamp(time())
+
+        fmt_data = {
+            'ifname': ifname,
+            'status': "active" if if_data['state'] else "failed",
+            'last_change': change_dt.strftime("%Y-%m-%d %H:%M:%S") if change_dt else 'N/A',
+            'last_success': str(now - success_dt) if success_dt else 'N/A',
+            'last_failure': str(now - failure_dt) if failure_dt else 'N/A',
+            'failures': if_data['failure_count']
+        }
+        print(status_format.format(**fmt_data))
+
+@_verify
+def show_summary(raw: bool):
+    data = _get_raw_data()
+
+    if raw:
+        return data
+    else:
+        return _get_formatted_output(data)
+
+@_verify
+def show_connection(raw: bool):
+    res = cmd('sudo conntrack -L -n')
+    lines = res.split("\n")
+    filtered_lines = [line for line in lines if re.search(r' mark=[1-9]', line)]
+
+    if raw:
+        return filtered_lines
+
+    for line in lines:
+        print(line)
+
+@_verify
+def show_status(raw: bool):
+    res = cmd('sudo nft list chain ip vyos_wanloadbalance wlb_mangle_prerouting')
+    lines = res.split("\n")
+    filtered_lines = [line.replace("\t", "") for line in lines[3:-2] if 'meta mark set' not in line]
+
+    if raw:
+        return filtered_lines
+
+    for line in filtered_lines:
+        print(line)
+
+if __name__ == "__main__":
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/log.py b/src/op_mode/log.py
index 797ba5a88..0bf44cf6a 100755
--- a/src/op_mode/log.py
+++ b/src/op_mode/log.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/maya_date.py b/src/op_mode/maya_date.py
index 847b543e0..06f2f22b1 100755
--- a/src/op_mode/maya_date.py
+++ b/src/op_mode/maya_date.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (c) 2013, 2018 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/memory.py b/src/op_mode/memory.py
index eb530035b..20d937243 100755
--- a/src/op_mode/memory.py
+++ b/src/op_mode/memory.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/mtr.py b/src/op_mode/mtr.py
index 522cbe008..646d95e7b 100644
--- a/src/op_mode/mtr.py
+++ b/src/op_mode/mtr.py
@@ -1,6 +1,6 @@
 #! /usr/bin/env python3
 
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/mtr_execute.py b/src/op_mode/mtr_execute.py
index 2585a7ee4..b97e46a1f 100644
--- a/src/op_mode/mtr_execute.py
+++ b/src/op_mode/mtr_execute.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/multicast.py b/src/op_mode/multicast.py
index 0666f8af3..096d01665 100755
--- a/src/op_mode/multicast.py
+++ b/src/op_mode/multicast.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/nat.py b/src/op_mode/nat.py
index c6cf4770a..a65bcfd59 100755
--- a/src/op_mode/nat.py
+++ b/src/op_mode/nat.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/neighbor.py b/src/op_mode/neighbor.py
index 8b3c45c7c..50fcf87c5 100755
--- a/src/op_mode/neighbor.py
+++ b/src/op_mode/neighbor.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ntp.py b/src/op_mode/ntp.py
index 6ec0fedcb..42d0c1b00 100644
--- a/src/op_mode/ntp.py
+++ b/src/op_mode/ntp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/openconnect-control.py b/src/op_mode/openconnect-control.py
index b70d4fa16..dec5b9482 100755
--- a/src/op_mode/openconnect-control.py
+++ b/src/op_mode/openconnect-control.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/openconnect.py b/src/op_mode/openconnect.py
index 62c683ebb..35df25856 100755
--- a/src/op_mode/openconnect.py
+++ b/src/op_mode/openconnect.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/openvpn.py b/src/op_mode/openvpn.py
index 092873909..7347ac757 100755
--- a/src/op_mode/openvpn.py
+++ b/src/op_mode/openvpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/otp.py b/src/op_mode/otp.py
index a4ab9b22b..aceb75660 100755
--- a/src/op_mode/otp.py
+++ b/src/op_mode/otp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
-
-# Copyright 2017, 2022 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/ping.py b/src/op_mode/ping.py
index 583d8792c..e9487e03b 100755
--- a/src/op_mode/ping.py
+++ b/src/op_mode/ping.py
@@ -1,6 +1,6 @@
 #! /usr/bin/env python3
 
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 49a461e9e..0f144443b 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -417,7 +417,7 @@ def parse_san_string(san_string):
             output.append(ipaddress.IPv6Address(value))
         elif tag == 'dns' or tag == 'rfc822':
             output.append(value)
-    return
+    return output
 
 
 def generate_certificate_request(
@@ -1373,6 +1373,21 @@ def show_all(raw: bool):
     print('\n')
     show_crl(raw)
 
+def renew_certbot(raw: bool, force: typing.Optional[bool] = False):
+    from vyos.defaults import directories
+
+    certbot_config = directories['certbot']
+    hook_dir = directories['base']
+
+    tmp = f'/usr/bin/certbot renew --no-random-sleep-on-renew ' \
+          f'--config-dir "{certbot_config}" ' \
+          f'--post-hook "{hook_dir}/vyos-certbot-renew-pki.sh"'
+    if force:
+        tmp += ' --force-renewal'
+
+    out = cmd(tmp)
+    if not raw:
+        print(out)
 
 if __name__ == '__main__':
     try:
diff --git a/src/op_mode/policy_route.py b/src/op_mode/policy_route.py
index d12465008..966dc80f9 100755
--- a/src/op_mode/policy_route.py
+++ b/src/op_mode/policy_route.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/powerctrl.py b/src/op_mode/powerctrl.py
index c32a2be7d..a60c33dc6 100755
--- a/src/op_mode/powerctrl.py
+++ b/src/op_mode/powerctrl.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ppp-server-ctrl.py b/src/op_mode/ppp-server-ctrl.py
index 2bae5b32a..96b497549 100755
--- a/src/op_mode/ppp-server-ctrl.py
+++ b/src/op_mode/ppp-server-ctrl.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/qos.py b/src/op_mode/qos.py
index b8ca149a0..47a7a3d59 100755
--- a/src/op_mode/qos.py
+++ b/src/op_mode/qos.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -38,7 +38,7 @@ def get_tc_info(interface_dict, interface_name, policy_type):
     if not policy_name:
         return None, None
     
