vyos-documentation.git/docs/configuration/firewall, branch T9456-container-kernel-overlayfs

docs: T9157: document firewall fib-type match (#2186)

2026-09-25T13:37:27+00:00

* docs: T9157: document firewall fib-type match Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6. * docs: T9157: update fib match docs for fib-type -> fib type rename Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token. * docs: T9157: add prerouting raw fib type reference, fix backtick style CodeRabbit feedback on #2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly. * docs: T9157: update fib docs for rule-level lookup/match split Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.

firewall/groups: document include option and remote-group interval (#2241)

2026-09-15T09:59:52+00:00

* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".

firewall: T9076: document remote-group update interval (#2148)

2026-09-11T11:42:42+00:00

* firewall: T9076: document remote-group update interval Document the new 'set firewall group remote-group interval' command: per-group update interval from 60 seconds to 4 weeks, given as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back to the global resolver-interval when unset. Co-Authored-By: Claude Fable 5 * firewall: T9076: note URL quoting and log redaction for remote-group Warn that remote-group URLs with query strings must be quoted (unquoted '&' silently truncates the value; literal '?' may need Ctrl-V, see T9077) and that vyos-domain-resolver logs redact the query string on download failures (T8829). Co-Authored-By: Claude Fable 5 * firewall: T9076: note that remote-group interval suffixes may be combined Address review feedback: document that s/m/h/d/w units can be stacked (e.g. 1h30m), matching human_to_seconds and the CLI regex. --------- Co-authored-by: Claude Fable 5

docs: update flowtable and ethernet/bonding documentation (#2106)

2026-07-20T09:38:55+00:00

* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

docs: Add GeoIP ASN support (T5746) (#2124)

2026-07-03T15:35:26+00:00

* docs: Add GeoIP ASN support (T5746) * Small styling changes --------- Co-authored-by: Daniil Baturin

chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/

2026-05-10T14:19:31+00:00

The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio (#1899/#1900/#1901) landed in May 2026. The mechanism's surface area (scripts/swap_sources.py, its 245-line test, RTD pre/post hooks, Makefile glue, conf.py dynamic loader) is dead weight, and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Changes: - Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns; Context7 excludes it via excludeFolders. - Strip swap_sources.py invocation from docs/Makefile (swap/restore targets, : swap deps, trap chains). - Strip jobs: pre_build/post_build block from .readthedocs.yml. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update context7.json: add docs/_rst_legacy to excludeFolders; fix stale "Branch current tracks…" rule to "Branch rolling tracks…" (default branch was renamed 2026-05-10). - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test; describe _rst_legacy as archive only. Verified: sphinx-build -b html with --keep-going produces identical warning set (68 unique), identical sitemap entry count (257), identical llms.txt entry count (22), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)

feat: flip swap mechanism — MD as primary, RST as override (Phase 1)

2026-05-06T17:42:32+00:00

This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io

docs: fix typos and a few grammar issues (ported from #1852 RST → MyST)

2026-05-06T13:18:03+00:00

Ports the typo/grammar sweep originally captured in PR #1852 from .rst files to their .md equivalents, plus the eventhandler grammar fix that Copilot flagged in #1852's review (which the RST PR explicitly skipped as scope-stretch). Sources: - 73 typo/grammar substitutions from PR #1852 (rebased from #1801) - "Using environments is more preferable" → "Using environment variables is preferable" (Copilot review comment on #1852) #1852 itself is being discarded since it targets RST and we are phasing out the RST tree in favor of MyST. The 4 RST-linter line-wrap comments and 1 RST section-underline comment from Copilot's #1852 review are RST-specific and do not apply to .md. 🤖 Generated by [robots](https://vyos.io)

docs: address review feedback from PR #1857

2026-05-06T13:18:03+00:00

Fix conversion artifacts, typos, grammar errors, and technical inaccuracies flagged by automated code review (Copilot + CodeRabbit). Infrastructure: add root-level md-*.md exclusion to conf.py, fix sphinx-autobuild ignore globs in Makefile. Content: fix curly quotes, invalid Go panic() calls, shell quoting in cURL examples, incorrect firewall command paths, typos across 22 documentation files, remove duplicate sections. 🤖 Generated by [robots](https://vyos.io)

refactor(swap): rename imported .md files to md- prefix for swap mechanism

2026-05-06T13:18:03+00:00

Restore the canary file naming convention that swap_sources.py expects: the imported MyST pages now live as docs//md-.md alongside the existing docs//.rst, so swap_sources.py --swap can rename them into place at build time. - 254 .md files renamed (every page with a matching .rst counterpart) - 2 MyST-only pages left at their final names (no .rst exists, no swap needed): docs/copyright.md, docs/automation/terraform/terraformvyos.md All 114 stems listed in docs/_swap.txt now have a corresponding md-.md source file ready to swap in. 🤖 Generated by [robots](https://vyos.io)