Merge pull request #1841 from vyos/yuriy/convert-images-to-webp

perf: convert all images to WebP with PDF fallback

26 files changed, 157 insertions, 76 deletions

diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst
index 4d6561d0..ee865076 100644
--- a/docs/configexamples/ansible.rst
+++ b/docs/configexamples/ansible.rst
@@ -15,7 +15,7 @@ We have four pre-configured routers with this configuration:
 
 Using the general schema for example:
 
-.. image:: /_static/images/ansible.png
+.. image:: /_static/images/ansible.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
index 77f9b118..f2a98479 100644
--- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
@@ -18,7 +18,7 @@ The topology has 3 VyOS routers and one client. Between the DHCP Server and
 the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large
 Network.
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Ansible Example topology image
 
 *************
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp
new file mode 100644
index 00000000..592484cb
--- /dev/null
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
index 2a528852..6092199b 100644
--- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
+++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
@@ -53,7 +53,7 @@ Topology
 
 We use the following network topology in this example:
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: L3VPN EVPN with VyOS topology image
 
 
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp
new file mode 100644
index 00000000..f3218799
--- /dev/null
+++ b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
index 6666399d..acb880d1 100644
--- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
@@ -14,7 +14,7 @@ Topology consists of:
  * VyOS as a OpenVPN Server
  * VyOS as Client
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: OpenVPN with LDAP topology image
 
 Active Directory on Windows server
@@ -39,13 +39,20 @@ Here are some PowerShell commands to quickly add a Test Active Directory.
 Configure VyOS as OpenVPN Server
 ====================================
 
-In this example OpenVPN will be setup with a client certificate and username / password authentication.
+In this example OpenVPN will be setup with a client certificate and
+username / password authentication.
 
-First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed.
-Please look :ref:`here <configuration/pki/index:pki>` for more information.
+First a CA, a signed server and client ceftificate and a
+Diffie-Hellman parameter musst be generated and installed.
+Please look :ref:`here <configuration/pki/index:pki>` for more
+information.
 
 | Add the LDAP plugin configuration file `/config/auth/ldap-auth.config`
-| Check all possible settings `here <https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf>`_
+
+| Check all possible settings `here`_.
+
+.. _here:
+   https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf
 
 .. literalinclude:: _include/ldap-auth.config
    :language: none
@@ -93,7 +100,8 @@ OpenVPN Server configuration can be carried out.
 Client configuration
 ====================
 
-One advantage of having the client certificate stored is the ability to create the client configuration.
+One advantage of having the client certificate stored is the ability to
+create the client configuration.
 
 .. code-block:: none
 
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp
new file mode 100644
index 00000000..13bf2d73
--- /dev/null
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp
diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst
index 1feb03e8..7d7b216a 100644
--- a/docs/configexamples/autotest/Wireguard/Wireguard.rst
+++ b/docs/configexamples/autotest/Wireguard/Wireguard.rst
@@ -17,7 +17,7 @@ Topology
 The topology have a central and a branch VyOS router and one client, to
 test, in each site.
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Ansible Example topology image
 
 *************
diff --git a/docs/configexamples/autotest/Wireguard/_include/topology.webp b/docs/configexamples/autotest/Wireguard/_include/topology.webp
new file mode 100644
index 00000000..3cc5e992
--- /dev/null
+++ b/docs/configexamples/autotest/Wireguard/_include/topology.webp
diff --git a/docs/configexamples/autotest/tunnelbroker/_include/topology.webp b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp
new file mode 100644
index 00000000..c3a812ab
--- /dev/null
+++ b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp
diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
index 370cf9d6..e34cb779 100644
--- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
+++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
@@ -28,7 +28,7 @@ Topology
 The example topology has 2 VyOS routers. One as The WAN Router and on as a
 Client, to test a single LAN setup
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Tunnelbroker topology image
 
 
@@ -64,6 +64,7 @@ Setup the IPv6 default route to the tunnel interface
 
 Now you should be able to ping a public IPv6 Address
 
+.. stop_vyoslinter
 
 .. code-block:: none
 
@@ -73,11 +74,13 @@ Now you should be able to ping a public IPv6 Address
    64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms
    64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms
    64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms
-   
+
    --- 2001:470:20::2 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 2999ms
    rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms
 