-    class_dict = op_mode_config_dict(['qos', 'policy', policy_type, policy_name], key_mangling=('-', '_'),
+    class_dict = op_mode_config_dict(['qos', 'policy', policy_type, policy_name],
                             get_first_key=True)
     if not class_dict:
         return None, None
diff --git a/src/op_mode/raid.py b/src/op_mode/raid.py
index fed8ae2c3..985ef730f 100755
--- a/src/op_mode/raid.py
+++ b/src/op_mode/raid.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/reset_openvpn.py b/src/op_mode/reset_openvpn.py
index cef5299da..e3345435a 100755
--- a/src/op_mode/reset_openvpn.py
+++ b/src/op_mode/reset_openvpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/reset_vpn.py b/src/op_mode/reset_vpn.py
index 61d7c8c81..4ff1740d2 100755
--- a/src/op_mode/reset_vpn.py
+++ b/src/op_mode/reset_vpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/reset_wireguard.py b/src/op_mode/reset_wireguard.py
new file mode 100755
index 000000000..60aeef52d
--- /dev/null
+++ b/src/op_mode/reset_wireguard.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import typing
+
+import vyos.opmode
+
+from vyos.ifconfig import WireGuardIf
+from vyos.configquery import ConfigTreeQuery
+
+
+def _verify(func):
+    """Decorator checks if WireGuard interface config exists"""
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = ConfigTreeQuery()
+        interface = kwargs.get('interface')
+        if not config.exists(['interfaces', 'wireguard', interface]):
+            unconf_message = f'WireGuard interface {interface} is not configured'
+            raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        return func(*args, **kwargs)
+
+    return _wrapper
+
+
+@_verify
+def reset_peer(interface: str, peer: typing.Optional[str] = None):
+    intf = WireGuardIf(interface, create=False, debug=False)
+    return intf.operational.reset_peer(peer)
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/restart.py b/src/op_mode/restart.py
index 3b0031f34..7f50ba621 100755
--- a/src/op_mode/restart.py
+++ b/src/op_mode/restart.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
@@ -53,6 +53,10 @@ service_map = {
         'systemd_service': 'strongswan',
         'path': ['vpn', 'ipsec'],
     },
+    'load-balancing_wan': {
+        'systemd_service': 'vyos-wan-load-balance',
+        'path': ['load-balancing', 'wan'],
+    },
     'mdns_repeater': {
         'systemd_service': 'avahi-daemon',
         'path': ['service', 'mdns', 'repeater'],
@@ -86,6 +90,7 @@ services = typing.Literal[
     'haproxy',
     'igmp_proxy',
     'ipsec',
+    'load-balancing_wan',
     'mdns_repeater',
     'router_advert',
     'snmp',
diff --git a/src/op_mode/restart_dhcp_relay.py b/src/op_mode/restart_dhcp_relay.py
index 42626cac4..99c2c20b6 100755
--- a/src/op_mode/restart_dhcp_relay.py
+++ b/src/op_mode/restart_dhcp_relay.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/restart_frr.py b/src/op_mode/restart_frr.py
index 83146f5ec..188d99037 100755
--- a/src/op_mode/restart_frr.py
+++ b/src/op_mode/restart_frr.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/route.py b/src/op_mode/route.py
index 4aa57dbf4..b11b0ccc2 100755
--- a/src/op_mode/route.py
+++ b/src/op_mode/route.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/secure_boot.py b/src/op_mode/secure_boot.py
index 5f6390a15..a2d4c9e72 100755
--- a/src/op_mode/secure_boot.py
+++ b/src/op_mode/secure_boot.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/serial.py b/src/op_mode/serial.py
index a5864872b..e9f9fc121 100644
--- a/src/op_mode/serial.py
+++ b/src/op_mode/serial.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/sflow.py b/src/op_mode/sflow.py
index 0f3feb35a..668d0b7b3 100755
--- a/src/op_mode/sflow.py
+++ b/src/op_mode/sflow.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show-bond.py b/src/op_mode/show-bond.py
index f676e0841..0be3ae215 100755
--- a/src/op_mode/show-bond.py
+++ b/src/op_mode/show-bond.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_acceleration.py b/src/op_mode/show_acceleration.py
index 1c4831f1d..36e906cb8 100755
--- a/src/op_mode/show_acceleration.py
+++ b/src/op_mode/show_acceleration.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -26,7 +26,7 @@ from vyos.utils.process import popen
 def detect_qat_dev():
     output, err = popen('lspci -nn', decode='utf-8')
     if not err:
-        data = re.findall('(8086:19e2)|(8086:37c8)|(8086:0435)|(8086:6f54)', output)
+        data = re.findall('(8086:19e2)|(8086:37c[8-9])|(8086:0435)|(8086:6f54)', output)
         # QAT devices found
         if data:
             return
@@ -93,7 +93,7 @@ args = parser.parse_args()
 if args.hw:
     detect_qat_dev()
     # Show availible Intel QAT devices
-    call('lspci -nn | egrep -e \'8086:37c8|8086:19e2|8086:0435|8086:6f54\'')
+    call('lspci -nn | egrep -e \'8086:37c[8-9]|8086:19e2|8086:0435|8086:6f54\'')
 elif args.flow and args.dev:
     check_qat_if_conf()
     call('cat '+get_qat_proc_path(args.dev)+"fw_counters")
diff --git a/src/op_mode/show_bonding_detail.sh b/src/op_mode/show_bonding_detail.sh
new file mode 100755
index 000000000..62265daa2
--- /dev/null
+++ b/src/op_mode/show_bonding_detail.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ -f "/proc/net/bonding/$1" ]; then
+  cat "/proc/net/bonding/$1";
+else
+  echo "Interface $1 does not exist!";
+fi
diff --git a/src/op_mode/show_configuration_json.py b/src/op_mode/show_configuration_json.py
index fdece533b..4e4b4d386 100755
--- a/src/op_mode/show_configuration_json.py
+++ b/src/op_mode/show_configuration_json.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_openconnect_otp.py b/src/op_mode/show_openconnect_otp.py
index 3771fb385..36aa7bf11 100755
--- a/src/op_mode/show_openconnect_otp.py
+++ b/src/op_mode/show_openconnect_otp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2017-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/show_openvpn.py b/src/op_mode/show_openvpn.py
index 6abafc8b6..9f2708b69 100755
--- a/src/op_mode/show_openvpn.py
+++ b/src/op_mode/show_openvpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_openvpn_mfa.py b/src/op_mode/show_openvpn_mfa.py
index 100c42154..a08fd33ae 100755
--- a/src/op_mode/show_openvpn_mfa.py
+++ b/src/op_mode/show_openvpn_mfa.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2017-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/show_ppp_stats.sh b/src/op_mode/show_ppp_stats.sh
new file mode 100755
index 000000000..d9c17f966
--- /dev/null
+++ b/src/op_mode/show_ppp_stats.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+if [ -d "/sys/class/net/$1" ]; then
+  /usr/sbin/pppstats "$1";
+fi
diff --git a/src/op_mode/show_sensors.py b/src/op_mode/show_sensors.py
index 5e3084fe9..1efcc9aec 100755
--- a/src/op_mode/show_sensors.py
+++ b/src/op_mode/show_sensors.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2017-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/show_techsupport_report.py b/src/op_mode/show_techsupport_report.py
index 32cf67778..f22b5054a 100644
--- a/src/op_mode/show_techsupport_report.py
+++ b/src/op_mode/show_techsupport_report.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -59,7 +59,7 @@ def execute_command(command: str, header_text: str) -> None:
     # Flush standard streams; redirect remaining output to devnull
     # Resolves T5633: Bug #1 and 3
     except (BrokenPipeError, KeyboardInterrupt):
-        os.dup2(os.open(os.devnull, os.O_WRONLY), sys.stdout.fileno())
+        os.dup2(os.open(os.devnull, os.O_WRONLY), sys.stdout.fileno()) # pylint: disable = no-member
         sys.exit(1)
     except Exception as e:
         print(f"Error executing command: {command}")
diff --git a/src/op_mode/show_usb_serial.py b/src/op_mode/show_usb_serial.py
index 973bf19c8..7c1d2a07f 100755
--- a/src/op_mode/show_usb_serial.py
+++ b/src/op_mode/show_usb_serial.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_users.py b/src/op_mode/show_users.py
index 82bd585c9..bccfaf991 100755
--- a/src/op_mode/show_users.py
+++ b/src/op_mode/show_users.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_virtual_server.py b/src/op_mode/show_virtual_server.py
index 7880edc97..5c6ba4f4e 100755
--- a/src/op_mode/show_virtual_server.py
