Revert "Add incremental RST-to-MyST swap mechanism (circinus) (#1867)" (#1893)

This reverts commit 5eb383a10ec92c65eed525bc174785a6852e997f.
author: Daniil Baturin <daniil@vyos.io> 2026-05-06 14:08:35 +0100
committer: GitHub <noreply@github.com> 2026-05-06 14:08:35 +0100
commit: 9d0341379184622b3da2e7e05aeeceed4bbf83e9 (patch)
tree: 3c881338b1f6e0ec369a138e4c53772fcbaa8253 /docs/configuration/firewall
parent: 5eb383a10ec92c65eed525bc174785a6852e997f (diff)
download: vyos-documentation-9d0341379184622b3da2e7e05aeeceed4bbf83e9.tar.gz
vyos-documentation-9d0341379184622b3da2e7e05aeeceed4bbf83e9.zip
8 files changed, 0 insertions, 6529 deletions
diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md
deleted file mode 100644
index 3ed30f78..00000000
--- a/docs/configuration/firewall/md-bridge.md
+++ /dev/null
@@ -1,868 +0,0 @@
----
-lastproofread: '2026-03-28'
----
-
-(firewall-configuration)=
-
-# Bridge Firewall Configuration
-
-## Overview
-
-Learn more about bridge firewall configuration
-and related op-mode commands.
-
-The following commands are covered in this section:
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge <options>
-```
-
-From the main structure defined in
-{doc}`Firewall Overview</configuration/firewall/index>`
-in this section you can find detailed information only for the next part
-of the general structure:
-
-```none
-- set firewall
-    * bridge
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-         - prerouting
-            + filter
-         - name
-            + custom_name
-```
-
-Traffic that is received by the router on an interface that is a member of a
-bridge is processed on the **Bridge Layer**. Before the bridge decision is
-made, all packets are analyzed at **Prerouting**. First filters can be applied
-here, and also rules for ignoring connection tracking system can be configured.
-The relevant configuration that acts in **prerouting** is:
-
-> - `set firewall bridge prerouting filter ...`.
-
-For traffic that needs to be switched internally by the bridge, the base
-chain is **forward**, and its base command for filtering is `set firewall
-bridge forward filter ...`, which happens in stage 4, highlighted with red
-color.
-
-:::{figure} /_static/images/firewall-bridge-forward.webp
-:::
-
-For traffic destined to the router itself or that needs to be routed
-(assuming a layer3 bridge is configured), the base chain is **input**, and the
-base command is `set firewall bridge input filter ...` and the path is:
-
-:::{figure} /_static/images/firewall-bridge-input.webp
-:::
-
-If it's not dropped, then the packet is sent to **IP Layer**, and will be
-processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again
-the {doc}`general packet flow diagram</configuration/firewall/index>` if
-needed.
-
-For traffic that originates from the bridge itself, the base chain is
-**output**, and the base command is `set firewall bridge output filter
-...`, and the path is:
-
-:::{figure} /_static/images/firewall-bridge-output.webp
-:::
-
-Custom bridge firewall chains can be created with the command `set firewall
-bridge name <name> ...`. To use such a custom chain, a rule with action jump
-and the appropriate target must be defined in a base chain.
-
-## Bridge Rules
-
-For firewall filtering, firewall rules need to be created. Each rule is
-numbered, has an action to apply if the rule is matched, and the ability
-to specify multiple matching criteria. Data packets go through the rules
-from 1 - 999999, so order is crucial. At the first match the action of the
-rule will be executed.
-
-### Actions
-
-If a rule is defined, an action must also be defined for it. This tells the
-firewall what to do if all matching criteria in the rule are met.
-
-In firewall bridge rules, the action can be:
-
-> - `accept`: accept the packet.
-> - `continue`: continue parsing next rule.
-> - `drop`: drop the packet.
-> - `jump`: jump to another custom chain.
-> - `return`: Return from the current chain and continue at the next rule
->   of the last chain.
-> - `queue`: Enqueue packet to userspace.
-> - `notrack`: ignore connection tracking system. This action is only
->   available in prerouting chain.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> action
-   [accept | continue | drop | jump | notrack | queue | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> action
-   [accept | continue | drop | jump | queue | return]
-
-   This required setting defines the action of the current rule. If action is
-   set to jump, then jump-target is also needed.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   jump-target <text>
-```
-
-If action is set to ``queue``, use next command to specify the queue
-target. Range is also supported:
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   queue <0-65535>
-
-   Also, if action is set to ``queue``, use next command to specify the queue
-   options. Possible options are ``bypass`` and ``fanout``:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   queue-options fanout
-```
-
-Also, **default-action** is an action that takes place whenever a packet does
-not match any rule in its chain. For base chains, possible options for
-**default-action** are **accept** or **drop**.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> default-action
-   [accept | continue | drop | jump | reject | return]
-
-   This sets the default action of the rule-set if a packet does not match
-   any of the rules in that chain. If default-action is set to ``jump``, then
-   ``default-jump-target`` is also needed. Note that for base chains, default
-   action can only be set to ``accept`` or ``drop``, while on custom chains
-   more actions are available.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> default-jump-target <text>
-
-   To be used only when ``default-action`` is set to ``jump``. Use this
-   command to specify jump target for default rule.
-```
-
-:::{note}
-**Important note about default-actions:**
-If the default action for any base chain is not defined, then the default
-action is set to **accept** for that chain. For custom chains, if the
-default action is not defined, then the default-action is set to **drop**.
-:::
-
-### Firewall Logs
-
-You can enable logging for every firewall rule. If enabled, other log options
-can be configured.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> log
-
-   Enable logging for the matched packet. If this configuration command is not
-   present, then the log is not enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> default-log
-
-   Use this command to enable the logging of the default action on
-   the specified chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-
-   Define log-level. Only applicable if rule log is enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   log-options group <0-65535>
-
-   Define the log group to send messages to. Only applicable if rule log is
-   enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   log-options snapshot-length <0-9000>
-
-   Define length of packet payload to include in netlink message. Only
-   applicable if rule log is enabled and the log group is defined.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   log-options queue-threshold <0-65535>
-
-   Define the number of packets to queue inside the kernel before sending them
-   to userspace. Only applicable if rule log is enabled and the log group is
-   defined.
-```
-
-### Firewall Description
-
-You can define a description for reference for every custom chain.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> description <text>
-
-   Provide a rule-set description to a custom firewall chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
-   description <text>
-
-   Provide a description for each rule.
-```
-
-### Rule Status
-
-By default, when you define a rule, it is enabled. In some cases, it is
-useful to disable the rule instead of removing it.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> disable
-
-   Command for disabling a rule but keep it in the configuration.
-```
-
-### Matching criteria
-
-There are many matching criteria against which a packet can be tested. Refer
-to {doc}`IPv4</configuration/firewall/ipv4>` and
-{doc}`IPv6</configuration/firewall/ipv6>` matching criteria for more details.
-
-Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are
-supported in bridge firewall configuration. Same applies to firewall groups.
