routing: split routing protocols into individual files

9 files changed, 413 insertions, 438 deletions

diff --git a/docs/index.rst b/docs/index.rst
index 7b416d34..7e27b0cc 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -20,7 +20,7 @@ as a router and firewall platform for cloud deployments.
     quick-start.rst
     configuration-overview.rst
     interfaces/index.rst
-    routing.rst
+    routing/index.rst
     firewall.rst
     nat.rst
     vpn/index.rst
diff --git a/docs/routing.rst b/docs/routing.rst
deleted file mode 100644
index 217847d6..00000000
--- a/docs/routing.rst
+++ /dev/null
@@ -1,437 +0,0 @@
-.. _routing:
-
-Routing
-=======
-
-VyOS is a "router first" network operating system. It supports static routing,
-policy routing, and dynamic routing using standard protocols (RIP, OSPF, and
-BGP).
-
-Static
-------
-
-Static routes are manually configured network routes.
-
-A typical use for a static route is a static default route for systems that do
-not make use of DHCP or dynamic routing protocols:
-
-.. code-block:: sh
-
-  set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 distance '1'
-
-Another common use of static routes is to blackhole (drop) traffic. In the
-example below, RFC 1918 private IP networks are set as blackhole routes. This
-does not prevent networks within these segments from being used, since the
-most specific route is always used. It does, however, prevent traffic to
-unknown private networks from leaving the router. Commonly refereed to as
-leaking.
-
-.. code-block:: sh
-
-  set protocols static route 10.0.0.0/8 blackhole distance '254'
-  set protocols static route 172.16.0.0/12 blackhole distance '254'
-  set protocols static route 192.168.0.0/16 blackhole distance '254'
-
-.. note:: Routes with a distance of 255 are effectively disabled and not
-   installed into the kernel.
-
-RIP
----
-
-Simple RIP configuration using 2 nodes and redistributing connected interfaces.
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set interfaces loopback address 10.1.1.1/32
-  set protocols rip network 192.168.0.0/24
-  set protocols rip redistribute connected
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set interfaces loopback address 10.2.2.2/32
-  set protocols rip network 192.168.0.0/24
-  set protocols rip redistribute connected
-
-
-.. _routing-ospf:
-
-OSPF
-----
-
-IPv4
-^^^^
-
-A typical configuration using 2 nodes, redistribute loopback address and the
-node 1 sending the default route:
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set interfaces loopback lo address 10.1.1.1/32
-  set protocols ospf area 0 network 192.168.0.0/24
-  set protocols ospf default-information originate always
-  set protocols ospf default-information originate metric 10
-  set protocols ospf default-information originate metric-type 2
-  set protocols ospf log-adjacency-changes
-  set protocols ospf parameters router-id 10.1.1.1
-  set protocols ospf redistribute connected metric-type 2
-  set protocols ospf redistribute connected route-map CONNECT
-
-  set policy route-map CONNECT rule 10 action permit
-  set policy route-map CONNECT rule 10 match interface lo
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set interfaces loopback lo address 10.2.2.2/32
-  set protocols ospf area 0 network 192.168.0.0/24
-  set protocols ospf log-adjacency-changes
-  set protocols ospf parameters router-id 10.2.2.2
-  set protocols ospf redistribute connected metric-type 2
-  set protocols ospf redistribute connected route-map CONNECT
-
-  set policy route-map CONNECT rule 10 action permit
-  set policy route-map CONNECT rule 10 match interface lo
-
-IPv6
-^^^^
-
-A typical configuration using 2 nodes.
