vyos-documentation.git/docs/configuration/firewall, branch test/ai-validation-e2e-v1.1.0

Merge pull request #2356 from LiudmylaNad/revise-groups

2026-10-22T17:54:06+00:00

docs: Update Firewall groups page to VyOS 1.5 standards

Clarify the new workaround with quotes

2026-10-22T15:06:24+00:00

Add a modal verb to clarify the usage of groups

2026-10-22T15:05:51+00:00

docs: Update Firewall global options page to VyOS 1.5 standards (#2347)

2026-10-22T13:58:03+00:00

* docs: Update Firewall global options page to VyOS 1.5 standards * Update global-options.md

docs: Update Firewall page to VyOS 1.5 standards (#2338)

2026-10-22T13:38:20+00:00

* docs: Update Firewall page to VyOS 1.5 standards * Apply suggestion from @github-actions[bot] Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update index.md --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update groups.md

2026-10-19T21:31:09+00:00

docs: Update Firewall groups page to VyOS 1.5 standards

2026-10-19T21:04:57+00:00

docs: T8887: backfill Phase 1 commands from recent vyos-1x additions (#2134)

2026-10-13T12:40:47+00:00

* docs: T8887: backfill Phase 1 commands from recent vyos-1x additions Documents six CLI features added to vyos-1x between Nov 2025 and May 2026 that were missing from the docs (gap-audit T8886, Phase 1 / T8887): - policy route-map match source-peer (vyos-1x#5149, T8588) - high-availability vrrp snmp trap (vyos-1x#5108, T8448) - protocols segment-routing traffic-engineering subtree (vyos-1x#4994, T6750) - protocols bgp bmp target monitor pre-policy/post-policy/local-rib (vyos-1x#4922, T8133) - firewall global-options geoip provider/maxmind-* (vyos-1x#4949, T7926/T8049) - vpn ipsec childless IKE SA option (vyos-1x#4930, T8136) system frr watchfrr-timeout and service router-advert prefix base-interface are now documented on rolling via the page rewrites in vyos-documentation#2251 and vyos-documentation#2132. protocols bgp parameters as-notation is deferred: rolling carries it commented out; to be handled in a follow-up. 🤖 Generated by [robots](https://vyos.io) * docs: T8887: wrap pre-existing overlong lines in touched files - route-map, ipsec_general: wrap five pre-existing overlong lines so the doc linter (which scans whole modified files) passes on touched files 🤖 Generated by [robots](https://vyos.io) * docs: T8887: document BMP prerequisites and mandatory target address - state that set system frr bmp needs a commit plus a router reboot (or FRR restart) before BMP targets can be committed (protocols_bgp.py verify) - add target address (mandatory) and port (default 5000) commands and include the address in the example 🤖 Generated by [robots](https://vyos.io) * docs: T8887: state SR-TE segment-list commit requirements Per protocols_segment-routing.py verify(): a segment list needs at least one index; each index needs an MPLS label or a NAI; an adjacency NAI needs both source- and destination-identifier; a prefix identifier needs an algorithm; IS-IS/OSPF import, adjacency/prefix, IPv4/IPv6 and spf/strict-spf are mutually exclusive. Add a complete example. 🤖 Generated by [robots](https://vyos.io) * docs: T8887: escape placeholders in GeoIP and childless cfgcmd headers 🤖 Generated by [robots](https://vyos.io) * Apply suggestions from Liydmyla Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com> --------- Co-authored-by: Daniil Baturin Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>

docs: T9157: document firewall fib-type match (#2186)

2026-09-25T13:37:27+00:00

* docs: T9157: document firewall fib-type match Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6. * docs: T9157: update fib match docs for fib-type -> fib type rename Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token. * docs: T9157: add prerouting raw fib type reference, fix backtick style CodeRabbit feedback on #2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly. * docs: T9157: update fib docs for rule-level lookup/match split Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.

firewall/groups: document include option and remote-group interval (#2241)

2026-09-15T09:59:52+00:00

* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".