docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks (#2136) (#2144)

2026-08-04T10:15:07+00:00

* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks In DMVPN the mGRE tunnel and the IPSec protecting it are handled independently, so GRE can be forwarded while no IPSec SA is active for a peer (e.g. while an SA is still being negotiated or after one expires), allowing unencrypted GRE to leave the router. This is inherent to combining GRE with IPSec and is common to DMVPN implementations in general. Add a "Protecting against unencrypted traffic leaks" section to the DMVPN reference page explaining the behaviour and recommending an output filter rule that drops GRE not matched by an outbound IPSec policy (ipsec match-none-out). Note that this disables unencrypted GRE on the node entirely, so coexisting plain GRE tunnels would stop working. Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes. * docs(DMVPN): reflow DMVPN documentation for line length compliance Reformat the DMVPN guide and dual-hub dual-cloud example to wrap long lines and improve readability without changing the documented behavior or configuration guidance. --------- (cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b) Co-authored-by: zdc Co-authored-by: Daniil Baturin

feat: flip swap mechanism on circinus — MD as primary, RST as override

2026-05-06T18:08:17+00:00

Mirror of #1899 for circinus. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 253 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 253 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py rewritten with inverted rename direction (rst-.rst → .rst when applying overrides; .md excluded via _md_exclude.txt) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py rewritten for new semantics Identical change set to #1899 (current). Per-branch differences: - circinus has 253 stems vs current's 254 (suricata is current-only) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io

vyos-documentation.git/docs/configuration/vpn/dmvpn.md, branch circinus

docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks (#2136) (#2144)

feat: flip swap mechanism on circinus — MD as primary, RST as override