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set protocols ospfv3 area 0.0.0.0 interface eth1
-  set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
-  set protocols ospfv3 parameters router-id 192.168.1.1
-  set protocols ospfv3 redistribute connected
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set protocols ospfv3 area 0.0.0.0 interface eth1
-  set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
-  set protocols ospfv3 parameters router-id 192.168.2.1
-  set protocols ospfv3 redistribute connected
-
-.. _routing-bgp:
-
-BGP
----
-
-IPv4
-^^^^
-
-A simple eBGP configuration:
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set protocols bgp 65534 neighbor 192.168.0.2 ebgp-multihop '2'
-  set protocols bgp 65534 neighbor 192.168.0.2 remote-as '65535'
-  set protocols bgp 65534 neighbor 192.168.0.2 update-source '192.168.0.1'
-  set protocols bgp 65534 address-family ipv4-unicast network '172.16.0.0/16'
-  set protocols bgp 65534 parameters router-id '192.168.0.1'
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set protocols bgp 65535 neighbor 192.168.0.1 ebgp-multihop '2'
-  set protocols bgp 65535 neighbor 192.168.0.1 remote-as '65534'
-  set protocols bgp 65535 neighbor 192.168.0.1 update-source '192.168.0.2'
-  set protocols bgp 65535 address-family ipv4-unicast network '172.17.0.0/16'
-  set protocols bgp 65535 parameters router-id '192.168.0.2'
-
-
-Don't forget, the CIDR declared in the network statement MUST **exist in your
-routing table (dynamic or static), the best way to make sure that is true is
-creating a static route:**
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set protocols static route 1.0.0.0/16 blackhole distance '254'
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set protocols static route 2.0.0.0/16 blackhole distance '254'
-
-
-IPv6
-^^^^
-
-A simple BGP configuration via IPv6.
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set protocols bgp 65534 neighbor 2001:db8::2 ebgp-multihop '2'
-  set protocols bgp 65534 neighbor 2001:db8::2 remote-as '65535'
-  set protocols bgp 65534 neighbor 2001:db8::2 update-source '2001:db8::1'
-  set protocols bgp 65534 neighbor 2001:db8::2 address-family ipv6-unicast
-  set protocols bgp 65534 address-family ipv6-unicast network '2001:db8:1::/48'
-  set protocols bgp 65534 parameters router-id '10.1.1.1'
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set protocols bgp 65535 neighbor 2001:db8::1 ebgp-multihop '2'
-  set protocols bgp 65535 neighbor 2001:db8::1 remote-as '65534'
-  set protocols bgp 65535 neighbor 2001:db8::1 update-source '2001:db8::2'
-  set protocols bgp 65535 neighbor 2001:db8::1 address-family ipv6-unicast
-  set protocols bgp 65535 address-family ipv6-unicast network '2001:db8:2::/48'
-  set protocols bgp 65535 parameters router-id '10.1.1.2'
-
-Don't forget, the CIDR declared in the network statement **MUST exist in your
-routing table (dynamic or static), the best way to make sure that is true is
-creating a static route:**
-
-**Node 1:**
-
-.. code-block:: sh
-
-  set protocols static route6 2a001:100:1::/48 blackhole distance '254'
-
-**Node 2:**
-
-.. code-block:: sh
-
-  set protocols static route6 2001:db8:2::/48 blackhole distance '254'
-
-Route Filter
-^^^^^^^^^^^^
-
-Route filter can be applied using a route-map:
-
-**Node1:**
-
-.. code-block:: sh
-
-  set policy prefix-list AS65535-IN rule 10 action 'permit'
-  set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
-  set policy prefix-list AS65535-OUT rule 10 action 'deny'
-  set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
-  set policy prefix-list6 AS65535-IN rule 10 action 'permit'
-  set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
-  set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
-  set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
-  set policy route-map AS65535-IN rule 10 action 'permit'
-  set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
-  set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
-  set policy route-map AS65535-IN rule 20 action 'deny'
-  set policy route-map AS65535-OUT rule 10 action 'deny'
-  set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
-  set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
-  set policy route-map AS65535-OUT rule 20 action 'permit'
-  set protocols bgp 65534 neighbor 2001:db8::2 route-map export 'AS65535-OUT'
-  set protocols bgp 65534 neighbor 2001:db8::2 route-map import 'AS65535-IN'
-
-**Node2:**
-
-.. code-block:: sh
-
-  set policy prefix-list AS65534-IN rule 10 action 'permit'
-  set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
-  set policy prefix-list AS65534-OUT rule 10 action 'deny'
-  set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
-  set policy prefix-list6 AS65534-IN rule 10 action 'permit'
-  set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
-  set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
-  set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
-  set policy route-map AS65534-IN rule 10 action 'permit'
-  set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
-  set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
-  set policy route-map AS65534-IN rule 20 action 'deny'
-  set policy route-map AS65534-OUT rule 10 action 'deny'
-  set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
-  set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
-  set policy route-map AS65534-OUT rule 20 action 'permit'
-  set protocols bgp 65535 neighbor 2001:db8::1 route-map export 'AS65534-OUT'
-  set protocols bgp 65535 neighbor 2001:db8::1 route-map import 'AS65534-IN'
-
-We could expand on this and also deny link local and multicast in the rule 20
-action deny.