+++ b/src/op_mode/show_virtual_server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/show_vpp_interfaces.py b/src/op_mode/show_vpp_interfaces.py
new file mode 100755
index 000000000..c159ad0aa
--- /dev/null
+++ b/src/op_mode/show_vpp_interfaces.py
@@ -0,0 +1,257 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import argparse
+import json
+from tabulate import tabulate
+
+from vyos.configquery import ConfigTreeQuery
+from vyos.utils.process import rc_cmd
+
+from vyos.vpp import VPPControl
+from vyos.vpp.utils import (
+    vpp_ifaces_list,
+    vpp_ip_addresses_by_index,
+    vpp_ifaces_stats,
+)
+
+
+def get_iproute_address_list(interface: str) -> list:
+    """Get data from the Linux command 'ip --json address list dev {interface}' and return a list info
+    for the given interface.
+
+    Args:
+        interface (str): Interface name.
+
+    Returns:
+        list: A dictionary containing the JSON data from the 'ip --json address list' command for the specified interface.
+    """
+    rc, out = rc_cmd(f'ip --json address list dev {interface}')
+    if rc:
+        return []
+    return json.loads(out)
+
+
+def get_iproute_link_list(interface):
+    """Get data from the Linux command 'ip --json link show dev {interface}' and return a list info
+    for the given interface.
+
+    Args:
+        interface (str): Interface name.
+
+    Returns:
+        list: A dictionary containing the JSON data from the 'ip --json link show' command for the specified interface.
+    """
+    rc, out = rc_cmd(f'ip --json link list dev {interface}')
+    if rc:
+        return []
+    return json.loads(out)
+
+
+def merge_dicts(*dicts) -> dict:
+    """Merge dictionaries into a new dictionary.
+
+    Args:
+        *dicts: Any number of dictionaries.
+
+    Returns:
+        dict: A new dictionary containing all the key-value pairs from the given dictionaries.
+    """
+    merged = {}
+    for dictionary in dicts:
+        merged.update(dictionary)
+    return merged
+
+
+def show_interfaces(interfaces_list: list) -> str:
+    """Get JSON info from linux and represent it in a table format
+    Use tabulate to generate table
+
+    Interface        IP Address             Mtu           S/L  Description
+    ---------        ----------             ---           ---  -----------
+    dum0             203.0.113.1/32         1500          u/u
+                     100.64.1.1/24
+    eth0             192.168.122.14/24      1500          u/u  WAN
+
+    :return:
+    """
+    table = []
+    for interface in interfaces_list:
+        # Get the data for the interface
+        ip_address_data = get_iproute_address_list(interface)
+        link_data = get_iproute_link_list(interface)
+
+        # Skip this interface if data is not available
+        if not link_data:
+            continue
+        interface_data = merge_dicts(ip_address_data[0], link_data[0])
+
+        # Get the interface name
+        interface_name = interface_data['ifname']
+
+        # Get the IP addresses and their corresponding prefixes
+        ip_info = [
+            (address['local'], address.get('prefixlen', ''))
+            for address in interface_data['addr_info']
+        ]
+
+        # Format the IP addresses with prefixes and line breaks
+        ip_addresses = '\n'.join(f'{ip}/{prefix}' for ip, prefix in ip_info)
+
+        # Get the MAC address
+        mac = interface_data.get('address', 'n/a')
+
+        # Get the MTU
+        mtu = interface_data.get('mtu')
+
+        # Get the state of the interface
+        state = interface_data['operstate'].lower()
+
+        # Get the description of the interface
+        description = interface_data.get('ifalias', '')
+
+        # Create the list of values for the table
+        values = [interface_name, ip_addresses, mac, mtu, state, description]
+
+        # Append the list of values to the table
+        table.append(values)
+
+    # Print the table with IP addresses listed on separate lines
+    headers = ['Interface', 'IP Address', 'MAC', 'MTU', 'State', 'Description']
+    return tabulate(table, headers=headers, tablefmt='simple')
+
+
+def show_interfaces_dataplane(interfaces_list: list, filter_type: str = 'all') -> str:
+    table = []
+    interface_dp_filter = ('tun', 'tap')
+    lcp_pair_list = vpp.lcp_pairs_list()
+    vpp_name_kernel_to_kernel_name = {
+        entry['vpp_name_kernel']: entry['kernel_name'] for entry in lcp_pair_list
+    }
+    for interface in interfaces_list:
+        interface_name = interface.get('interface_name')
+        if filter_type == 'no_tun_tap' and interface_name.startswith(
+            interface_dp_filter
+        ):
+            continue
+        if filter_type == 'only_tun_tap' and not interface_name.startswith(
+            interface_dp_filter
+        ):
+            continue
+        kernel_name = vpp_name_kernel_to_kernel_name.get(interface_name, '')
+
+        dp_ip_addresses = vpp_ip_addresses_by_index(
+            vpp.api, interface.get('sw_if_index')
+        )
+        ip_addresses = '\n'.join(dp_ip_addresses)
+
+        mac = str(interface.get('l2_address', 'n/a'))
+        mtu = interface.get('mtu', [])[0]
+        # state
+        flags = interface.get('flags')
+        state = 'up' if flags == 3 else 'down'
+
+        iftype = interface.get('interface_dev_type').split()[0]
+
+        values = [kernel_name, interface_name, iftype, ip_addresses, mac, mtu, state]
+        table.append(values)
+    headers = [
+        'Kernel',
+        'Dataplane',
+        'Type',
+        'IP Address',
+        'MAC',
+        'MTU',
+        'State',
+    ]
+    table = sorted(table)
+    return tabulate(table, headers=headers, tablefmt='simple')
+
+
+def show_interfaces_hardware(intf_name) -> str:
+    if not intf_name:
+        intf_name = ''
+
+    statistics = vpp_ifaces_stats(intf_name)
+    for intf, stats in sorted(statistics.items()):
+        print(f'\n---------------------------------\nInterface {intf}:\n')
+        table = []
+        for k, v in stats.items():
+            if isinstance(v, dict):
+                for i, j in v.items():
+                    table.append([f"{k} {i}", j])
+            else:
+                table.append([k, v])
+        print(tabulate(table, tablefmt="presto"))
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Show VPP interfaces')
+    parser.add_argument(
+        '--summary',
+        action='store_true',
+        help='Show summary of VPP interfaces (ethernet and kernel tun)',
+    )
+    parser.add_argument(
+        '--dataplane', action='store_true', help='Show VPP ethernet interfaces'
+    )
+    parser.add_argument(
+        '--kernel', action='store_true', help='Show VPP kernel interfaces'
+    )
+    parser.add_argument(
+        '--iproute', action='store_true', help='Show interfaces (iproute2)'
+    )
+    parser.add_argument(
+        '--hardware',
+        action='store_true',
+        help='Show more detailed statistics for VPP interfaces',
+    )
+    parser.add_argument('--intf-name', action='store', help='Kernel interface name')
+
+    args = parser.parse_args()
+
+    config = ConfigTreeQuery()
+
+    if not config.exists('vpp settings interface'):
+        print('VPP interfaces not configured')
+        exit(0)
+
+    vpp = VPPControl()
+    dp_ifaces_list = vpp_ifaces_list(vpp.api)
+
+    if args.summary:
+        print(show_interfaces_dataplane(dp_ifaces_list, filter_type='all'))
+
+    if args.dataplane:
+        print(show_interfaces_dataplane(dp_ifaces_list, filter_type='no_tun_tap'))
+        exit(0)
+
+    if args.kernel:
+        print(show_interfaces_dataplane(dp_ifaces_list, filter_type='only_tun_tap'))
+
+    if args.iproute:
+        vpp_interfaces = []
+        vpp_ethernet = config.list_nodes('vpp settings interface')
+        vpp_interfaces.extend(vpp_ethernet)
+        if config.exists('vpp kernel-interfaces'):
+            vpp_kernel_interfaces = config.list_nodes('vpp kernel-interfaces')
+            vpp_interfaces.extend(vpp_kernel_interfaces)
+        print(show_interfaces(interfaces_list=vpp_interfaces))
+
+    if args.hardware:
+        show_interfaces_hardware(intf_name=args.intf_name)
diff --git a/src/op_mode/show_vpp_nat44.py b/src/op_mode/show_vpp_nat44.py
new file mode 100644
index 000000000..500280210
--- /dev/null