+.. start_vyoslinter
+
 
 Assuming the pings are successful, you need to add some DNS servers.
 Some options:
@@ -88,6 +91,7 @@ Some options:
 
 You should now be able to ping something by IPv6 DNS name:
 
+.. stop_vyoslinter
 
 .. code-block:: none
 
@@ -97,11 +101,13 @@ You should now be able to ping something by IPv6 DNS name:
    64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms
    64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms
    64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms
-   
+
    --- tunnelbroker.net ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3002ms
    rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms
 
+.. start_vyoslinter
+
 
 *****************
 LAN Configuration
@@ -151,6 +157,7 @@ This accomplishes a few things:
 
 Now the Client is able to ping a public IPv6 address
 
+.. stop_vyoslinter
 
 .. code-block:: none
 
@@ -160,11 +167,13 @@ Now the Client is able to ping a public IPv6 address
    64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms
    64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms
    64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms
-   
+
    --- 2001:470:20::2 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3005ms
    rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms
 
+.. start_vyoslinter
+
 
 Multiple LAN/DMZ Setup
 ======================
@@ -186,6 +195,8 @@ In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
 
 So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
@@ -200,6 +211,8 @@ So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc:
   set service router-advert interface eth3 name-server '2001:470:20::2'
   set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64
 
+.. start_vyoslinter
+
 Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default,
 'valid-lifetime' and 'preferred-lifetime' are set to default values of
 30 days and 4 hours respectively.
@@ -207,9 +220,11 @@ Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default,
 Firewall
 ========
 
-Finally, don't forget the :ref:`Firewall<configuration/firewall/index:Firewall>`. The usage is identical, except for
-instead of `set firewall ipv4 name NAME`, you would use `set firewall ipv6 name
-NAME`.
+Finally, don't forget the
+:ref:`Firewall<configuration/firewall/index:Firewall>`. The usage is
+identical, except instead of `set firewall ipv4 name NAME`, you would
+use `set firewall ipv6 name NAME`.
 
-Similarly, to attach the firewall, you would use `set firewall ipv6 name NAME rule N inbound-interface name eth0` or `set firewall zone LOCAL from WAN firewall 
-ipv6-name`.
+Similarly, to attach the firewall, you would use
+`set firewall ipv6 name NAME rule N inbound-interface name eth0` or
+`set firewall zone LOCAL from WAN firewall ipv6-name`.
diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst
index 5a789647..a3a4e619 100644
--- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst
+++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst
@@ -6,16 +6,17 @@
 DMVPN Dual HUB Dual Cloud
 #########################
 
-This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3.
+This document is to describe a basic setup to build DVMPN network with
+two Hubs and two clouds using DMVPN Phase3.
 OSPF is used as routing protocol inside DMVPN.
 
-In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1)
-as a Spoke.
+In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2,
+SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke.
 
 Network Topology
 ================
 
-.. image:: /_static/images/dual-hub-DMVPN.png
+.. image:: /_static/images/dual-hub-DMVPN.*
    :width: 80%
    :align: center
    :alt: DMVPN Network Topology
@@ -80,9 +81,12 @@ Spoke-3
 NHRP configuration
 __________________
 
-The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE
-multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub.
-In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud.
+The next step is to configure the NHRP protocol. In a Dual cloud
+network, every HUB has to be configured with one GRE multipoint tunnel
+interface and every spoke has to be configured with two tunnel
+interfaces, one tunnel to each hub.
+In this example tunnel networks are 10.100.100.0/24 for the first cloud
+and 10.100.101.0/24 for the second cloud.
 But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32.
 
 HUB-1
@@ -211,8 +215,10 @@ Spoke-3
 Overlay configuration
 _____________________
 
-The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol.
-But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol.
+The last step is to configure the routing protocol. In this scenario,
+OSPF was chosen as the dynamic routing protocol.
+But you can use iBGP or eBGP. To form fast convergence it is possible
+to use BFD protocol.
 
 
 HUB-1
@@ -378,7 +384,8 @@ SPOKE-1
 Monitoring
 ==========
 
-All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF.
+All spokes created IPSec tunnels to Hubs, are registered on Hubs using
+NHRP protocol and formed adjacency in OSPF.
 