-
-
-ARP
----
-
-To manipulate or display ARP_ table entries, the following commands are implemented.
-
-adding a static arp entry
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: sh
-
-  set protocols static arp 10.1.1.100 hwaddr 08:00:27:de:23:aa
-  commit
-
-display arp table entries
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: sh
-
-  show protocols static arp
-
-  Address                  HWtype  HWaddress           Flags Mask            Iface
-  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
-  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
-
-.. code-block:: sh
-
-  show protocols static arp interface eth1
-  Address                  HWtype  HWaddress           Flags Mask            Iface
-  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
-  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
-
-
-Policy-Based Routing (PBR)
---------------------------
-
-VyOS supports Policy Routing, allowing traffic to be assigned to a different
-routing table. Traffic can be matched using standard 5-tuple matching (source
-address, destination address, protocol, source port, destination port).
-
-Transparent Proxy
-^^^^^^^^^^^^^^^^^
-
-The following example will show how VyOS can be used to redirect web traffic to
-an external transparent proxy:
-
-.. code-block:: sh
-
-  set policy route FILTER-WEB rule 1000 destination port 80
-  set policy route FILTER-WEB rule 1000 protocol tcp
-  set policy route FILTER-WEB rule 1000 set table 100
-
-This creates a route policy called FILTER-WEB with one rule to set the routing
-table for matching traffic (TCP port 80) to table ID 100 instead of the
-default routing table.
-
-To create routing table 100 and add a new default gateway to be used by
-traffic matching our route policy:
-
-.. code-block:: sh
-
-  set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2
-
-This can be confirmed using the show ip route table 100 operational command.
-
-Finally, to apply the policy route to ingress traffic on our LAN interface,
-we use:
-
-.. code-block:: sh
-
-  set interfaces ethernet eth1 policy route FILTER-WEB
-
-
-Multiple Uplinks
-^^^^^^^^^^^^^^^^
-
-VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and
-forwarding the traffic using different routing tables.
-
-Routing tables that will be used in this example are:
-
-* ``table 10`` Routing tabled used for VLAN 10 (192.168.188.0/24)
-* ``table 11`` Routing tabled used for VLAN 11 (192.168.189.0/24)
-* ``main`` Routing table used by VyOS and other interfaces not paritipating in PBR
-
-.. figure:: _static/images/pbr_example_1.png
-   :scale: 80 %
-   :alt: PBR multiple uplinks
-
-   Policy-Based Routing with multiple ISP uplinks (source ./draw.io/pbr_example_1.drawio)
-
-Add default routes for routing ``table 10`` and ``table 11``
-
-.. code-block:: sh
-
-  set protocols static table 10 route 0.0.0.0/0 next-hop 192.0.1.1
-  set protocols static table 11 route 0.0.0.0/0 next-hop 192.0.2.2
-
-Add policy route matching VLAN source addresses
-
-.. code-block:: sh
-
-  set policy route PBR rule 20 set table '10'
-  set policy route PBR rule 20 description 'Route VLAN10 traffic to table 10'
-  set policy route PBR rule 20 source address '192.168.188.0/24'
-
-  set policy route PBR rule 20 set table '11'
-  set policy route PBR rule 20 description 'Route VLAN11 traffic to table 11'
-  set policy route PBR rule 20 source address '192.168.189.0/24'
-
-Apply routing policy to **inbound** direction of out VLAN interfaces
-
-.. code-block:: sh
-
-  set interfaces ethernet eth0 vif 10 policy route 'PBR'
-  set interfaces ethernet eth0 vif 11 policy route 'PBR'
-
-
-**OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR
-
-.. code-block:: sh
-
-  set policy route PBR rule 10 description 'VLAN10 <-> VLAN11 shortcut'
-  set policy route PBR rule 10 destination address '192.168.188.0/24'
-  set policy route PBR rule 10 destination address '192.168.189.0/24'
-  set policy route PBR rule 10 set table 'main'
-
-.. note:: Allows the VLAN10 and VLAN20 hosts to communicate with each other using the
-   main routing table.