+++ b/src/op_mode/show_vpp_nat44.py
@@ -0,0 +1,251 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import json
+import sys
+from tabulate import tabulate
+
+import vyos.opmode
+from vyos.configquery import ConfigTreeQuery
+
+from vyos.vpp import VPPControl
+
+
+protocol_map = {
+    0: 'all',
+    1: 'icmp',
+    6: 'tcp',
+    17: 'udp',
+}
+
+# NAT flags
+flags_map = {
+    'twice-nat': 0x01,
+    'self-twice-nat': 0x02,
+    'out2in-only': 0x04,
+    'out': 0x10,
+    'in': 0x20,
+}
+
+
+def _verify(func):
+    """Decorator checks if config for VPP NAT44 exists"""
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = ConfigTreeQuery()
+        base = 'vpp nat44'
+        if not config.exists(base):
+            raise vyos.opmode.UnconfiguredSubsystem(f'{base} is not configured')
+
+        return func(*args, **kwargs)
+
+    return _wrapper
+
+
+def decode_bitmask(bitmask: int) -> list:
+    """Decode a bitmask into a list of flag names"""
+    return [name for name, value in flags_map.items() if bitmask & value]
+
+
+def _get_raw_output(data_dump):
+    data = [json.loads(json.dumps(d._asdict(), default=str)) for d in data_dump]
+    return data
+
+
+def _get_raw_output_sessions(vpp_api):
+    users: list[dict] = vpp_api.nat44_user_dump()
+    sessions_list: list[dict] = []
+    for user in users:
+        ip_address = str(user._asdict().get('ip_address'))
+        user_sessions_dump = vpp_api.nat44_user_session_v3_dump(ip_address=ip_address)
+        user_sessions = [
+            json.loads(json.dumps(session._asdict(), default=str))
+            for session in user_sessions_dump
+        ]
+        sessions_list.extend(user_sessions)
+    return sorted(sessions_list, key=lambda x: x["inside_ip_address"])
+
+
+def _get_formatted_output_sessions(sessions_list):
+    print('NAT44 ED sessions:')
+    print(f'---------------  {len(sessions_list)} sessions  ---------------')
+    for session in sessions_list:
+        in_ip_addr = session.get('inside_ip_address')
+        in_port = session.get('inside_port')
+        out_ip_addr = session.get('outside_ip_address')
+        out_port = session.get('outside_port')
+        protocol = protocol_map[session.get('protocol')].upper()
+        last_heard = session.get('last_heard')
+        time_since_last_heard = session.get('time_since_last_heard')
+        total_bytes = session.get('total_bytes')
+        total_pkts = session.get('total_pkts')
+        ext_host_address = session.get('ext_host_address')
+        ext_host_port = session.get('ext_host_port')
+        is_timed_out = session.get('is_timed_out')
+
+        print(f'   i2o {in_ip_addr} proto {protocol} port {in_port}')
+        print(f'   o2i {out_ip_addr} proto {protocol} port {out_port}')
+        print(f'      external host {ext_host_address}:{ext_host_port}')
+        print(
+            f'      i2o flow: match: saddr {in_ip_addr} sport {in_port} daddr {ext_host_address} dport {ext_host_port} proto {protocol} rewrite: saddr {out_ip_addr}'
+            + (
+                f' sport {out_port}'
+                if protocol != 'ICMP'
+                else f' daddr {ext_host_address} icmp-id {ext_host_port}'
+            )
+        )
+        print(
+            f'      o2i flow: match: saddr {ext_host_address} sport {ext_host_port} daddr {out_ip_addr} dport {out_port} proto {protocol} rewrite: '
+            + (
+                f'daddr {in_ip_addr} dport {in_port}'
+                if protocol != 'ICMP'
+                else f' saddr {ext_host_address} daddr {in_ip_addr} icmp-id {ext_host_port}'
+            )
+        )
+        print(f'      last heard {last_heard}')
+        print(f'      time since last heard {time_since_last_heard}')
+        print(f'      total packets {total_pkts}, total bytes {total_bytes}')
+        if is_timed_out:
+            print('      session timed out')
+        print('\n')
+
+
+def _get_formatted_output_addresses(addresses):
+    twice_nat_address = []
+    translation_address = []
+    for address_info in addresses:
+        address = address_info.get('ip_address')
+        if address_info.get('flags') & flags_map['twice-nat']:
+            twice_nat_address.append(address)
+        else:
+            translation_address.append(address)
+
+    print('NAT44 pool addresses:')
+    for addr in translation_address:
+        print(f' {addr}')
+    print('NAT44 twice-nat pool addresses:')
+    for addr in twice_nat_address:
+        print(f' {addr}')
+
+
+def _get_formatted_output_interfaces(vpp, interfaces):
+    print('NAT44 interfaces:')
+    for interface in interfaces:
+        name = vpp.get_interface_name(interface['sw_if_index'])
+        iface_type = decode_bitmask(interface['flags'])
+        print(f'  {name} {" ".join(iface_type)}')
+
+
+def _get_formatted_output_rules(rules_list):
+    data_entries = []
+    for rule in rules_list:
+        external_address = rule.get('external_ip_address')
+        external_port = rule.get('external_port') or ''
+        local_address = rule.get('local_ip_address')
+        local_port = rule.get('local_port') or ''
+        protocol = protocol_map[rule.get('protocol', 0)]
+        options = ' '.join(decode_bitmask(rule.get('flags')))
+
+        values = [
+            external_address,
+            external_port,
+            local_address,
+            local_port,
+            protocol,
+            options,
+        ]
+        data_entries.append(values)
+    headers = [
+        'External address',
+        'External port',
+        'Local address',
+        'Local port',
+        'Protocol',
+        'Options',
+    ]
+    out = sorted(data_entries, key=lambda x: x[2])
+    return tabulate(out, headers=headers, tablefmt='simple')
+
+
+@_verify
+def show_sessions(raw: bool):
+    vpp = VPPControl()
+    sessions_list: list[dict] = _get_raw_output_sessions(vpp.api)
+
+    if raw:
+        return sessions_list
+
+    else:
+        return _get_formatted_output_sessions(sessions_list)
+
+
+@_verify
+def show_summary(raw: bool):
+    vpp = VPPControl()
+    return vpp.cli_cmd('show nat44 summary').reply
+
+
+@_verify
+def show_static(raw: bool):
+    vpp = VPPControl()
+    nat_static_dump = vpp.api.nat44_static_mapping_dump()
+    rules_list: list[dict] = _get_raw_output(nat_static_dump)
+
+    if raw:
+        return rules_list
+
+    else:
+        return _get_formatted_output_rules(rules_list)
+
+
+@_verify
+def show_addresses(raw: bool):
+    vpp = VPPControl()
+    addresses_dump = vpp.api.nat44_address_dump()
+    addresses: list[dict] = _get_raw_output(addresses_dump)
+
+    if raw:
+        return addresses
+
+    else:
+        return _get_formatted_output_addresses(addresses)
+
+
+@_verify
+def show_interfaces(raw: bool):
+    vpp = VPPControl()
+    interfaces_dump = vpp.api.nat44_interface_dump()
+    interfaces: list[dict] = _get_raw_output(interfaces_dump)
+
+    if raw:
+        return interfaces
+
+    else:
+        return _get_formatted_output_interfaces(vpp, interfaces)
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/show_wwan.py b/src/op_mode/show_wwan.py
index bd97bb0e5..05e7d0e75 100755
--- a/src/op_mode/show_wwan.py
+++ b/src/op_mode/show_wwan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/snmp.py b/src/op_mode/snmp.py
index 3d6cd220a..ea952aaaa 100755
--- a/src/op_mode/snmp.py
+++ b/src/op_mode/snmp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/snmp_ifmib.py b/src/op_mode/snmp_ifmib.py
index c71febac9..020865c9d 100755
--- a/src/op_mode/snmp_ifmib.py
+++ b/src/op_mode/snmp_ifmib.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/snmp_v3.py b/src/op_mode/snmp_v3.py
index abeb524dd..94c6691b0 100755
--- a/src/op_mode/snmp_v3.py
+++ b/src/op_mode/snmp_v3.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/ssh.py b/src/op_mode/ssh.py
index 0c51576b0..a4442c301 100755
--- a/src/op_mode/ssh.py
+++ b/src/op_mode/ssh.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2017-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/op_mode/storage.py b/src/op_mode/storage.py
index 8fd2ffea1..0f3fabe32 100755
--- a/src/op_mode/storage.py
+++ b/src/op_mode/storage.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -13,10 +13,8 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
 
