vyos-documentation.git/docs/configuration/firewall, branch docs/t8887-phase1-batch1

Apply suggestions from Liydmyla

2026-10-13T12:09:51+00:00

Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>

docs: T8887: escape placeholders in GeoIP and childless cfgcmd headers

2026-10-03T14:44:36+00:00

🤖 Generated by [robots](https://vyos.io)

docs: T8887: backfill Phase 1 commands from recent vyos-1x additions

2026-10-03T12:43:02+00:00

Documents six CLI features added to vyos-1x between Nov 2025 and May 2026 that were missing from the docs (gap-audit T8886, Phase 1 / T8887): - policy route-map match source-peer (vyos-1x#5149, T8588) - high-availability vrrp snmp trap (vyos-1x#5108, T8448) - protocols segment-routing traffic-engineering subtree (vyos-1x#4994, T6750) - protocols bgp bmp target monitor pre-policy/post-policy/local-rib (vyos-1x#4922, T8133) - firewall global-options geoip provider/maxmind-* (vyos-1x#4949, T7926/T8049) - vpn ipsec childless IKE SA option (vyos-1x#4930, T8136) system frr watchfrr-timeout and service router-advert prefix base-interface are now documented on rolling via the page rewrites in vyos-documentation#2251 and vyos-documentation#2132. protocols bgp parameters as-notation is deferred: rolling carries it commented out; to be handled in a follow-up. 🤖 Generated by [robots](https://vyos.io)

docs: T9157: document firewall fib-type match (#2186)

2026-09-25T13:37:27+00:00

* docs: T9157: document firewall fib-type match Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6. * docs: T9157: update fib match docs for fib-type -> fib type rename Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token. * docs: T9157: add prerouting raw fib type reference, fix backtick style CodeRabbit feedback on #2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly. * docs: T9157: update fib docs for rule-level lookup/match split Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.

firewall/groups: document include option and remote-group interval (#2241)

2026-09-15T09:59:52+00:00

* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".

firewall: T9076: document remote-group update interval (#2148)

2026-09-11T11:42:42+00:00

* firewall: T9076: document remote-group update interval Document the new 'set firewall group remote-group interval' command: per-group update interval from 60 seconds to 4 weeks, given as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back to the global resolver-interval when unset. Co-Authored-By: Claude Fable 5 * firewall: T9076: note URL quoting and log redaction for remote-group Warn that remote-group URLs with query strings must be quoted (unquoted '&' silently truncates the value; literal '?' may need Ctrl-V, see T9077) and that vyos-domain-resolver logs redact the query string on download failures (T8829). Co-Authored-By: Claude Fable 5 * firewall: T9076: note that remote-group interval suffixes may be combined Address review feedback: document that s/m/h/d/w units can be stacked (e.g. 1h30m), matching human_to_seconds and the CLI regex. --------- Co-authored-by: Claude Fable 5

docs: update flowtable and ethernet/bonding documentation (#2106)

2026-07-20T09:38:55+00:00

* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

docs: Add GeoIP ASN support (T5746) (#2124)

2026-07-03T15:35:26+00:00

* docs: Add GeoIP ASN support (T5746) * Small styling changes --------- Co-authored-by: Daniil Baturin

chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/

2026-05-10T14:19:31+00:00

The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio (#1899/#1900/#1901) landed in May 2026. The mechanism's surface area (scripts/swap_sources.py, its 245-line test, RTD pre/post hooks, Makefile glue, conf.py dynamic loader) is dead weight, and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Changes: - Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns; Context7 excludes it via excludeFolders. - Strip swap_sources.py invocation from docs/Makefile (swap/restore targets, : swap deps, trap chains). - Strip jobs: pre_build/post_build block from .readthedocs.yml. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update context7.json: add docs/_rst_legacy to excludeFolders; fix stale "Branch current tracks…" rule to "Branch rolling tracks…" (default branch was renamed 2026-05-10). - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test; describe _rst_legacy as archive only. Verified: sphinx-build -b html with --keep-going produces identical warning set (68 unique), identical sitemap entry count (257), identical llms.txt entry count (22), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)

feat: flip swap mechanism — MD as primary, RST as override (Phase 1)

2026-05-06T17:42:32+00:00

This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io