-
-MSS Clamping
-============
-
-As Internet wide PMTU discovery rarely works we sometimes need to clamp our TCP
-MSS value to a specific value. Starting with VyOS 1.2 there is a firewall option
-to clamp your TCP MSS value for IPv4 and IPv6.
-
-Clamping can be disabled per interface using the `disable` keywork:
-
-.. code-block:: sh
-
-  set firewall options interface pppoe0 disable
-
-IPv4
-----
-
-Clamp outgoing MSS value in a TCP SYN packet to `1452` for `pppoe0` and `1372`
-for your WireGuard `wg02` tunnel.
-
-.. code-block:: sh
-
-  set firewall options interface pppoe0 adjust-mss '1452'
-  set firewall options interface wg02 adjust-mss '1372'
-
-IPv6
-----
-
-Clamp outgoing MSS value in a TCP SYN packet to `1280` for both `pppoe0` and
-`wg02` interface.
-
-To achieve the same for IPv6 please use:
-
-.. code-block:: sh
-
-  set firewall options interface pppoe0 adjust-mss6 '1280'
-  set firewall options interface wg02 adjust-mss6 '1280'
-
-.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol
diff --git a/docs/routing/arp.rst b/docs/routing/arp.rst
new file mode 100644
index 00000000..ceceebf9
--- /dev/null
+++ b/docs/routing/arp.rst
@@ -0,0 +1,34 @@
+.. _routing-arp:
+
+ARP
+---
+
+To manipulate or display ARP_ table entries, the following commands are implemented.
+
+adding a static arp entry
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: sh
+
+  set protocols static arp 10.1.1.100 hwaddr 08:00:27:de:23:aa
+  commit
+
+display arp table entries
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: sh
+
+  show protocols static arp
+
+  Address                  HWtype  HWaddress           Flags Mask            Iface
+  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
+  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
+
+.. code-block:: sh
+
+  show protocols static arp interface eth1
+  Address                  HWtype  HWaddress           Flags Mask            Iface
+  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
+  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
+
+.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol
diff --git a/docs/routing/bgp.rst b/docs/routing/bgp.rst
new file mode 100644
index 00000000..f4281140
--- /dev/null
+++ b/docs/routing/bgp.rst
@@ -0,0 +1,144 @@
+.. _routing-bgp:
+
+BGP
+---
+
+IPv4
+^^^^
+
+A simple eBGP configuration:
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set protocols bgp 65534 neighbor 192.168.0.2 ebgp-multihop '2'
+  set protocols bgp 65534 neighbor 192.168.0.2 remote-as '65535'
+  set protocols bgp 65534 neighbor 192.168.0.2 update-source '192.168.0.1'
+  set protocols bgp 65534 address-family ipv4-unicast network '172.16.0.0/16'
+  set protocols bgp 65534 parameters router-id '192.168.0.1'
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set protocols bgp 65535 neighbor 192.168.0.1 ebgp-multihop '2'
+  set protocols bgp 65535 neighbor 192.168.0.1 remote-as '65534'
+  set protocols bgp 65535 neighbor 192.168.0.1 update-source '192.168.0.2'
+  set protocols bgp 65535 address-family ipv4-unicast network '172.17.0.0/16'
+  set protocols bgp 65535 parameters router-id '192.168.0.2'
+
+
+Don't forget, the CIDR declared in the network statement MUST **exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set protocols static route 1.0.0.0/16 blackhole distance '254'
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set protocols static route 2.0.0.0/16 blackhole distance '254'
+
+
+IPv6
+^^^^
+
+A simple BGP configuration via IPv6.