 import sys
-
 import vyos.opmode
 
 from jinja2 import Template
@@ -28,9 +26,6 @@ Used:       {{used}} ({{use_percentage}}%)
 Available:  {{avail}} ({{avail_percentage}}%)
 """
 
-def _get_formatted_output():
-    return _get_system_storage()
-
 def show(raw: bool):
     from vyos.utils.disk import get_persistent_storage_stats
 
@@ -49,7 +44,7 @@ def show(raw: bool):
             tmpl = Template(output_tmpl)
             return tmpl.render(data).strip()
 
-    return output
+    return None
 
 if __name__ == '__main__':
     try:
@@ -59,4 +54,3 @@ if __name__ == '__main__':
     except (ValueError, vyos.opmode.Error) as e:
         print(e)
         sys.exit(1)
-
diff --git a/src/op_mode/stp.py b/src/op_mode/stp.py
new file mode 100755
index 000000000..ae0954604
--- /dev/null
+++ b/src/op_mode/stp.py
@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import typing
+import json
+from tabulate import tabulate
+
+import vyos.opmode
+from vyos.utils.process import cmd
+from vyos.utils.network import interface_exists
+
+def detailed_output(dataset, headers):
+    for data in dataset:
+        adjusted_rule = data + [""] * (len(headers) - len(data)) # account for different header length, like default-action
+        transformed_rule = [[header, adjusted_rule[i]] for i, header in enumerate(headers) if i < len(adjusted_rule)] # create key-pair list from headers and rules lists; wrap at 100 char
+
+        print(tabulate(transformed_rule, tablefmt="presto"))
+        print()
+
+def _get_bridge_vlan_data(iface):
+    allowed_vlans = []
+    native_vlan = None
+    vlanData = json.loads(cmd(f"bridge -j -d vlan show"))
+    for vlans in vlanData:
+        if vlans['ifname'] == iface:
+            for allowed in vlans['vlans']:
+                if "flags" in allowed and "PVID" in allowed["flags"]:
+                    native_vlan = allowed['vlan']
+                elif allowed.get('vlanEnd', None):
+                    allowed_vlans.append(f"{allowed['vlan']}-{allowed['vlanEnd']}")
+                else:
+                    allowed_vlans.append(str(allowed['vlan']))
+
+    if not allowed_vlans:
+        allowed_vlans = ["none"]
+    if not native_vlan:
+        native_vlan = "none"
+
+    return ",".join(allowed_vlans), native_vlan
+
+def _get_stp_data(ifname, brInfo, brStatus):
+    tmpInfo = {}
+
+    tmpInfo['bridge_name'] = brInfo.get('ifname')
+    tmpInfo['up_state'] = brInfo.get('operstate')
+    tmpInfo['priority'] = brInfo.get('linkinfo').get('info_data').get('priority')
+    tmpInfo['vlan_filtering'] = "Enabled" if brInfo.get('linkinfo').get('info_data').get('vlan_filtering') == 1 else "Disabled"
+    tmpInfo['vlan_protocol'] = brInfo.get('linkinfo').get('info_data').get('vlan_protocol')
+
+    # The version of VyOS I tested had am issue with the "ip -d link show type bridge"
+    # output. The root_id was always the local bridge, even though the underlying system
+    # understood when it wasn't. Could be an upstream Bug. I pull from the "/sys/class/net"
+    # structure instead. This can be changed later if the "ip link" behavior is corrected.
+
+    #tmpInfo['bridge_id'] = brInfo.get('linkinfo').get('info_data').get('bridge_id')
+    #tmpInfo['root_id'] = brInfo.get('linkinfo').get('info_data').get('root_id')
+
+    tmpInfo['bridge_id'] = cmd(f"cat /sys/class/net/{brInfo.get('ifname')}/bridge/bridge_id").split('.')
+    tmpInfo['root_id'] = cmd(f"cat /sys/class/net/{brInfo.get('ifname')}/bridge/root_id").split('.')
+
+    # The "/sys/class/net" structure stores the IDs without seperators like ':' or '.'
+    # This adds a ':' after every 2 characters to make it resemble a MAC Address
+    tmpInfo['bridge_id'][1] = ':'.join(tmpInfo['bridge_id'][1][i:i+2] for i in range(0, len(tmpInfo['bridge_id'][1]), 2))
+    tmpInfo['root_id'][1] = ':'.join(tmpInfo['root_id'][1][i:i+2] for i in range(0, len(tmpInfo['root_id'][1]), 2))
+
+    tmpInfo['stp_state'] = "Enabled" if brInfo.get('linkinfo', {}).get('info_data', {}).get('stp_state') == 1 else "Disabled"
+
+    # I don't call any of these values, but I created them to be called within raw output if desired
+
+    tmpInfo['mcast_snooping'] = "Enabled" if brInfo.get('linkinfo').get('info_data').get('mcast_snooping') == 1 else "Disabled"
+    tmpInfo['rxbytes'] = brInfo.get('stats64').get('rx').get('bytes')
+    tmpInfo['rxpackets'] = brInfo.get('stats64').get('rx').get('packets')
+    tmpInfo['rxerrors'] = brInfo.get('stats64').get('rx').get('errors')
+    tmpInfo['rxdropped'] = brInfo.get('stats64').get('rx').get('dropped')
+    tmpInfo['rxover_errors'] = brInfo.get('stats64').get('rx').get('over_errors')
+    tmpInfo['rxmulticast'] = brInfo.get('stats64').get('rx').get('multicast')
+    tmpInfo['txbytes'] = brInfo.get('stats64').get('tx').get('bytes')
+    tmpInfo['txpackets'] = brInfo.get('stats64').get('tx').get('packets')
+    tmpInfo['txerrors'] = brInfo.get('stats64').get('tx').get('errors')
+    tmpInfo['txdropped'] = brInfo.get('stats64').get('tx').get('dropped')
+    tmpInfo['txcarrier_errors'] = brInfo.get('stats64').get('tx').get('carrier_errors')
+    tmpInfo['txcollosions'] = brInfo.get('stats64').get('tx').get('collisions')
+
+    tmpStatus = []
+    for members in brStatus:
+        if members.get('master') == brInfo.get('ifname'):
+            allowed_vlans, native_vlan = _get_bridge_vlan_data(members['ifname'])
+            tmpStatus.append({'interface': members.get('ifname'),
+                                'state': members.get('state').capitalize(),
+                                'mtu': members.get('mtu'),
+                                'pathcost': members.get('cost'),
+                                'bpduguard': "Enabled" if members.get('guard') == True else "Disabled",
+                                'rootguard': "Enabled" if members.get('root_block') == True else "Disabled",
+                                'mac_learning': "Enabled" if members.get('learning') == True else "Disabled",
+                                'neigh_suppress': "Enabled" if members.get('neigh_suppress') == True else "Disabled",
+                                'vlan_tunnel': "Enabled" if members.get('vlan_tunnel') == True else "Disabled",
+                                'isolated': "Enabled" if members.get('isolated') == True else "Disabled",
+                                **({'allowed_vlans': allowed_vlans} if allowed_vlans else {}),
+                                **({'native_vlan': native_vlan} if native_vlan else {})})
+
+    tmpInfo['members'] = tmpStatus
+    return tmpInfo
+
+def show_stp(raw: bool, ifname: typing.Optional[str], detail: bool):
+    rawList = []
+    rawDict = {'stp': []}
+
+    if ifname:
+        if not interface_exists(ifname):
+            raise vyos.opmode.Error(f"{ifname} does not exist!")
+    else:
+        ifname = ""
+
+    bridgeInfo = json.loads(cmd(f"ip -j -d -s link show type bridge {ifname}"))
+
+    if not bridgeInfo:
+        raise vyos.opmode.Error(f"No Bridges configured!")
+
+    bridgeStatus = json.loads(cmd(f"bridge -j -s -d link show"))
+
+    for bridges in bridgeInfo:
+        output_list = []
+        amRoot = ""
+        bridgeDict = _get_stp_data(ifname, bridges, bridgeStatus)
+
+        if bridgeDict['bridge_id'][1] == bridgeDict['root_id'][1]:
+            amRoot = " (This bridge is the root)"
+
+        print('-' * 80)
+        print(f"Bridge interface {bridgeDict['bridge_name']} ({bridgeDict['up_state']}):\n")
+        print(f"Spanning Tree is {bridgeDict['stp_state']}")
+        print(f"Bridge ID {bridgeDict['bridge_id'][1]}, Priority {int(bridgeDict['bridge_id'][0], 16)}")
+        print(f"Root ID {bridgeDict['root_id'][1]}, Priority {int(bridgeDict['root_id'][0], 16)}{amRoot}")
+        print(f"VLANs {bridgeDict['vlan_filtering'].capitalize()}, Protocol {bridgeDict['vlan_protocol']}")
+        print()
+
+        for members in bridgeDict['members']:
+            output_list.append([members['interface'],
+                              members['state'],
+                              *([members['pathcost']] if detail else []),
+                              members['bpduguard'],
+                              members['rootguard'],
+                              members['mac_learning'],
+                              *([members['neigh_suppress']] if detail else []),
+                              *([members['vlan_tunnel']] if detail else []),
+                              *([members['isolated']] if detail else []),
+                              *([members['allowed_vlans']] if detail else []),
+                              *([members['native_vlan']] if detail else [])])
+
+        if raw:
+            rawList.append(bridgeDict)
+        elif detail:
+            headers = ['Interface', 'State', 'Pathcost', 'BPDU_Guard', 'Root_Guard', 'Learning', 'Neighbor_Suppression', 'Q-in-Q', 'Port_Isolation', 'Allowed VLANs', 'Native VLAN']
+            detailed_output(output_list, headers)
+        else:
+            headers = ['Interface', 'State', 'BPDU_Guard', 'Root_Guard', 'Learning']
+            print(tabulate(output_list, headers))
+            print()
+
+    if raw:
+        rawDict['stp'] = rawList
+        return rawDict
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/system.py b/src/op_mode/system.py
index 854b4b699..6d0815a4a 100755
--- a/src/op_mode/system.py
+++ b/src/op_mode/system.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/tcpdump.py b/src/op_mode/tcpdump.py
index 607b59603..fcdb23a81 100644
--- a/src/op_mode/tcpdump.py
+++ b/src/op_mode/tcpdump.py
@@ -1,6 +1,6 @@
 #! /usr/bin/env python3
 