 .. code-block:: none
 
@@ -468,7 +475,8 @@ For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1
      3   *192.168.11.2   3.241 ms (ICMP type:3, code:3, Destination port unreachable)
 
 First trace goes via HUB but the second goes directly from  SPOKE-1 to SPOKE-2.
-Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES.
+Now routing tables are changed. LAN networks 192.168.12.0/24 and
+192.168.11.0/24 available directly via SPOKES.
 
 .. code-block:: none
 
@@ -541,8 +549,11 @@ A new Spoke to Spoke IPSec tunnel is created
 Summary
 =======
 
-If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role.
-This is a simple example where only one internet connection is used. But in the real world, there can be two
-connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection,
-choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level
+If one of the Hubs loses connectivity to the Internet, the other Hub
+will be available and take the main role.
+This is a simple example where only one internet connection is used.
+But in the real world, there can be two connections to the Internet.
+In this case, there is a recommendation to build each tunnel via each
+Internet connection, choose the main cloud, and manipulate traffic via
+a routing protocol. It allows the creation failover on link-level
 connections too.
\ No newline at end of file
diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst
index 992b625e..bd97e1ad 100644
--- a/docs/configexamples/fwall-and-vrf.rst
+++ b/docs/configexamples/fwall-and-vrf.rst
@@ -9,7 +9,7 @@ This example shows how to configure a VyOS router with VRFs and firewall rules.
 
 Diagram used in this example:
 
-.. image:: /_static/images/firewall-and-vrf-blueprints.png
+.. image:: /_static/images/firewall-and-vrf-blueprints.*
     :width: 80%
     :align: center
     :alt: Network Topology Diagram
diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst
index 11c23bf0..1f02da8e 100644
--- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst
+++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst
@@ -16,7 +16,8 @@ where you might need that some network can access other in a different VRF.
 The scope of this document is to cover such cases in a dynamic way without the
 use of MPLS-LDP.
 
-General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter.
+General information about L3VPNs can be found in the
+:ref:`configuration/vrf/index:L3VPN VRFs` chapter.
 
 ********
 Overview
@@ -70,7 +71,7 @@ community(ies) into that prefix.
 ********
 Topology
 ********
-.. image:: /_static/images/inter-vrf-routing-vrf-lite.png
+.. image:: /_static/images/inter-vrf-routing-vrf-lite.*
    :width: 70%
    :align: center
    :alt: Network Topology Diagram
@@ -467,7 +468,7 @@ Now we perform some end-to-end testing
 
 - From Management to Outside (fails as intended)
 
-
+.. stop_vyoslinter
 
 .. code-block:: none
 
@@ -515,6 +516,7 @@ Now we perform some end-to-end testing
    --- 2001:db8:2::1 ping statistics ---
    2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms
 
+.. start_vyoslinter
 
 - LAN1 to Outside
 
@@ -772,6 +774,8 @@ route-map with an prefix-list.
 
 We create a prefix-list first and add all the routes we need to.
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
    # set both ipv4 and ipv6 policies
@@ -795,6 +799,8 @@ We create a prefix-list first and add all the routes we need to.
    set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit'
    set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64'
 
+.. start_vyoslinter
+
 Then add a route-map and reference to above prefix. Consider that the actions
 taken inside the prefix will MATCH the routes that will be affected by the
 actions inside the rules of the route-map.
diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst
index 787c1140..257d98a1 100644
--- a/docs/configexamples/ipsec-cisco-policy-based.rst
+++ b/docs/configexamples/ipsec-cisco-policy-based.rst
@@ -15,7 +15,7 @@ initiator role on VyOS side.
 Network Topology
 ================
 
-.. image:: /_static/images/cisco-vpn-ipsec.png
+.. image:: /_static/images/cisco-vpn-ipsec.*
    :align: center
    :alt: Network Topology Diagram
 
diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst
index f7c3cb08..553c5e2a 100644
--- a/docs/configexamples/ipsec-cisco-route-based.rst
+++ b/docs/configexamples/ipsec-cisco-route-based.rst
@@ -16,7 +16,7 @@ inside the tunnel.
 Network Topology
 ================
 