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set protocols bgp 65534 neighbor 2001:db8::2 ebgp-multihop '2'
+  set protocols bgp 65534 neighbor 2001:db8::2 remote-as '65535'
+  set protocols bgp 65534 neighbor 2001:db8::2 update-source '2001:db8::1'
+  set protocols bgp 65534 neighbor 2001:db8::2 address-family ipv6-unicast
+  set protocols bgp 65534 address-family ipv6-unicast network '2001:db8:1::/48'
+  set protocols bgp 65534 parameters router-id '10.1.1.1'
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set protocols bgp 65535 neighbor 2001:db8::1 ebgp-multihop '2'
+  set protocols bgp 65535 neighbor 2001:db8::1 remote-as '65534'
+  set protocols bgp 65535 neighbor 2001:db8::1 update-source '2001:db8::2'
+  set protocols bgp 65535 neighbor 2001:db8::1 address-family ipv6-unicast
+  set protocols bgp 65535 address-family ipv6-unicast network '2001:db8:2::/48'
+  set protocols bgp 65535 parameters router-id '10.1.1.2'
+
+Don't forget, the CIDR declared in the network statement **MUST exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set protocols static route6 2a001:100:1::/48 blackhole distance '254'
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set protocols static route6 2001:db8:2::/48 blackhole distance '254'
+
+Route Filter
+^^^^^^^^^^^^
+
+Route filter can be applied using a route-map:
+
+**Node1:**
+
+.. code-block:: sh
+
+  set policy prefix-list AS65535-IN rule 10 action 'permit'
+  set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
+  set policy prefix-list AS65535-OUT rule 10 action 'deny'
+  set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
+  set policy prefix-list6 AS65535-IN rule 10 action 'permit'
+  set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
+  set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
+  set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
+  set policy route-map AS65535-IN rule 10 action 'permit'
+  set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
+  set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
+  set policy route-map AS65535-IN rule 20 action 'deny'
+  set policy route-map AS65535-OUT rule 10 action 'deny'
+  set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
+  set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
+  set policy route-map AS65535-OUT rule 20 action 'permit'
+  set protocols bgp 65534 neighbor 2001:db8::2 route-map export 'AS65535-OUT'
+  set protocols bgp 65534 neighbor 2001:db8::2 route-map import 'AS65535-IN'
+
+**Node2:**
+
+.. code-block:: sh
+
+  set policy prefix-list AS65534-IN rule 10 action 'permit'
+  set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
+  set policy prefix-list AS65534-OUT rule 10 action 'deny'
+  set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
+  set policy prefix-list6 AS65534-IN rule 10 action 'permit'
+  set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
+  set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
+  set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
+  set policy route-map AS65534-IN rule 10 action 'permit'
+  set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
+  set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
+  set policy route-map AS65534-IN rule 20 action 'deny'
+  set policy route-map AS65534-OUT rule 10 action 'deny'
+  set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
+  set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
+  set policy route-map AS65534-OUT rule 20 action 'permit'
+  set protocols bgp 65535 neighbor 2001:db8::1 route-map export 'AS65534-OUT'
+  set protocols bgp 65535 neighbor 2001:db8::1 route-map import 'AS65534-IN'
+
+We could expand on this and also deny link local and multicast in the rule 20
+action deny.
diff --git a/docs/routing/index.rst b/docs/routing/index.rst
new file mode 100644
index 00000000..cdf313ac
--- /dev/null
+++ b/docs/routing/index.rst
@@ -0,0 +1,20 @@
+.. _routing:
+
+Routing
+=======
+
+VyOS is a "router first" network operating system. It supports static routing,
+policy routing, and dynamic routing using standard protocols (RIP, OSPF, and
+BGP).