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/tech_support.py b/src/op_mode/tech_support.py
index 24ac0af1b..6055cbf15 100644
--- a/src/op_mode/tech_support.py
+++ b/src/op_mode/tech_support.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -20,6 +20,7 @@ import json
 import vyos.opmode
 
 from vyos.utils.process import cmd
+from vyos.base import Warning
 
 def _get_version_data():
     from vyos.version import get_version_data
@@ -51,7 +52,12 @@ def _get_storage():
 def _get_devices():
     devices = {}
     devices["pci"] = cmd("lspci")
-    devices["usb"] = cmd("lsusb")
+
+    try:
+        devices["usb"] = cmd("lsusb")
+    except OSError:
+        Warning("Could not retrieve information about USB devices")
+        devices["usb"] = {}
 
     return devices
 
diff --git a/src/op_mode/toggle_help_binding.sh b/src/op_mode/toggle_help_binding.sh
index a8708f3da..7c8bc05ce 100755
--- a/src/op_mode/toggle_help_binding.sh
+++ b/src/op_mode/toggle_help_binding.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (C) 2019 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/traceroute.py b/src/op_mode/traceroute.py
index d2bac3f7c..cc19464e2 100755
--- a/src/op_mode/traceroute.py
+++ b/src/op_mode/traceroute.py
@@ -1,6 +1,6 @@
 #! /usr/bin/env python3
 
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/update_suricata.sh b/src/op_mode/update_suricata.sh
new file mode 100755
index 000000000..6e4e605f4
--- /dev/null
+++ b/src/op_mode/update_suricata.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if test -f /run/suricata/suricata.yaml; then
+  suricata-update --suricata-conf /run/suricata/suricata.yaml;
+  systemctl restart suricata;
+else
+  echo "Service Suricata not configured";
+fi
diff --git a/src/op_mode/uptime.py b/src/op_mode/uptime.py
index 1c1a149ec..90475cb50 100755
--- a/src/op_mode/uptime.py
+++ b/src/op_mode/uptime.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
diff --git a/src/op_mode/version.py b/src/op_mode/version.py
index 71a40dd50..b93e3081b 100755
--- a/src/op_mode/version.py
+++ b/src/op_mode/version.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2016-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/vpn_ike_sa.py b/src/op_mode/vpn_ike_sa.py
index 9385bcd0c..0cd192174 100755
--- a/src/op_mode/vpn_ike_sa.py
+++ b/src/op_mode/vpn_ike_sa.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/vpn_ipsec.py b/src/op_mode/vpn_ipsec.py
index ef89e605f..3d7049a14 100755
--- a/src/op_mode/vpn_ipsec.py
+++ b/src/op_mode/vpn_ipsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,13 +23,13 @@ SWANCTL_CONF = '/etc/swanctl/swanctl.conf'
 
 
 def get_peer_connections(peer, tunnel, return_all = False):
-    search = rf'^[\s]*(peer_{peer}_(tunnel_[\d]+|vti)).*'
+    search = rf'^[\s]*({peer}-(tunnel-[\d]+|vti))[\s]*{{'
     matches = []
     with open(SWANCTL_CONF, 'r') as f:
         for line in f.readlines():
             result = re.match(search, line)
             if result:
-                suffix = f'tunnel_{tunnel}' if tunnel.isnumeric() else tunnel
+                suffix = f'tunnel-{tunnel}' if tunnel.isnumeric() else tunnel
                 if return_all or (result[2] == suffix):
                     matches.append(result[1])
     return matches
@@ -66,7 +66,8 @@ def debug_peer(peer, tunnel):
         return
 