-.. image:: /_static/images/cisco-vpn-ipsec.png
+.. image:: /_static/images/cisco-vpn-ipsec.*
    :align: center
    :alt: Network Topology Diagram
 
@@ -89,6 +89,8 @@ Configuration
 VyOS
 ----
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  set interfaces ethernet eth0 address '10.0.1.2/30'
@@ -132,9 +134,13 @@ VyOS
  set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
  set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
 
+.. start_vyoslinter
+
 Cisco
 -----
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  crypto isakmp policy 10
@@ -196,6 +202,7 @@ Cisco
  !
  ip route 0.0.0.0 0.0.0.0 10.0.2.1
 
+.. start_vyoslinter
 
 
 Monitoring
@@ -230,6 +237,8 @@ IPsec SAs:
 
 OSPF Neighbor Status:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  vyos@vyos:~$ show ip ospf neighbor
@@ -237,6 +246,8 @@ OSPF Neighbor Status:
  Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
  1.1.1.1           1 Full/-          1h29m37s          39.317s 10.100.100.2    vti1:10.100.100.1                    0     0     0
 
+.. start_vyoslinter
+
 Routing Table:
 
 .. code-block:: none
@@ -268,6 +279,8 @@ Routing Table:
 Monitoring on Cisco side
 ------------------------
 
+.. stop_vyoslinter
+
 IKE SAs:
 
 .. code-block:: none
@@ -378,6 +391,8 @@ Routing Table:
  C        192.168.11.0/24 is directly connected, GigabitEthernet0/2
  L        192.168.11.1/32 is directly connected, GigabitEthernet0/2
 
+.. start_vyoslinter
+
 
 Checking Connectivity
 ---------------------
diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst
index b6f6f3a7..96349d98 100644
--- a/docs/configexamples/ipsec-pa-route-based.rst
+++ b/docs/configexamples/ipsec-pa-route-based.rst
@@ -17,7 +17,7 @@ include firewall configuration.
 Network Topology
 ================
 
-.. image:: /_static/images/ipsec-vyos-pa.png
+.. image:: /_static/images/ipsec-vyos-pa.*
    :align: center
    :alt: Network Topology Diagram
 
@@ -88,6 +88,8 @@ Configuration
 VyOS
 ----
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  set interfaces ethernet eth0 address '10.0.1.2/30'
@@ -131,42 +133,46 @@ VyOS
  set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
  set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
 
+.. start_vyoslinter
+
 Palo Alto
 ---------
 
+.. stop_vyoslinter
+
 GUI Configuration:
  Network -> Network Profiles -> IKE Crypto
 
- .. image:: /_static/images/PA-IKE-group.png
+ .. image:: /_static/images/PA-IKE-group.*
    :align: center
 
  Network -> Network Profiles -> IKE Gateways
 
- .. image:: /_static/images/PA-IKE-GW-1.png
+ .. image:: /_static/images/PA-IKE-GW-1.*
    :align: center
 
- .. image:: /_static/images/PA-IKE-GW-2.png
+ .. image:: /_static/images/PA-IKE-GW-2.*
    :align: center
 
  Network -> Network Profiles -> IPSec Crypto
 
- .. image:: /_static/images/PA-ESP-group.png
+ .. image:: /_static/images/PA-ESP-group.*
    :align: center
 
  Network -> Interfaces
 
- .. image:: /_static/images/PA-tunnel-1.png
+ .. image:: /_static/images/PA-tunnel-1.*
    :align: center
 
- .. image:: /_static/images/PA-tunnel-2.png
+ .. image:: /_static/images/PA-tunnel-2.*
    :align: center
 
- .. image:: /_static/images/PA-tunnel-3.png
+ .. image:: /_static/images/PA-tunnel-3.*
    :align: center
 
  Network -> IPSec Tunnels
 
- .. image:: /_static/images/PA-IPsec-tunnel.png
+ .. image:: /_static/images/PA-IPsec-tunnel.*
    :align: center
 
 CLI configuration with OSPF:
@@ -225,6 +231,8 @@ CLI configuration with OSPF:
  set network virtual-router default protocol ospf router-id 1.1.1.1
  set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ]
 