+
+.. toctree::
+   :maxdepth: 2
+   :hidden:
+
+   arp
+   bgp
+   ospf
+   pbr
+   rip
+   static
+
diff --git a/docs/routing/ospf.rst b/docs/routing/ospf.rst
new file mode 100644
index 00000000..1a55dc16
--- /dev/null
+++ b/docs/routing/ospf.rst
@@ -0,0 +1,65 @@
+.. _routing-ospf:
+
+OSPF
+----
+
+IPv4
+^^^^
+
+A typical configuration using 2 nodes, redistribute loopback address and the
+node 1 sending the default route:
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set interfaces loopback lo address 10.1.1.1/32
+  set protocols ospf area 0 network 192.168.0.0/24
+  set protocols ospf default-information originate always
+  set protocols ospf default-information originate metric 10
+  set protocols ospf default-information originate metric-type 2
+  set protocols ospf log-adjacency-changes
+  set protocols ospf parameters router-id 10.1.1.1
+  set protocols ospf redistribute connected metric-type 2
+  set protocols ospf redistribute connected route-map CONNECT
+
+  set policy route-map CONNECT rule 10 action permit
+  set policy route-map CONNECT rule 10 match interface lo
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set interfaces loopback lo address 10.2.2.2/32
+  set protocols ospf area 0 network 192.168.0.0/24
+  set protocols ospf log-adjacency-changes
+  set protocols ospf parameters router-id 10.2.2.2
+  set protocols ospf redistribute connected metric-type 2
+  set protocols ospf redistribute connected route-map CONNECT
+
+  set policy route-map CONNECT rule 10 action permit
+  set policy route-map CONNECT rule 10 match interface lo
+
+IPv6
+^^^^
+
+A typical configuration using 2 nodes.
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set protocols ospfv3 area 0.0.0.0 interface eth1
+  set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
+  set protocols ospfv3 parameters router-id 192.168.1.1
+  set protocols ospfv3 redistribute connected
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set protocols ospfv3 area 0.0.0.0 interface eth1
+  set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
+  set protocols ospfv3 parameters router-id 192.168.2.1
+  set protocols ospfv3 redistribute connected
+
diff --git a/docs/routing/pbr.rst b/docs/routing/pbr.rst
new file mode 100644
index 00000000..a8ee9e87
--- /dev/null
+++ b/docs/routing/pbr.rst
@@ -0,0 +1,98 @@
+.. _routing-pbr:
+
+Policy-Based Routing (PBR)
+--------------------------
+
+VyOS supports Policy Routing, allowing traffic to be assigned to a different
+routing table. Traffic can be matched using standard 5-tuple matching (source
+address, destination address, protocol, source port, destination port).
+
+Transparent Proxy
+^^^^^^^^^^^^^^^^^
+
+The following example will show how VyOS can be used to redirect web traffic to
+an external transparent proxy:
+
+.. code-block:: sh
+
+  set policy route FILTER-WEB rule 1000 destination port 80
+  set policy route FILTER-WEB rule 1000 protocol tcp
+  set policy route FILTER-WEB rule 1000 set table 100
+
+This creates a route policy called FILTER-WEB with one rule to set the routing
+table for matching traffic (TCP port 80) to table ID 100 instead of the
+default routing table.
+
+To create routing table 100 and add a new default gateway to be used by
+traffic matching our route policy:
+
+.. code-block:: sh
+
+  set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2
+
+This can be confirmed using the show ip route table 100 operational command.
+
+Finally, to apply the policy route to ingress traffic on our LAN interface,
+we use:
+
+.. code-block:: sh
+
+  set interfaces ethernet eth1 policy route FILTER-WEB
+
+
+Multiple Uplinks
+^^^^^^^^^^^^^^^^
+
+VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and
+forwarding the traffic using different routing tables.