     for conn in conns:
-        call(f'/usr/sbin/ipsec statusall | grep {conn}')
+        command = f'/usr/sbin/ipsec statusall | grep {conn}'
+        call(command)
 
 
 if __name__ == '__main__':
diff --git a/src/op_mode/vpp_acl.py b/src/op_mode/vpp_acl.py
new file mode 100644
index 000000000..ed9b35ef6
--- /dev/null
+++ b/src/op_mode/vpp_acl.py
@@ -0,0 +1,342 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import json
+import sys
+import typing
+from tabulate import tabulate
+
+import vyos.opmode
+from vyos.config import Config
+from vyos.configquery import ConfigTreeQuery
+
+from vyos.vpp import VPPControl
+
+
+NO_ACL_INDEX = 0xFFFFFFFF
+
+# ACL action flags
+action_map = {
+    0: 'deny',
+    1: 'permit',
+    2: 'permit-reflect',
+}
+
+# TCP flag names to bit values
+TCP_FLAGS = {
+    'FIN': 0x01,
+    'SYN': 0x02,
+    'RST': 0x04,
+    'PSH': 0x08,
+    'ACK': 0x10,
+    'URG': 0x20,
+    'ECN': 0x40,
+    'CWR': 0x80,
+}
+
+
+def _verify(target):
+    """Decorator checks if config for VPP NAT CGNAT exists"""
+    from functools import wraps
+
+    if target not in ['ip', 'macip', 'no_target']:
+        raise ValueError('Invalid target')
+
+    def _verify_target(func):
+        @wraps(func)
+        def _wrapper(*args, **kwargs):
+            config = ConfigTreeQuery()
+            path = 'vpp acl'
+            if target == 'ip':
+                path += ' ip'
+            elif target == 'macip':
+                path += ' macip'
+            if not config.exists(path):
+                raise vyos.opmode.UnconfiguredSubsystem(f'"{path}" is not configured')
+            return func(*args, **kwargs)
+
+        return _wrapper
+
+    return _verify_target
+
+
+def _get_acl_tag_by_index(vpp, acl_index):
+    acl = vpp.api.acl_dump(acl_index=acl_index)
+    if acl:
+        return acl[0].tag
+
+    return None
+
+
+def _get_macip_acl_tag_by_index(vpp, acl_index):
+    acl = vpp.api.macip_acl_dump(acl_index=acl_index)
+    if acl:
+        return acl[0].tag
+
+    return None
+
+
+def _get_tcp_flag_states(value, mask):
+    set_flags = []
+    unset_flags = []
+    for flag, bit in TCP_FLAGS.items():
+        if mask & bit:  # This flag is being checked
+            if value & bit:
+                set_flags.append(flag)
+            else:
+                unset_flags.append(flag)
+    return sorted(set_flags), sorted(unset_flags)
+
+
+def _get_raw_output_acls(data_dump):
+    out = []
+    for data in data_dump:
+        rules = [json.loads(json.dumps(d._asdict(), default=str)) for d in data.r]
+        out.append(
+            {
+                'acl_index': data.acl_index,
+                'tag': data.tag,
+                'count': data.count,
+                'r': rules,
+            }
+        )
+    return out
+
+
+def _get_raw_output_interfaces(data_dump):
+    ifaces_list = []
+    for iface in data_dump:
+        if iface.count != 0:
+            ifaces_list.append(json.loads(json.dumps(iface._asdict(), default=str)))
+    return ifaces_list
+
+
+def _get_formatted_output_interfaces(vpp, interfaces):
+    data_entries = []
+    for interface in interfaces:
+        name = vpp.get_interface_name(interface.get('sw_if_index'))
+        input_acls = []
+        for acl_index in interface.get('acls')[: interface.get('n_input')]:
+            input_acls.append(_get_acl_tag_by_index(vpp, int(acl_index)))
+        output_acls = []
+        for acl_index in interface.get('acls')[interface.get('n_input') :]:
+            output_acls.append(_get_acl_tag_by_index(vpp, int(acl_index)))
+        values = [
+            name,
+            '\n'.join(input_acls),
+            '\n'.join(output_acls),
+        ]
+        data_entries.append(values)
+
+    headers = ['Interface', 'Input ACLs', 'Output ACLs']
+    return tabulate(data_entries, headers=headers, tablefmt='simple')
+
+
+def _get_formatted_output_macip_interfaces(vpp, interfaces):
+    data_entries = []
+    for interface in interfaces:
+        name = vpp.get_interface_name(interface.get('sw_if_index'))
+        acl = _get_macip_acl_tag_by_index(vpp, int(interface.get('acls')[0]))
+        data_entries.append([name, acl])
+
+    headers = ['Interface', 'ACL']
+    return tabulate(data_entries, headers=headers, tablefmt='simple')
+
+
+def _get_formatted_output_acls(acls_list):
+    conf = Config()
+
+    for acl in acls_list:
+        acl_index = acl.get('acl_index')
+        tag = acl.get('tag')
+        rules = acl.get('r')
+        print(
+            '\n---------------------------------\n'
+            f'IP ACL "tag-name {tag}" acl_index {acl_index}\n'
+        )
+
+        path = ['vpp', 'acl', 'ip', 'tag-name', tag, 'rule']
+        conf_rules = conf.list_nodes(path)
+        data_entries = []
+        for rule_index, rule in enumerate(rules):
+            srcport_first = str(rule.get('srcport_or_icmptype_first'))
+            srcport_last = str(rule.get('srcport_or_icmptype_last'))
+            dstport_first = str(rule.get('dstport_or_icmpcode_first'))
+            dstport_last = str(rule.get('dstport_or_icmpcode_last'))
+            set_flags, unset_flags = _get_tcp_flag_states(
+                rule.get('tcp_flags_value'), rule.get('tcp_flags_mask')
+            )
+
+            values = [
+                conf_rules[rule_index],
+                action_map.get(rule.get('is_permit')),
+                rule.get('src_prefix'),
+                (
+                    f'{srcport_first}-{srcport_last}'
+                    if srcport_first != srcport_last
+                    else srcport_first
+                ),
+                rule.get('dst_prefix'),
+                (
+                    f'{dstport_first}-{dstport_last}'
+                    if dstport_first != dstport_last
+                    else dstport_first
+                ),
+                rule.get('proto'),
+                '\n'.join(set_flags),
+                '\n'.join(unset_flags),
+            ]
+            data_entries.append(values)
+
+        headers = [
+            'Rule',
+            'Action',
+            'Src prefix',
+            'Src port',
+            'Dst prefix',
+            'Dst port',
+            'Proto',
+            'TCP flags set',
+            'TCP flags not set',
+        ]
+        print(tabulate(data_entries, headers=headers, tablefmt='simple'))
+        print('\n')
+
+
+def _get_formatted_output_macip_acls(acls_list):
+    conf = Config()
+
+    for acl in acls_list:
+        acl_index = acl.get('acl_index')
+        tag = acl.get('tag')
+        rules = acl.get('r')
+        print(
+            '\n---------------------------------\n'
+            f'MACIP ACL "tag-name {tag}" acl_index {acl_index}\n'
+        )
+
+        path = ['vpp', 'acl', 'macip', 'tag-name', tag, 'rule']
+        conf_rules = conf.list_nodes(path)