+.. start_vyoslinter
+
 
 Monitoring
 ==========
@@ -260,6 +268,8 @@ IPsec SAs:
 
 OSPF Neighbor Status:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  vyos@vyos:~$ show ip ospf neighbor
@@ -267,6 +277,8 @@ OSPF Neighbor Status:
  Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
  1.1.1.1           1 Full/-          23m56s            37.948s 10.100.100.2    vti1:10.100.100.1                    0     0     0
 
+.. start_vyoslinter
+
 
 Routing Table:
 
@@ -337,6 +349,8 @@ IPsec SAs:
 
 OSPF Neighbor Status:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  admin@PA-VM> show routing protocol ospf neighbor
@@ -361,6 +375,8 @@ OSPF Neighbor Status:
    restart helper time remaining: 0
    restart helper exit reason:    none
 
+.. start_vyoslinter
+
 
 
 Routing Table:
diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst
index c05b9a3f..90a036d8 100644
--- a/docs/configexamples/l3vpn-hub-and-spoke.rst
+++ b/docs/configexamples/l3vpn-hub-and-spoke.rst
@@ -54,7 +54,7 @@ General information can be found in the
 ********
 Topology
 ********
-.. image:: /_static/images/L3VPN_hub_and_spoke.png
+.. image:: /_static/images/L3VPN_hub_and_spoke.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst
index 8443ddff..5f344d54 100644
--- a/docs/configexamples/lac-lns.rst
+++ b/docs/configexamples/lac-lns.rst
@@ -20,7 +20,7 @@ All users with domain **vyos.io** will be tunneled to LNS via L2TP.
 Network Topology
 ================
 
-.. image:: /_static/images/lac-lns-diagram.jpg
+.. image:: /_static/images/lac-lns-diagram.*
    :width: 60%
    :align: center
    :alt: Network Topology Diagram
@@ -79,6 +79,8 @@ LAC
 LNS
 ---
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
     set interfaces ethernet eth0 address '192.168.139.100/24'
@@ -96,8 +98,11 @@ LNS
     set vpn l2tp remote-access name-server '8.8.8.8'
     set vpn l2tp remote-access ppp-options disable-ccp
 
+.. start_vyoslinter
+
 .. note:: This setup requires the Compression Control Protocol (CCP)
-          being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp``
+          being disabled, the command
+          ``set vpn l2tp remote-access ppp-options disable-ccp``
           accomplishes that.
 
 Client
@@ -105,7 +110,7 @@ Client
 
 In this lab we use Windows PPPoE client.
 
-.. image:: /_static/images/lac-lns-winclient.jpg
+.. image:: /_static/images/lac-lns-winclient.*
    :width: 100%
    :align: center
    :alt: Window PPPoE Client Configuration
diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst
index 318e9a91..8945a9f4 100644
--- a/docs/configexamples/nmp.rst
+++ b/docs/configexamples/nmp.rst
@@ -33,37 +33,37 @@ Configuration 'NMP'
 
 Next, you just  should follow the pictures:
 
-.. image:: /_static/images/nmp1.png
+.. image:: /_static/images/nmp1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp2.png
+.. image:: /_static/images/nmp2.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp3.png
+.. image:: /_static/images/nmp3.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp4.png
+.. image:: /_static/images/nmp4.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp5.png
+.. image:: /_static/images/nmp5.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp6.png
+.. image:: /_static/images/nmp6.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp7.png
+.. image:: /_static/images/nmp7.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst
index 5d98e944..dcf59af9 100644
--- a/docs/configexamples/policy-based-ipsec-and-firewall.rst
+++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst
@@ -41,7 +41,7 @@ This configuration example and the requirements consists of:
     - Allow connections from LANs to LANs through the tunnel.
 