+
+Routing tables that will be used in this example are:
+
+* ``table 10`` Routing tabled used for VLAN 10 (192.168.188.0/24)
+* ``table 11`` Routing tabled used for VLAN 11 (192.168.189.0/24)
+* ``main`` Routing table used by VyOS and other interfaces not paritipating in PBR
+
+.. figure:: ../_static/images/pbr_example_1.png
+   :scale: 80 %
+   :alt: PBR multiple uplinks
+
+   Policy-Based Routing with multiple ISP uplinks (source ./draw.io/pbr_example_1.drawio)
+
+Add default routes for routing ``table 10`` and ``table 11``
+
+.. code-block:: sh
+
+  set protocols static table 10 route 0.0.0.0/0 next-hop 192.0.1.1
+  set protocols static table 11 route 0.0.0.0/0 next-hop 192.0.2.2
+
+Add policy route matching VLAN source addresses
+
+.. code-block:: sh
+
+  set policy route PBR rule 20 set table '10'
+  set policy route PBR rule 20 description 'Route VLAN10 traffic to table 10'
+  set policy route PBR rule 20 source address '192.168.188.0/24'
+
+  set policy route PBR rule 20 set table '11'
+  set policy route PBR rule 20 description 'Route VLAN11 traffic to table 11'
+  set policy route PBR rule 20 source address '192.168.189.0/24'
+
+Apply routing policy to **inbound** direction of out VLAN interfaces
+
+.. code-block:: sh
+
+  set interfaces ethernet eth0 vif 10 policy route 'PBR'
+  set interfaces ethernet eth0 vif 11 policy route 'PBR'
+
+
+**OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR
+
+.. code-block:: sh
+
+  set policy route PBR rule 10 description 'VLAN10 <-> VLAN11 shortcut'
+  set policy route PBR rule 10 destination address '192.168.188.0/24'
+  set policy route PBR rule 10 destination address '192.168.189.0/24'
+  set policy route PBR rule 10 set table 'main'
+
+.. note:: Allows the VLAN10 and VLAN20 hosts to communicate with each other using the
+   main routing table.
diff --git a/docs/routing/rip.rst b/docs/routing/rip.rst
new file mode 100644
index 00000000..237106f6
--- /dev/null
+++ b/docs/routing/rip.rst
@@ -0,0 +1,22 @@
+.. _routing-rip:
+
+RIP
+---
+
+Simple RIP configuration using 2 nodes and redistributing connected interfaces.
+
+**Node 1:**
+
+.. code-block:: sh
+
+  set interfaces loopback address 10.1.1.1/32
+  set protocols rip network 192.168.0.0/24
+  set protocols rip redistribute connected
+
+**Node 2:**
+
+.. code-block:: sh
+
+  set interfaces loopback address 10.2.2.2/32
+  set protocols rip network 192.168.0.0/24
+  set protocols rip redistribute connected
diff --git a/docs/routing/static.rst b/docs/routing/static.rst
new file mode 100644
index 00000000..e1f96c31
--- /dev/null
+++ b/docs/routing/static.rst
@@ -0,0 +1,29 @@
+.. _routing-static:
+
+Static
+------
+
+Static routes are manually configured network routes.
+
+A typical use for a static route is a static default route for systems that do
+not make use of DHCP or dynamic routing protocols:
+
+.. code-block:: sh
+
+  set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 distance '1'
+
+Another common use of static routes is to blackhole (drop) traffic. In the
+example below, RFC 1918 private IP networks are set as blackhole routes. This
+does not prevent networks within these segments from being used, since the
+most specific route is always used. It does, however, prevent traffic to
+unknown private networks from leaving the router. Commonly refereed to as
+leaking.
+
+.. code-block:: sh
+
+  set protocols static route 10.0.0.0/8 blackhole distance '254'
+  set protocols static route 172.16.0.0/12 blackhole distance '254'
+  set protocols static route 192.168.0.0/16 blackhole distance '254'
+
+.. note:: Routes with a distance of 255 are effectively disabled and not
+   installed into the kernel.