+        data_entries = []
+        for rule_index, rule in enumerate(rules):
+            values = [
+                conf_rules[rule_index],
+                action_map.get(rule.get('is_permit')),
+                rule.get('src_prefix'),
+                rule.get('src_mac'),
+                rule.get('src_mac_mask'),
+            ]
+            data_entries.append(values)
+
+        headers = [
+            'Rule',
+            'Action',
+            'IP prefix',
+            'MAC address',
+            'MAC mask',
+        ]
+        print(tabulate(data_entries, headers=headers, tablefmt='simple'))
+        print('\n')
+
+
+def _find_acl_by_tag(acls, tag_name):
+    return [acl for acl in acls if acl['tag'] == tag_name]
+
+
+@_verify('ip')
+def show_ip_acls(raw: bool, tag_name: typing.Optional[str]):
+    vpp = VPPControl()
+    acls_dump = vpp.api.acl_dump(acl_index=NO_ACL_INDEX)
+    acls: list[dict] = _get_raw_output_acls(acls_dump)
+
+    if tag_name:
+        acls = _find_acl_by_tag(acls, tag_name)
+
+    if raw:
+        return acls
+
+    else:
+        return _get_formatted_output_acls(acls)
+
+
+@_verify('macip')
+def show_macip_acls(raw: bool, tag_name: typing.Optional[str]):
+    vpp = VPPControl()
+    acls_dump = vpp.api.macip_acl_dump(acl_index=NO_ACL_INDEX)
+    acls: list[dict] = _get_raw_output_acls(acls_dump)
+
+    if tag_name:
+        acls = _find_acl_by_tag(acls, tag_name)
+
+    if raw:
+        return acls
+
+    else:
+        return _get_formatted_output_macip_acls(acls)
+
+
+@_verify('ip')
+def show_interfaces(raw: bool):
+    vpp = VPPControl()
+    interfaces_dump = vpp.api.acl_interface_list_dump()
+    interfaces: list[dict] = _get_raw_output_interfaces(interfaces_dump)
+
+    if raw:
+        return interfaces
+
+    else:
+        return _get_formatted_output_interfaces(vpp, interfaces)
+
+
+@_verify('macip')
+def show_macip_interfaces(raw: bool):
+    vpp = VPPControl()
+    interfaces_dump = vpp.api.macip_acl_interface_list_dump()
+    interfaces: list[dict] = _get_raw_output_interfaces(interfaces_dump)
+
+    if raw:
+        return interfaces
+
+    else:
+        return _get_formatted_output_macip_interfaces(vpp, interfaces)
+
+
+@_verify('no_target')
+def show_all_acls(raw: bool):
+    conf = Config()
+    acls_all = {}
+    path = ['vpp', 'acl']
+    if conf.exists(path + ['ip']):
+        ip_acls = show_ip_acls(raw, tag_name=None)
+        acls_all['ip'] = ip_acls
+    if conf.exists(path + ['macip']):
+        macip_acls = show_macip_acls(raw, tag_name=None)
+        acls_all['macip'] = macip_acls
+
+    if raw:
+        return acls_all
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/vpp_nat_cgnat.py b/src/op_mode/vpp_nat_cgnat.py
new file mode 100644
index 000000000..9a7dd2086
--- /dev/null
+++ b/src/op_mode/vpp_nat_cgnat.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import json
+import sys
+from tabulate import tabulate
+
+import vyos.opmode
+from vyos.configquery import ConfigTreeQuery
+
+from vyos.vpp import VPPControl
+
+
+def _verify(func):
+    """Decorator checks if config for VPP NAT CGNAT exists"""
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = ConfigTreeQuery()
+        base = 'vpp nat cgnat'
+        if not config.exists(base):
+            raise vyos.opmode.UnconfiguredSubsystem(f'{base} is not configured')
+
+        return func(*args, **kwargs)
+
+    return _wrapper
+
+
+def _get_raw_output(data_dump):
+    data = [json.loads(json.dumps(d._asdict(), default=str)) for d in data_dump]
+    return data
+
+
+def _get_formatted_output_interfaces(vpp, interfaces):
+    print('CGNAT interfaces:')
+    for interface in interfaces:
+        name = vpp.get_interface_name(interface['sw_if_index'])
+        iface_type = 'in' if interface['is_inside'] else 'out'
+        print(f'  {name} {iface_type}')
+
+
+def _get_formatted_output_mappings(rules_list):
+    data_entries = []
+    for rule in rules_list:
+        in_addr = rule.get('in_addr')
+        in_plen = str(rule.get('in_plen'))
+        out_addr = rule.get('out_addr')
+        out_plen = str(rule.get('out_plen'))
+        sharing_ratio = rule.get('sharing_ratio')
+        ports_per_host = rule.get('ports_per_host')
+        ses_num = rule.get('ses_num')
+
+        values = [
+            f'{in_addr}/{in_plen}',
+            f'{out_addr}/{out_plen}',
+            sharing_ratio,
+            ports_per_host,
+            ses_num,
+        ]
+        data_entries.append(values)
+    headers = [
+        'Inside',
+        'Outside',
+        'Sharing ratio',
+        'Ports per host',
+        'Sessions',
+    ]
+    out = sorted(data_entries, key=lambda x: x[0])
+    return tabulate(out, headers=headers, tablefmt='simple')
+
+
+@_verify
+def show_sessions(raw: bool):
+    vpp = VPPControl()
+    out = vpp.cli_cmd('show det44 sessions').reply
+    out = out.replace('NAT44 deterministic', 'CGNAT')
+    return out
+
+
+@_verify
+def show_mappings(raw: bool):
+    vpp = VPPControl()
+    nat_static_dump = vpp.api.det44_map_dump()
+    rules_list: list[dict] = _get_raw_output(nat_static_dump)
+
+    if raw:
+        return rules_list
+
+    else:
+        return _get_formatted_output_mappings(rules_list)
+
+
+@_verify
+def show_interfaces(raw: bool):
+    vpp = VPPControl()
+    interfaces_dump = vpp.api.det44_interface_dump()
+    interfaces: list[dict] = _get_raw_output(interfaces_dump)
+
+    if raw:
+        return interfaces
+
+    else:
+        return _get_formatted_output_interfaces(vpp, interfaces)
+
+
+@_verify
+def clear_session(address: str, port: str, ext_address: str, ext_port: str):
+    vpp = VPPControl()
+    vpp.api.det44_close_session_in(
+        in_addr=address,
+        in_port=int(port),
+        ext_addr=ext_address,
+        ext_port=int(ext_port),
+    )
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/vrf.py b/src/op_mode/vrf.py
index 51032a4b5..a13b48866 100755
--- a/src/op_mode/vrf.py
+++ b/src/op_mode/vrf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/vrrp.py b/src/op_mode/vrrp.py
index ef1338e23..c8414b03e 100755
--- a/src/op_mode/vrrp.py
+++ b/src/op_mode/vrrp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/webproxy_update_blacklist.sh b/src/op_mode/webproxy_update_blacklist.sh
index 05ea86f9e..90594daf6 100755
--- a/src/op_mode/webproxy_update_blacklist.sh
+++ b/src/op_mode/webproxy_update_blacklist.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/wireguard_client.py b/src/op_mode/wireguard_client.py
index 04d8ce28c..7638d24a0 100755
--- a/src/op_mode/wireguard_client.py
+++ b/src/op_mode/wireguard_client.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/op_mode/zone.py b/src/op_mode/zone.py
index df39549d2..8bdf373a8 100644
--- a/src/op_mode/zone.py
+++ b/src/op_mode/zone.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as