 
-.. image:: /_static/images/policy-based-ipsec-and-firewall.png
+.. image:: /_static/images/policy-based-ipsec-and-firewall.*
 
 
 Configuration
diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst
index ad588def..cc14451c 100644
--- a/docs/configexamples/pppoe-ipv6-basic.rst
+++ b/docs/configexamples/pppoe-ipv6-basic.rst
@@ -17,7 +17,7 @@ please contact your ISP for more information.
 Network Topology
 ================
 
-.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg
+.. image:: /_static/images/pppoe-ipv6-pd-diagram.*
    :width: 60%
    :align: center
    :alt: Network Topology Diagram
@@ -51,8 +51,13 @@ delegation (PD).
    set interfaces pppoe pppoe0 ipv6 address autoconf
    set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100'
 
+.. stop_vyoslinter
+
 * Here we use the prefix to configure the address of eth1 (LAN) to form
   ``<prefix>::64``, where ``64`` is hexadecimal of address 100.
+
+.. start_vyoslinter
+
 * For home network users, most of time ISP only provides /64 prefix, hence
   there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface`
   for more information.
diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst
index 268163df..96448dd4 100644
--- a/docs/configexamples/qos.rst
+++ b/docs/configexamples/qos.rst
@@ -18,7 +18,7 @@ first.
 
 Using the general schema for example:
 
-.. image:: /_static/images/qos1.png
+.. image:: /_static/images/qos1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -79,21 +79,21 @@ Main rules:
 
 Check the result
 
-.. image:: /_static/images/qos2.png
+.. image:: /_static/images/qos2.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 Before the interface eth0 on router VyOS3
 
-.. image:: /_static/images/qos3.png
+.. image:: /_static/images/qos3.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 After the interface eth0 on router VyOS3
 
-.. image:: /_static/images/qos4.png
+.. image:: /_static/images/qos4.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -120,7 +120,7 @@ default class and class for changing all labels from CS0 to CS4
 Next on the router VyOS2 we will change labels on all incoming
 traffic only from CS4-> CS6
 
-.. image:: /_static/images/qos5.png
+.. image:: /_static/images/qos5.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -143,28 +143,28 @@ traffic only from CS4-> CS6
     set qos policy shaper vyos2 default queue-type 'fair-queue'
         set qos interface eth2 egress 'vyos2'
 
-.. image:: /_static/images/qos6.png
+.. image:: /_static/images/qos6.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS0 
 
-.. image:: /_static/images/qos7.png
+.. image:: /_static/images/qos7.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS0 - > CS4
 
-.. image:: /_static/images/qos8.png
+.. image:: /_static/images/qos8.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS4 - > CS5
 
-.. image:: /_static/images/qos9.png
+.. image:: /_static/images/qos9.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -192,7 +192,7 @@ Set up bandwidth limits on the eth2 interface of the router “VyOS2”.
 
 Check the result.
 
-.. image:: /_static/images/qos10.png
+.. image:: /_static/images/qos10.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst
index d9bc439b..86cbec26 100644
--- a/docs/configexamples/segment-routing-isis.rst
+++ b/docs/configexamples/segment-routing-isis.rst
@@ -11,7 +11,7 @@ blue print as an initial setup to get MPLS ISIS-SR working between those two
 devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual
 Environment NG)`.
 
-.. figure:: /_static/images/vyos-sr-isis.png
+.. figure:: /_static/images/vyos-sr-isis.*
    :alt: ISIS-SR network
 
    ISIS-SR example network
diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst
index 38490616..d03d4ed9 100644
--- a/docs/configexamples/wan-load-balancing.rst
+++ b/docs/configexamples/wan-load-balancing.rst
@@ -14,7 +14,7 @@ Example 1: Distributing load evenly
 
 The setup used in this example is shown in the following diagram:
 
-.. image:: /_static/images/Wan_load_balancing1.png
+.. image:: /_static/images/Wan_load_balancing1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -159,7 +159,7 @@ Example 5: Exclude traffic from load balancing
 In this example two LAN interfaces exist in different subnets instead
 of one like in the previous examples:
 
-.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
+.. image:: /_static/images/Wan_load_balancing_exclude1.*                      
    :width: 80%                                                          
    :align: center                                                       
    :alt: Network Topology Diagram 
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst
index 0c1c2617..7ea33b95 100644
--- a/docs/configexamples/zone-policy.rst
+++ b/docs/configexamples/zone-policy.rst
@@ -40,7 +40,7 @@ adapted for however many NICs you have**:
 * DMZ cannot access LAN resources.
 * Inbound WAN connect to DMZ host.
 
-.. image:: /_static/images/zone-policy-diagram.png
+.. image:: /_static/images/zone-policy-diagram.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram