vyos-documentation.git/docs/configuration, branch feature/T9082-codeql-onboard

docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks (#2136)

2026-07-10T15:33:10+00:00

* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks In DMVPN the mGRE tunnel and the IPSec protecting it are handled independently, so GRE can be forwarded while no IPSec SA is active for a peer (e.g. while an SA is still being negotiated or after one expires), allowing unencrypted GRE to leave the router. This is inherent to combining GRE with IPSec and is common to DMVPN implementations in general. Add a "Protecting against unencrypted traffic leaks" section to the DMVPN reference page explaining the behaviour and recommending an output filter rule that drops GRE not matched by an outbound IPSec policy (ipsec match-none-out). Note that this disables unencrypted GRE on the node entirely, so coexisting plain GRE tunnels would stop working. Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes. Co-authored-by: Daniil Baturin * docs(DMVPN): reflow DMVPN documentation for line length compliance Reformat the DMVPN guide and dual-hub dual-cloud example to wrap long lines and improve readability without changing the documented behavior or configuration guidance. --------- Co-authored-by: Daniil Baturin

docs: Update Suricata page to VyOS 1.5 standards (#2118)

2026-07-07T09:23:54+00:00

* docs: Update Suricata page to VyOS 1.5 standards * Update suricata.md * Update suricata.md * Update suricata.md

Merge pull request #2133 from LiudmylaNad/te-ospf-note

2026-07-06T15:13:14+00:00

docs(Traffic Engineering): Clarify OSPF advertisement is not yet supported

2026-07-03T15:50:21+00:00

docs: Add GeoIP ASN support (T5746) (#2124)

2026-07-03T15:35:26+00:00

* docs: Add GeoIP ASN support (T5746) * Small styling changes --------- Co-authored-by: Daniil Baturin

docs: Update UDP broadcast relay page to VyOS 1.5 standards (#2115)

2026-07-01T10:46:01+00:00

* docs: Update UDP broadcast relay page to VyOS 1.5 standards * Remove the implication that something other than IPv4 supports broadcast --------- Co-authored-by: Daniil Baturin

bgp: T6573: add input/output queue limit CLI commands

2026-06-30T13:57:32+00:00

docs: Update TFTP server page to VyOS 1.5 standards (#2119)

2026-06-29T16:13:58+00:00

* docs: Update TFTP server page to VyOS 1.5 standards * Update tftp-server.md

docs: Update Console server page to VyOS 1.5 standards (#2117)

2026-06-29T12:49:50+00:00

* docs: Update Console server page to VyOS 1.5 standards * Minor corrections * Minor corrections * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update console-server.md * Apply suggestions from code review Co-authored-by: Daniil Baturin * Remove the mention of long-EOL'd VyOS 1.3 --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Daniil Baturin

Merge pull request #1865 from alexandr-san4ez/T8540-current

2026-06-23T10:39:53+00:00

pseudo-ethernet: T8540: Add anycast-gateway support for EVPN