-
-Same specific matching criteria that can be used in bridge firewall are
-described in this section:
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> ethernet-type
-   [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> ethernet-type
-   [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> ethernet-type
-   [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> ethernet-type
-   [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> ethernet-type
-   [802.1q | 802.1ad | arp | ipv4 | ipv6]
-
-   Match based on the Ethernet type of the packet.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan
-   ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan
-   ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan
-   ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan
-   ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> vlan
-   ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6]
-
-   Match based on the Ethernet type of the packet when it is VLAN tagged.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan id
-   <0-4096>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan id
-   <0-4096>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan id
-   <0-4096>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan id
-   <0-4096>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> vlan id
-   <0-4096>
-
-   Match based on VLAN identifier. Range is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan priority
-   <0-7>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan priority
-   <0-7>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan priority
-   <0-7>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan priority
-   <0-7>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge name <name> rule <1-999999> vlan priority
-   <0-7>
-
-   Match based on VLAN priority (Priority Code Point - PCP). Range is also
-   supported.
-```
-
-### Packet Modifications
-
-Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify
-packets before they are sent out. This feature provides more flexibility in
-packet handling.
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter
-   rule <1-999999> set dscp <0-63>
-
-   Set a specific value of Differentiated Services Codepoint (DSCP).
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter
-   rule <1-999999> set mark <1-2147483647>
-
-   Set a specific packet mark value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter
-   rule <1-999999> set tcp-mss <500-1460>
-
-   Set the TCP-MSS (TCP maximum segment size) for the connection.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter
-   rule <1-999999> set ttl <0-255>
-
-   Set the TTL (Time to Live) value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter
-   rule <1-999999> set hop-limit <0-255>
-
-   Set hop limit value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall bridge [forward | output] filter
-   rule <1-999999> set connection-mark <0-2147483647>
-
-   Set connection mark value.
-
-```
-
-### Use IP firewall
-
-By default, for switched traffic, only the rules defined under `set firewall
-bridge` are applied. There are two global-options that can be configured in
-order to force deeper analysis of the packet on the IP layer. These options
-are:
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv4
-
-   This command enables the IPv4 firewall for bridged traffic. If this option
-   is used, packets are also parsed by rules defined in ``set firewall ipv4
-   ...``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv6
-
-   This command enables the IPv6 firewall for bridged traffic. If this option
-   is used, packets are also parsed by rules defined in ``set firewall ipv6
-   ...``
-```
-
-## Operation-mode Firewall
-
-### Rule-set overview
-
-In this section you can find all useful firewall op-mode commands.
-
-General commands for firewall configuration, counter and statistics:
-
-```{eval-rst}
-.. opcmd:: show firewall
-```
-
-```{eval-rst}
-.. opcmd:: show firewall summary
-```
-
-```{eval-rst}
-.. opcmd:: show firewall statistics
-```
-
-And, to print only bridge firewall information:
-
-```{eval-rst}
-.. opcmd:: show firewall bridge
-```
-
-```{eval-rst}
-.. opcmd:: show firewall bridge forward filter
-```
-
-```{eval-rst}
-.. opcmd:: show firewall bridge forward filter rule <rule>
-```
-
-```{eval-rst}
-.. opcmd:: show firewall bridge name <name>
-```
-
-```{eval-rst}
-.. opcmd:: show firewall bridge name <name> rule <rule>
-```
-
-### Show Firewall log
-
-```{eval-rst}
-.. opcmd:: show log firewall
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge forward
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge forward filter
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge name <name>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge forward filter rule <rule>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall bridge name <name> rule <rule>
-
-   Show the logs of all firewall; show all bridge firewall logs; show all logs
-   for forward hook; show all logs for forward hook and priority filter; show
-   all logs for particular custom chain; show logs for specific Rule-Set.
-```
-
-### Example
-
-Configuration example:
-
-```none
-set firewall bridge forward filter default-action 'drop'
-set firewall bridge forward filter default-log
-set firewall bridge forward filter rule 10 action 'continue'
-set firewall bridge forward filter rule 10 inbound-interface name 'eth2'
-set firewall bridge forward filter rule 10 vlan id '22'
-set firewall bridge forward filter rule 20 action 'drop'
-set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT'
-set firewall bridge forward filter rule 20 vlan id '60'
-set firewall bridge forward filter rule 30 action 'jump'
-set firewall bridge forward filter rule 30 jump-target 'TEST'
-set firewall bridge forward filter rule 30 outbound-interface name '!eth1'
-set firewall bridge forward filter rule 35 action 'accept'
-set firewall bridge forward filter rule 35 vlan id '11'
-set firewall bridge forward filter rule 40 action 'continue'
-set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11'
-set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66'
-set firewall bridge name TEST default-action 'accept'
-set firewall bridge name TEST default-log
-set firewall bridge name TEST rule 10 action 'continue'
-set firewall bridge name TEST rule 10 log
-set firewall bridge name TEST rule 10 vlan priority '0'
-```
-
-And op-mode commands:
-
-```none
-vyos@BRI:~$ show firewall bridge
-Rulesets bridge Information
-
----------------------------------
-bridge Firewall "forward filter"
-
-Rule     Action    Protocol      Packets    Bytes  Conditions
--------  --------  ----------  ---------  -------  ---------------------------------------------------------------------
-10       continue  all                 0        0  iifname "eth2" vlan id 22  continue
-20       drop      all                 0        0  iifname @I_TRUNK-RIGHT vlan id 60
-30       jump      all              2130   170688  oifname != "eth1"  jump NAME_TEST
-35       accept    all              2080   168616  vlan id 11  accept
-40       continue  all                 0        0  ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66  continue
-default  drop      all                 0        0
-
----------------------------------
-bridge Firewall "name TEST"
-
-Rule     Action    Protocol      Packets    Bytes  Conditions
--------  --------  ----------  ---------  -------  --------------------------------------------------
-10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
-default  accept    all              2130   170688
-
-vyos@BRI:~$
-vyos@BRI:~$ show firewall bridge name TEST
-Ruleset Information
-
----------------------------------
-bridge Firewall "name TEST"
-
-Rule     Action    Protocol      Packets    Bytes  Conditions
--------  --------  ----------  ---------  -------  --------------------------------------------------
-10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
-default  accept    all              2130   170688
-
-vyos@BRI:~$
-```
-
-Inspect logs:
-
-```none
-vyos@BRI:~$ show log firewall bridge
-Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
-Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
-Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
-...
-vyos@BRI:~$ show log firewall bridge forward filter
-Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
-Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
-```
diff --git a/docs/configuration/firewall/md-flowtables.md b/docs/configuration/firewall/md-flowtables.md
deleted file mode 100644
index e43dbd30..00000000
--- a/docs/configuration/firewall/md-flowtables.md
+++ /dev/null
@@ -1,189 +0,0 @@
----
-lastproofread: '2026-03-30'
----
-
-(firewall-flowtables-configuration)=
-
-# Flowtables Firewall Configuration
-
-```{include} /_include/need_improvement.txt
-```
-
-## Overview
-
-This section provides information on firewall configuration for flowtables.
-
-```{eval-rst}
-.. cfgcmd:: set firewall flowtable ...
-```
-
-To learn about the general traffic flow in VyOS firewalls,
-see {doc}`Firewall </configuration/firewall/index>`.
-
-```none
-- set firewall
-    * flowtable
-         - custom_flow_table
-            + ...
-```
-
-Flowtables let you define a fastpath through the flowtable datapath.
-Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP)
-protocols.
-
-:::{figure} /_static/images/firewall-flowtable-packet-flow.webp
-:::
-
-After the first packet successfully traverses the IP forwarding path (black
-circles path), you can offload subsequent packets to the flowtable through your
-ruleset. You specify when to add a flow to the flowtable during forward
-filtering (red circle number 6).
-
-When a packet finds a matching entry in the flowtable (flowtable hit), the
-system transmits it to the output netdevice. This means packets bypass the
-classic IP forwarding path and use the **Fast Path** (orange circles path).
-As a result, you do not see these packets from any Netfilter hooks after
-ingress. If no matching entry exists in the flowtable (flowtable miss), the
-packet traverses the classic IP forwarding path.
-
-:::{note}
-**Flowtable Reference:**
-<https://docs.kernel.org/networking/nf_flowtable.html>
-:::
-
-## Flowtable Configuration
-
-To use flowtables, you need to configure the following:
-
-> - Create a flowtable that includes the interfaces
->   that are going to be used by the flowtable.
-> - Create a firewall rule. Set the action to
->   `offload` and use your desired flowtable for `offload-target`.
-
-Creating a flow table:
-
-```{eval-rst}
-.. cfgcmd:: set firewall flowtable <flow_table_name> interface <iface>
-
-   Specify interfaces to use in the flowtable.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall flowtable <flow_table_name> description <text>
-```
-
-Provide a description for the flow table.
-
-```{eval-rst}
-.. cfgcmd:: set firewall flowtable <flow_table_name> offload
-   <hardware | software>
-
-   Specify the offload type the flowtable uses: ``hardware`` or
-   ``software``. The default is ``software`` offload.
-```
-
-:::{note}
-**Hardware offload**: Make sure your network interface controller
-(NIC) supports hardware offloading and that you have the necessary drivers
-
-> installed before enabling this option.
-:::
-
-Creating rules for using flow tables:
-
-```{eval-rst}
-.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999>
-   action offload
-
-   Create a firewall rule in the forward chain with the action set to
-   ``offload``.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999>
-   offload-target <flowtable>
-
-   Create a firewall rule in the forward chain and specify which flowtable
-   to use. Only applicable if the action is ``offload``.
-```
-
-## Configuration Example
-
-Consider the following in this setup:
-
-> - This example uses two interfaces in the flowtables: `eth0` and `eth1`.
-> - The example provides a minimal firewall ruleset with filtering rules
->   and rules for using flowtable offload capabilities.
-
-The first packet is evaluated by the firewall path, so a
-desired connection should be explicitly accepted.
-The same should occur for traffic in reverse order.
-In most cases, state policies are
-used to accept a connection in the reverse path.
-
-In the following example only traffic coming from interface `eth0`,
-TCP protocol, and destination port 1122 is accepted.
-All other traffic to the router is dropped.
-
-### Commands
-
-```none
-set firewall flowtable FT01 interface 'eth0'
-set firewall flowtable FT01 interface 'eth1'
-set firewall ipv4 forward filter default-action 'drop'
-set firewall ipv4 forward filter rule 10 action 'offload'
-set firewall ipv4 forward filter rule 10 offload-target 'FT01'
-set firewall ipv4 forward filter rule 10 state 'established'
-set firewall ipv4 forward filter rule 10 state 'related'
-set firewall ipv4 forward filter rule 20 action 'accept'
-set firewall ipv4 forward filter rule 20 state 'established'
-set firewall ipv4 forward filter rule 20 state 'related'
-set firewall ipv4 forward filter rule 110 action 'accept'
-set firewall ipv4 forward filter rule 110 destination address '192.0.2.100'
-set firewall ipv4 forward filter rule 110 destination port '1122'
-set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0'
-set firewall ipv4 forward filter rule 110 protocol 'tcp'
-```
-
-### Explanation
-
-Here's what happens for a desired connection:
-
-> 1. A packet arrives on `eth0` with destination address `192.0.2.100`, TCP
->    protocol, and destination port 1122. Assume this address is reachable
->    through interface `eth1`.
-> 2. For this first packet, the connection state is **new**. Neither rule 10
->    nor rule 20 applies.
-> 3. Rule 110 matches, so the connection is accepted.
-> 4. When the server 192.0.2.100 replies, the connection state becomes
->    **established**, and rule 20 accepts the reply.
-> 5. The router receives the second packet for this connection. Because the
->    connection state is **established**, rule 10 matches and adds a new
->    entry in the flowtable FT01 for this connection.
-> 6. Subsequent packets skip the traditional path and use the **Fast Path**
->    for offloading.
-
-### Checks
-
-Check the conntrack table to verify that the system accepted and properly
-offloaded connections.
-
-```none
-vyos@FlowTables:~$ show firewall ipv4 forward filter
-Ruleset Information
-
----------------------------------
-ipv4 Firewall "forward filter"
-
-Rule     Action    Protocol      Packets    Bytes  Conditions
--------  --------  ----------  ---------  -------  ----------------------------------------------------------------
-10       offload   all                 8      468  ct state { established, related }  flow add @VYOS_FLOWTABLE_FT01
-20       accept    all                 8      468  ct state { established, related }  accept
-110      accept    tcp                 2      120  ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0"  accept
-default  drop      all                 7      420
-
-vyos@FlowTables:~$ sudo conntrack -L | grep tcp
-conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown.
-tcp      6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2
-vyos@FlowTables:~$
-```
diff --git a/docs/configuration/firewall/md-global-options.md b/docs/configuration/firewall/md-global-options.md
deleted file mode 100644
index 5a74266c..00000000
--- a/docs/configuration/firewall/md-global-options.md
+++ /dev/null
@@ -1,259 +0,0 @@
----
-lastproofread: '2026-03-30'
----
-
-(firewall-global-options-configuration)=
-
-# Global Options Firewall Configuration
-
-## Overview
-
-Some firewall settings are global and affect the entire system. This section
-provides information about these global options that you can configure using
-the VyOS CLI.
-
-Configuration commands covered in this section:
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options ...
-```
-
-## Configuration
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options all-ping [enable | disable]
-
-   By default, when VyOS receives an ICMP echo request packet destined for
-   itself, it answers with an ICMP echo reply, unless your firewall prevents
-   it.
-
-   You can set firewall rules to accept, drop, or reject ICMP in, out, or
-   local traffic. You can also use the **firewall global-options all-ping**
-   command. This command affects only LOCAL traffic (packets destined for your
-   VyOS system), not IN or OUT traffic.
-
-   .. note:: **firewall global-options all-ping** affects only LOCAL traffic
-      and always behaves in the most restrictive way
-
-   .. code-block:: none
-
-      set firewall global-options all-ping enable
-
-   When you set this command, VyOS answers every ICMP echo request addressed
-   to itself, but that response occurs only if no other rule drops or rejects
-   local echo requests. In case of conflict, VyOS does not answer ICMP echo
-   requests.
-
-   .. code-block:: none
-
-      set firewall global-options all-ping disable
-
-   When you set this command, VyOS answers no ICMP echo requests addressed to
-   itself, regardless of where they come from or what specific rules accept
-   them.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6]
-
-   Apply IPv4 or IPv6 firewall rules to bridged traffic.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options broadcast-ping [enable | disable]
-
-   Enable or disable the response to ICMP broadcast messages. The system
-   alters the following parameter:
-
-   * ``net.ipv4.icmp_echo_ignore_broadcasts``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options ip-src-route [enable | disable]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options ipv6-src-route [enable | disable]
-
-   Set whether VyOS accepts packets with a source route option.
-   The following sysctl parameters will be changed:
-
-   * ``net.ipv4.conf.all.accept_source_route``
-   * ``net.ipv6.conf.all.accept_source_route``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options receive-redirects [enable | disable]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options ipv6-receive-redirects
-   [enable | disable]
-
-   Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages.
-   The following sysctl parameters will be changed:
-
-   * ``net.ipv4.conf.all.accept_redirects``
-   * ``net.ipv6.conf.all.accept_redirects``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options send-redirects [enable | disable]
-
-   Allow VyOS to send ICMPv4 redirect messages.
-   The following sysctl parameter will be changed:
-
-   * ``net.ipv4.conf.all.send_redirects``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options log-martians [enable | disable]
-
-   Allow VyOS to log martian IPv4 packets.
-   The following sysctl parameter will be changed:
-
-   * ``net.ipv4.conf.all.log_martians``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options source-validation
-   [strict | loose | disable]
-
-   Set the IPv4 source validation mode.
-   The following sysctl parameter will be changed:
-
-   * ``net.ipv4.conf.all.rp_filter``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options syn-cookies [enable | disable]
-
-   Allow VyOS to use IPv4 TCP SYN Cookies.
-   The following sysctl parameter will be changed:
-
-   * ``net.ipv4.tcp_syncookies``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options twa-hazards-protection
-   [enable | disable]
-
-   Enable or disable VyOS {rfc}`1337` conformance.
-   The following sysctl parameter will be changed:
-
-   * ``net.ipv4.tcp_rfc1337``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy established action
-   [accept | drop | reject]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy established log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy established log-level
-   [emerg | alert | crit | err | warn | notice | info | debug]
-
-   Set the global setting for an established connection.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy invalid action
-   [accept | drop | reject]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy invalid log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy invalid log-level
-   [emerg | alert | crit | err | warn | notice | info | debug]
-
-   Set the global setting for invalid packets.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy related action
-   [accept | drop | reject]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy related log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options state-policy related log-level
-   [emerg | alert | crit | err | warn | notice | info | debug]
-
-   Set the global setting for related connections.
-```
-
-VyOS supports setting timeouts for connections by connection type. You can
-set timeout values for generic connections, ICMP connections, UDP
-connections, or TCP connections in various states.
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout icmp <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout other <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout udp other <1-21474836>
-    :defaultvalue:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836>
-    :defaultvalue:
-
-    Set the timeout in seconds for a protocol or state.
-```
diff --git a/docs/configuration/firewall/md-groups.md b/docs/configuration/firewall/md-groups.md
deleted file mode 100644
index ed02d249..00000000
--- a/docs/configuration/firewall/md-groups.md
+++ /dev/null
@@ -1,526 +0,0 @@
----
-lastproofread: '2026-03-30'
----
-
-(firewall-groups-configuration)=
-
-# Firewall groups
-
-## Configuration
-
-Firewall groups represent collections of IP addresses, networks, ports,
-MAC addresses, domains, or interfaces. You can reference a group in firewall,
-NAT, and policy route rules as either a source or destination matcher, and/or
-as inbound or outbound in the case of interface groups.
-
-### Address Groups
-
-An **address group** contains a single IP address or IP address range.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group address-group <name> address [address |
-   address range]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group ipv6-address-group <name> address <address>
-
-   Define an IPv4 or IPv6 address group.
-
-   .. code-block:: none
-
-      set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1
-      set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8
-      set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group address-group <name> description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group ipv6-address-group <name> description <text>
-
-   Provide an IPv4 or IPv6 address group description.
-```
-
-### Remote Groups
-
-A **remote-group** uses a URL that hosts a newline-delimited list of IPv4
-and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically
-according to the frequency you define in the firewall **resolver-interval**
-and loads matching entries into the group for use in rules. The list is cached
-in persistent storage, so rules continue to function if updates fail.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group remote-group <name> url <http(s) url>
-
-   Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs
-   to fetch.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group remote-group <name> description <text>
-
-   Set a description for a remote group.
-```
-
-The remote list format is flexible. VyOS attempts to parse the first word of
-each line as an entry and skips lines it cannot match. Lines that begin with
-an alphanumeric character but do not match valid IPv4 or IPv6 addresses,
-ranges, or CIDRs are logged to the system log. The following examples show
-acceptable formats that VyOS parses correctly:
-
-```none
-127.0.0.1
-127.0.0.0/24
-127.0.0.1-127.0.0.254
-2001:db8::1
-2001:db8:cafe::/48
-2001:db8:cafe::1-2001:db8:cafe::ffff
-```
-
-### Network Groups
-
-**Network groups** accept IP networks in CIDR notation. You can add specific
-IP addresses as a 32-bit prefix. If you need to add a mix of addresses and
-networks, use a network group.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group network-group <name> network <CIDR>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group ipv6-network-group <name> network <CIDR>
-
-   Define an IPv4 or IPv6 network group.
-
-   .. code-block:: none
-
-      set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24
-      set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
-      set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group network-group <name> description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group ipv6-network-group <name> description <text>
-
-   Provide an IPv4 or IPv6 network group description.
-```
-
-### Interface Groups
-
-An **interface group** represents a collection of interfaces.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group interface-group <name> interface <text>
-
-   Define an interface group.
-   Wildcard ``*`` is supported. For example: ``eth3*``.
-   Prepend the character ``!`` to invert the criteria. For example: ``!eth2``.
-```
-
-```none
-set firewall group interface-group LAN interface bond1001
-set firewall group interface-group LAN interface eth3*
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group interface-group <name> description <text>
-
-   Provide an interface group description.
-```
-
-### Port Groups
-
-A **port group** represents only port numbers, not the protocol. You can
-reference port groups for either TCP or UDP. Create TCP and UDP groups
-separately to avoid accidentally filtering unnecessary ports. Specify port
-ranges by using `-`.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group port-group <name> port
-   [portname | portnumber | startport-endport]
-
-   Define a port group. A port name can be any name defined in
-   /etc/services. For example, ``http``.
-
-   .. code-block:: none
-
-      set firewall group port-group PORT-TCP-SERVER1 port http
-      set firewall group port-group PORT-TCP-SERVER1 port 443
-      set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group port-group <name> description <text>
-
-   Provide a port group description.
-```
-
-### MAC Groups
-
-A **mac group** represents a collection of mac addresses.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group mac-group <name> mac-address <mac-address>
-
-   Define a mac group.
-```
-
-```none
-set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f
-set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group mac-group <name> description <text>
-
-      Provide a MAC group description.
-```
-
-### Domain Groups
-
-A **domain group** represents a collection of domains.
-
-```{eval-rst}
-.. cfgcmd:: set firewall group domain-group <name> address <domain>
-
-   Define a domain group.
-```
-
-```none
-set firewall group domain-group DOM address example.com
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group domain-group <name> description <text>
-
-      Provide a domain group description.
-```
-
-### Dynamic Groups
-
-Firewall dynamic groups differ from other groups because you can use them as
-source/destination in firewall rules, and members are not defined statically
-in VyOS configuration. Instead, firewall rules dynamically add members to
-these groups.
-
-#### Defining Dynamic Address Groups
-
-Dynamic address groups support both IPv4 and IPv6 families. Use these
-commands to define dynamic IPv4 and IPv6 address groups:
-
-```{eval-rst}
-.. cfgcmd:: set firewall group dynamic-group address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group dynamic-group ipv6-address-group <name>
-```
-
-Add description to firewall groups:
-
-```{eval-rst}
-.. cfgcmd:: set firewall group dynamic-group address-group <name>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall group dynamic-group ipv6-address-group <name>
-   description <text>
-```
-
-#### Adding elements to Dynamic Firewall Groups
-
-After you define dynamic firewall groups, use them in firewall rules to
-dynamically add elements to them.
-
-Commands used for this task are:
-
-- Add destination IP address of the connection to a dynamic address group:
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
-   <1-999999> add-address-to-group destination-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
-   destination-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
-   <1-999999> add-address-to-group destination-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
-   destination-address address-group <name>
-```
-
-- Add source IP address of the connection to a dynamic address group:
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
-   <1-999999> add-address-to-group source-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
-   source-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
-   <1-999999> add-address-to-group source-address address-group <name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
-   source-address address-group <name>
-```
-
-You can define specific timeouts per rule. When a rule matches, the source or
-destination address is added to the group, and the element remains in the group
-until the timeout expires. If you do not define a timeout, the element remains
-in the group until the next reboot or until you commit firewall configuration
-changes.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
-   <1-999999> add-address-to-group [destination-address | source-address]
-   timeout <timeout>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
-   [destination-address | source-address] timeout <timeout>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
-   <1-999999> add-address-to-group [destination-address | source-address]
-   timeout <timeout>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
-   [destination-address | source-address] timeout <timeout>
-```
-
-Timeout can be defined using seconds, minutes, hours or days:
-
-```none
-set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout
-Possible completions:
-<number>s            Timeout value in seconds
-<number>m            Timeout value in minutes
-<number>h            Timeout value in hours
-<number>d            Timeout value in days
-```
-
-#### Using Dynamic Firewall Groups
-
-Like other firewall groups, you can use dynamic firewall groups in firewall
-rules as matching options. For example:
-
-```none
-set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO
-set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR
-```
-
-## Examples
-
-### General example
-
-After you create firewall groups, you can reference them in firewall, NAT,
-NAT66, and/or policy-route rules. The following example creates multiple
-groups:
-
-```none
-set firewall group address-group SERVERS address 198.51.100.101
-set firewall group address-group SERVERS address 198.51.100.102
-set firewall group network-group TRUSTEDv4 network 192.0.2.0/30
-set firewall group network-group TRUSTEDv4 network 203.0.113.128/25
-set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64
-set firewall group interface-group LAN interface eth2.2001
-set firewall group interface-group LAN interface bon0
-set firewall group port-group PORT-SERVERS port http
-set firewall group port-group PORT-SERVERS port 443
-set firewall group port-group PORT-SERVERS port 5000-5010
-```
-
-And next, some configuration example where groups are used:
-
-```none
-set firewall ipv4 output filter rule 10 action accept
-set firewall ipv4 output filter rule 10 outbound-interface group !LAN
-set firewall ipv4 forward filter rule 20 action accept
-set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4
-set firewall ipv6 input filter rule 10 action accept
-set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6
-set nat destination rule 101 inbound-interface group LAN
-set nat destination rule 101 destination group address-group SERVERS
-set nat destination rule 101 protocol tcp
-set nat destination rule 101 destination group port-group PORT-SERVERS
-set nat destination rule 101 translation address 203.0.113.250
-set policy route PBR rule 201 destination group port-group PORT-SERVERS
-set policy route PBR rule 201 protocol tcp
-set policy route PBR rule 201 set table 15
-```
-
-### Port knocking example
-
-You can use dynamic firewall groups with port knocking to secure access to
-the router or any other device. The following example shows a 4-step port
-knocking configuration:
-
-```none
-set firewall global-options state-policy established action 'accept'
-set firewall global-options state-policy invalid action 'drop'
-set firewall global-options state-policy related action 'accept'
-set firewall group dynamic-group address-group ALLOWED
-set firewall group dynamic-group address-group PN_01
-set firewall group dynamic-group address-group PN_02
-set firewall ipv4 input filter default-action 'drop'
-set firewall ipv4 input filter rule 5 action 'accept'
-set firewall ipv4 input filter rule 5 protocol 'icmp'
-set firewall ipv4 input filter rule 10 action 'drop'
-set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01'
-set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m'
-set firewall ipv4 input filter rule 10 description 'Port_nock 01'
-set firewall ipv4 input filter rule 10 destination port '9990'
-set firewall ipv4 input filter rule 10 protocol 'tcp'
-set firewall ipv4 input filter rule 20 action 'drop'
-set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02'
-set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m'
-set firewall ipv4 input filter rule 20 description 'Port_nock 02'
-set firewall ipv4 input filter rule 20 destination port '9991'
-set firewall ipv4 input filter rule 20 protocol 'tcp'
-set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01'
-set firewall ipv4 input filter rule 30 action 'drop'
-set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED'
-set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h'
-set firewall ipv4 input filter rule 30 description 'Port_nock 03'
-set firewall ipv4 input filter rule 30 destination port '9992'
-set firewall ipv4 input filter rule 30 protocol 'tcp'
-set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02'
-set firewall ipv4 input filter rule 99 action 'accept'
-set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh'
-set firewall ipv4 input filter rule 99 destination port '22'
-set firewall ipv4 input filter rule 99 protocol 'tcp'
-set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED'
-```
-
-Before testing, we can check the members of firewall groups:
-
-```none
-vyos@vyos# run show firewall group
-Firewall Groups
-
-Name     Type                    References            Members        Timeout    Expires
--------  ----------------------  --------------------  -------------  ---------  ---------
-ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
-PN_01    address_group(dynamic)  ipv4-input-filter-10  N/D            N/D        N/D
-PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
-[edit]
-vyos@vyos#
-```
-
-With this configuration, to gain SSH access to the router, the user must:
-
-1. Create a new TCP connection to destination port 9990. A new entry is added
-   to dynamic firewall group `PN_01`.
-
-   ```none
-   vyos@vyos# run show firewall group
-   Firewall Groups
-
-   Name     Type                    References            Members        Timeout    Expires
-   -------  ----------------------  --------------------  -------------  ---------  ---------
-   ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
-   PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        119
-   PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
-   [edit]
-   vyos@vyos#
-   ```
-
-2. Create a new TCP connection to destination port 9991. A new entry is added
-   to dynamic firewall group `PN_02`.
-
-   ```none
-   vyos@vyos# run show firewall group
-   Firewall Groups
-
-   Name     Type                    References            Members        Timeout    Expires
-   -------  ----------------------  --------------------  -------------  ---------  ---------
-   ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
-   PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        106
-   PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31  180        179
-   [edit]
-   vyos@vyos#
-   ```
-
-3. Create a new TCP connection to destination port 9992. A new entry is added
-   to dynamic firewall group `ALLOWED`.
-
-   ```none
-   vyos@vyos# run show firewall group
-   Firewall Groups
-
-   Name     Type                    References            Members        Timeout    Expires
-   -------  ----------------------  --------------------  -------------  ---------  ---------
-   ALLOWED  address_group(dynamic)  ipv4-input-filter-30  192.168.89.31       7200       7199
-   PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31        120         89
-   PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31        180        170
-   [edit]
-   vyos@vyos#
-   ```
-
-4. Now you can connect via SSH to the router (assuming SSH is
-   configured).
-
-## Operation-mode
-
-```{eval-rst}
-.. opcmd:: show firewall group
-```
-
-```{eval-rst}
-.. opcmd:: show firewall group <name>
-
-   Display an overview of defined groups, including the firewall group name,
-   type, references (where the group is used), members, timeout, and
-   expiration (the last two only apply to dynamic firewall groups).
-```
-
-Here is an example of such command:
-
-```none
-vyos@vyos:~$ show firewall group
-Firewall Groups
-
-Name          Type                    References              Members             Timeout    Expires
-------------  ----------------------  ----------------------  ----------------  ---------  ---------
-SERVERS       address_group           nat-destination-101     198.51.100.101
-                                                              198.51.100.102
-ALLOWED       address_group(dynamic)  ipv4-input-filter-30    192.168.77.39          7200       7174
-PN_01         address_group(dynamic)  ipv4-input-filter-10    192.168.0.245           120        112
-                                                              192.168.77.39           120         85
-PN_02         address_group(dynamic)  ipv4-input-filter-20    192.168.77.39           180        151
-LAN           interface_group         ipv4-output-filter-10   bon0
-                                      nat-destination-101     eth2.2001
-TRUSTEDv6     ipv6_network_group      ipv6-input-filter-10    2001:db8::/64
-TRUSTEDv4     network_group           ipv4-forward-filter-20  192.0.2.0/30
-                                                              203.0.113.128/25
-PORT-SERVERS  port_group              route-PBR-201           443
-                                      route-PBR-201           5000-5010
-                                      nat-destination-101     http
-vyos@vyos:~$
-```
diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md
deleted file mode 100644
index 204744d5..00000000
--- a/docs/configuration/firewall/md-index.md
+++ /dev/null
@@ -1,236 +0,0 @@
-lastproofread  
-2024-08-05
-
-# Firewall
-
-<div class="todo">
-
-Convert raw command blocks in this file to cfgcmd/opcmd
-directives for command coverage tracking.
-
-</div>
-
-<div class="warning">
-
-<div class="title">
-
-Warning
-
-</div>
-
-Due to a race condition that can lead to a failure during boot
-process, all interfaces are initialized before firewall is configured. This
-leads to a situation where the system is open to all traffic, and can be
-considered as a security risk.
-
-</div>
-
-As VyOS is based on Linux it leverages its firewall. The Netfilter project
-created iptables and its successor nftables for the Linux kernel to
-work directly on packet data flows. This now extends the concept of
-zone-based security to allow for manipulating the data at multiple stages once
-accepted by the network interface and the driver before being handed off to
-the destination (e.g., a web server OR another device).
-
-A simplified traffic flow diagram, based on Netfilter packet flow, is shown
-next, in order to have a full view and understanding of how packets are
-processed, and what possible paths traffic can take.
-
-<figure>
-<img src="/_static/images/firewall-gral-packet-flow.webp" />
-</figure>
-
-The main points regarding this packet flow and terminology used in VyOS
-firewall are covered below:
-
-> - **Bridge Port?**: choose appropriate path based on whether interface
->   where the packet was received is part of a bridge, or not.
-
-If the interface where the packet was received isn't part of a bridge, then
-packet is processed at the **IP Layer**:
-
-> - **Prerouting**: All packets that are received by the router
->   are processed in this stage, regardless of the destination of the packet.
->   Starting from vyos-1.5-rolling-202406120020, a new section was added to
->   the firewall configuration. There are several actions that can be done in
->   this stage, and currently these actions are also defined in different
->   parts of the VyOS configuration. Order is important, and the relevant
->   configuration that acts in this stage are:
->
->   > - **Firewall prerouting**: rules defined under `set firewall [ipv4 | ipv6] prerouting raw...`. All rules defined in this section are
->   >   processed before connection tracking subsystem.
->   > - **Conntrack Ignore**: rules defined under `set system conntrack ignore [ipv4 | ipv6] ...`. Starting from vyos-1.5-rolling-202406120020,
->   >   configuration done in this section can be done in `firewall [ipv4 | ipv6] prerouting ...`. For compatibility reasons, this feature is
->   >   still present, but it will be removed in the future.
->   > - **Policy Route**: rules defined under `set policy [route | route6] ...`.
->   > - **Destination NAT**: rules defined under `set [nat | nat66] destination...`.
->
-> - **Destination is the router?**: choose an appropriate path based on
->   destination IP address. Transit forward continues to **forward**,
->   while traffic where the destination IP address is configured on the router
->   continues to **input**.
->
-> - **Input**: stage where traffic destined for the router itself can be
->   filtered and controlled. This is where all rules for securing the router
->   should take place. This includes ipv4 and ipv6 filtering rules, defined
->   in:
->
->   - `set firewall ipv4 input filter ...`.
->   - `set firewall ipv6 input filter ...`.
->
-> - **Forward**: stage where transit traffic can be filtered and controlled.
->   This includes ipv4 and ipv6 filtering rules, defined in:
->
->   - `set firewall ipv4 forward filter ...`.
->   - `set firewall ipv6 forward filter ...`.
->
-> - **Output**: stage where traffic that originates from the router itself
->   can be filtered and controlled. Bear in mind that this traffic can be a
->   new connection originated by a internal process running on the VyOS router
->   such as NTP, or a response to traffic received externally through
->   **input** (for example response to an ssh login attempt to the router).
->   This includes ipv4 and ipv6 rules, and two different sections are present:
->
->   - **Output Prerouting**: `set firewall [ipv4 | ipv6] output raw ...`.
->     As described in **Prerouting**, rules defined in this section are
->     processed before connection tracking subsystem.
->   - **Output Filter**: `set firewall [ipv4 | ipv6] output filter ...`.
->
-> - **Postrouting**: as in **Prerouting**, several actions defined in
->   different parts of VyOS configuration are performed in this
->   stage. This includes:
->
->   - **Source NAT**: rules defined under `set [nat | nat66] source...`.
-
-If the interface where the packet was received is part of a bridge, then
-the packet is processed at the **Bridge Layer**:
-
-> - **Prerouting (Bridge)**: all packets that are received by the bridge are
->   processed in this stage, regardless of the destination of the packet.
->   First filters can be applied here, and/or also configure rules for
->   ignoring connection tracking system. The relevant configuration that
->   acts in:
->   - `set firewall bridge prerouting filter ...`.
-> - **Forward (Bridge)**: stage where traffic that is trespassing through the
->   bridge is filtered and controlled:
->   - `set firewall bridge forward filter ...`.
-> - **Input (Bridge)**: stage where traffic destined for the bridge itself can
->   be filtered and controlled:
->   - `set firewall bridge input filter ...`.
-> - **Output (Bridge)**: stage where traffic that originates from the bridge
->   itself can be filtered and controlled:
->   - `set firewall bridge output filter ...`.
-
-The main structure of the VyOS firewall CLI is shown next:
-
-``` none
-- set firewall
-    * bridge
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-         - prerouting
-            + filter
-         - name
-            + custom_name
-    * flowtable
-         - custom_flow_table
-            + ...
-    * global-options
-         + all-ping
-         + broadcast-ping
-         + ...
-    * group
-         - address-group
-         - ipv6-address-group
-         - network-group
-         - ipv6-network-group
-         - interface-group
-         - mac-group
-         - port-group
-         - domain-group
-    * ipv4
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-            + raw
-         - prerouting
-            + raw
-         - name
-            + custom_name
-    * ipv6
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-            + raw
-         - prerouting
-            + raw
-         - ipv6-name
-            + custom_name
-    * zone
-         - custom_zone_name
-            + ...
-```
-
-Please, refer to appropriate section for more information about firewall
-configuration:
-
-<div class="toctree" maxdepth="1" includehidden="">
-
-global-options
-groups
-bridge
-ipv4
-ipv6
-flowtables
-
-</div>
-
-<div class="note">
-
-<div class="title">
-
-Note
-
-</div>
-
-**For more information**
-of Netfilter hooks and Linux networking packet flows can be
-found in [Netfilter-Hooks](https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks)
-
-</div>
-
-## Zone-based firewall
-
-<div class="toctree" maxdepth="1" includehidden="">
-
-zone
-
-</div>
-
-With zone-based firewalls a new concept was implemented, in addition to the
-standard in and out traffic flows, a local flow was added. This local flow was
-for traffic originating and destined to the router itself. Which means that
-additional rules were required to secure the firewall itself from the network,
-in addition to the existing inbound and outbound rules from the traditional
-concept above.
-
-To configure VyOS with the
-`zone-based firewall configuration </configuration/firewall/zone>`
-
-As the example image below shows, the device now needs rules to allow/block
-traffic to or from the services running on the device that have open
-connections on that interface.
-
-<figure>
-<img src="/_static/images/firewall-zonebased.webp" />
-</figure>
diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md
deleted file mode 100644
index cf6e2231..00000000
--- a/docs/configuration/firewall/md-ipv4.md
+++ /dev/null
@@ -1,2099 +0,0 @@
----
-lastproofread: '2026-03-30'
----
-
-(firewall-ipv4-configuration)=
-
-# IPv4 Firewall Configuration
-
-## Overview
-
-This section provides information on IPv4 firewall configuration and
-appropriate operation-mode commands. This section covers the following
-configuration commands:
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 ...
-```
-
-To learn about the general traffic flow in VyOS firewalls,
-see {doc}`Firewall </configuration/firewall/index>`.
-
-```none
-- set firewall
-    * ipv4
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-            + raw
-         - prerouting
-            + raw
-         - name
-            + custom_name
-```
-
-First, the router receives all traffic and processes it in the **prerouting**
-stage.
-
-This stage includes:
-
-> - **Firewall Prerouting**: commands found under `set firewall ipv4
->   prerouting raw ...`
-> - {doc}`Conntrack Ignore</configuration/system/conntrack>`: `set system
->   conntrack ignore ipv4...`
-> - {doc}`Policy Route</configuration/policy/route>`: commands found under
->   `set policy route ...`
-> - {doc}`Destination NAT</configuration/nat/nat44>`: commands found under
->   `set nat destination ...`
-
-For transit traffic, which is received by the router and forwarded, the base
-chain is **forward**. The following is a simplified packet flow diagram for
-transit traffic:
-
-:::{figure} /_static/images/firewall-fwd-packet-flow.webp
-:::
-
-The base firewall chain for configuring filtering rules for transit traffic is
-`set firewall ipv4 forward filter ...`, which occurs in stage 5, highlighted
-in red.
-
-For traffic to the router itself, the base chain is **input**. For traffic
-the router originates, the base chain is **output**. A simplified packet flow
-diagram is shown next, which shows the path for traffic destined to the router
-itself and traffic the router generates (starting from circle number 6):
-
-:::{figure} /_static/images/firewall-input-packet-flow.webp
-:::
-
-The base chain for traffic towards the router is
-`set firewall ipv4 input filter ...`
-
-The base chain for traffic the router generates is `set firewall ipv4
-output ...`, where two sub-chains are available: **filter** and **raw**:
-
-- **Output Prerouting**: `set firewall ipv4 output raw ...`. As described
-  in **Prerouting**, the system processes rules in this section before the
-  connection tracking subsystem.
-- **Output Filter**: `set firewall ipv4 output filter ...`. The system
-  processes rules in this section after the connection tracking subsystem.
-
-:::{note}
-**Important note about default-actions:**
-If you do not define a default action for a base chain, the system sets
-the default action to **accept** for that chain. For custom chains, if you
-do not define a default action, the system sets the default-action to
-**drop**.
-:::
-
-You can create custom firewall chains using the following commands:
-`set firewall ipv4 name <name> ...`. To use a custom chain, you must define
-a rule with the **action jump** and the appropriate **target** in a base
-chain.
-
-## Firewall - IPv4 Rules
-
-Each firewall rule has a
-number, an action to apply if the rule matches, and the ability to specify
-multiple matching criteria. Packets traverse rules numbered 1-999999, so order
-is crucial. The system executes the rule action at the first match.
-
-### Actions
-
-If you define a rule, you must define an action for it. The action tells the
-firewall what to do if all the criteria you define for that rule are met.
-
-The action can be:
-
-> - `accept`: Accept the packet.
-> - `continue`: Continue parsing the next rule.
-> - `drop`: Drop the packet.
-> - `reject`: Reject the packet.
-> - `jump`: Jump to another custom chain.
-> - `return`: Return from the current chain and continue at the next rule
->   of the last chain.
-> - `queue`: Enqueue packet to userspace.
-> - `synproxy`: Synproxy the packet.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return | synproxy]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return | synproxy]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return]
-
-   This required setting defines the action of the current rule. If you set
-   the action to jump, you must also specify a jump-target.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   jump-target <text>
-
-   Use this command only when the action is set to ``jump``. Specify the
-   jump target.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   queue <0-65535>
-
-   Use this command only when the action is set to ``queue``. Specify the
-   queue target to use. Queue range is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   queue-options bypass
-
-   Use this command only when the action is set to ``queue``. Allow the packet
-   to pass through the firewall when no userspace software is connected to the
-   queue.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   queue-options fanout
-
-   Use this command only when the action is set to ``queue``. Distribute
-   packets between several queues.
-```
-
-Also, **default-action** is an action that applies when a packet does not
-match any rule in its chain. For base chains, possible options for
-**default-action** are **accept** or **drop**.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> default-action
-   [accept | drop | jump | queue | reject | return]
-
-   This command sets the default action of the rule-set if a packet does not
-   match the criteria of any rule. If you set the default-action to ``jump``,
-   you must also specify ``default-jump-target``. Note that for base chains,
-   you can set the default action only to ``accept`` or ``drop``, while on
-   custom chains, more actions are available.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> default-jump-target <text>
-
-   Use this command only when you set ``default-action`` to ``jump``. Specify
-   the jump target for the default rule.
-```
-
-:::{note}
-**Important note about default-actions:**
-If you do not define a default action for a base chain, the system sets
-the default action to **accept** for that chain. For custom chains, if you
-do not define a default action, the system sets the default-action to
-**drop**.
-:::
-
-### Firewall Logs
-
-You can enable logging for every single firewall rule. If you enable logging,
-you can define other log options.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> log
-
-   Enable logging for the matched packet. If this command is not present, then
-   logging is not enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> default-log
-
-   Use this command to enable logging of the default action on the specified
-   chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-
-   Define the log level. Only applicable if you enable rule logging.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   log-options group <0-65535>
-
-   Define the log group to send messages to. Only applicable if you enable rule
-   logging.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   log-options snapshot-length <0-9000>
-
-   Define the length of packet payload to include in a netlink message. Only
-   applicable if you enable rule logging and define the log group.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   log-options queue-threshold <0-65535>
-
-   Define the number of packets to queue inside the kernel before sending them
-   to userspace. Only applicable if you enable rule logging and define the log
-   group.
-```
-
-### Firewall Description
-
-You can add a description for reference for every single rule and for every
-defined custom chain.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> description <text>
-
-   Provide a rule-set description for a custom firewall chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> description <text>
-
-   Provide a description for each rule.
-```
-
-### Rule Status
-
-When you define a rule, it is enabled by default. In some cases, it is useful
-to disable the rule rather than removing it.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> disable
-
-   Command for disabling a rule but keeping it in the configuration.
-```
-
-### Matching criteria
-
-There are a lot of matching criteria against which the packet can be tested.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   connection-status nat [destination | source]
-
-   Match based on nat connection status.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   connection-mark <1-2147483647>
-
-   Match based on connection mark.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   conntrack-helper <module>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   conntrack-helper <module>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   conntrack-helper <module>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   conntrack-helper <module>
-
-   Match based on connection tracking protocol helper module to secure use of
-   that helper module. See below for possible completions `<module>`.
-
-   .. code-block:: none
-
-      Possible completions:
-      ftp                  Related traffic from FTP helper
-      h323                 Related traffic from H.323 helper
-      pptp                 Related traffic from PPTP helper
-      nfs                  Related traffic from NFS helper
-      sip                  Related traffic from SIP helper
-      tftp                 Related traffic from TFTP helper
-      sqlnet               Related traffic from SQLNet helper
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination address [address | addressrange | CIDR]
-
-   Match criteria based on source and/or destination address. This is similar
-   to the network groups part, but here you are able to negate the matching
-   addresses.
-
-   .. code-block:: none
-
-      set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11
-      # with a '!' the rule match everything except the specified subnet
-      set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination address-mask [address]
-
-   An arbitrary netmask can be applied to mask addresses to only match against
-   a specific portion.
-
-   This functions for both individual addresses and address groups.
-
-   .. code-block:: none
-
-      # Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet
-      set firewall ipv4 name FOO rule 100 destination address 0.11.0.13
-      set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination fqdn <fqdn>
-
-   Specify a Fully Qualified Domain Name as source/destination to match. Ensure
-   that the router is able to resolve this dns query.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination geoip inverse-match
-
-   Match IP addresses based on its geolocation. More info: `geoip matching
-   <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_.
-   Use inverse-match to match anything except the given country-codes.
-```
-
-Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required,
-permits redistribution so we can include a database in images(~3MB
-compressed). Includes cron script (manually callable by op-mode update
-geoip) to keep database and rules updated.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source mac-address <mac-address>
-
-   You can only specify a source mac-address to match.
-
-   .. code-block:: none
-
-      set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33
-      set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-
-   A port can be set by number or name as defined in ``/etc/services``.
-
-   .. code-block:: none
-
-      set firewall ipv4 forward filter rule 10 source port '22'
-      set firewall ipv4 forward filter rule 11 source port '!http'
-      set firewall ipv4 forward filter rule 12 source port 'https'
-
-   Multiple source ports can be specified as a comma-separated list.
-   The whole list can also be "negated" using ``!``. For example:
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group address-group <name | !name>
-
-   Use a specific address-group. Prepending the character ``!`` to invert the
-   criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-
-   Use a specific dynamic-address-group. Prepending the character ``!`` to
-   invert the criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group network-group <name | !name>
-
-   Use a specific network-group. Prepending the character ``!`` to invert the
-   criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group port-group <name | !name>
-
-   Use a specific port-group. Prepending the character ``!`` to invert the
-   criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group domain-group <name | !name>
-
-   Use a specific domain-group. Prepending the character ``!`` to invert the
-   criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   destination group mac-group <name | !name>
-
-   Use a specific mac-group. Prepending the character ``!`` to invert the
-   criteria to match is also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-
-   Match based on dscp value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   fragment [match-frag | match-non-frag]
-
-   Match based on fragmentation.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   icmp [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   icmp [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   icmp [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   icmp [code | type] <0-255>
-
-   Match based on icmp code and type.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   icmp type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   icmp type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   icmp type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   icmp type-name <text>
-
-   Match based on icmp type-name. Use tab for information
-   about what **type-name** criteria are supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   inbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   inbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   inbound-interface name <iface>
-
-   Match based on inbound interface. Wildcard ``*`` is supported. For example:
-   ``eth2*``. Prepend the character ``!`` to invert the criteria. For example:
-   ``!eth2``
-```
-
-:::{note}
-If an interface is attached to a non-default vrf, when using
-**inbound-interface**, the vrf name must be used. For example `set firewall
-ipv4 forward filter rule 10 inbound-interface name MGMT`
-:::
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   inbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   inbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   inbound-interface group <iface_group>
-
-   Match based on the inbound interface group. Prepend the character ``!`` to
-   invert the criteria. For example, ``!IFACE_GROUP``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   outbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   outbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   outbound-interface name <iface>
-
-   Match based on outbound interface. Wildcard ``*`` is supported. For example:
-   ``eth2*``. Prepend the character ``!`` to invert the criteria. For example:
-   ``!eth2``
-```
-
-:::{note}
-If an interface is attached to a non-default vrf, when using
-**outbound-interface**, the real interface name must be used. For example
-`set firewall ipv4 forward filter rule 10 outbound-interface name eth0`
-:::
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   outbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   outbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   outbound-interface group <iface_group>
-
-   Match based on outbound interface group. Prepend the character ``!`` to
-   invert the criteria. For example: ``!IFACE_GROUP``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   ipsec [match-ipsec-in | match-none-in]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   ipsec [match-ipsec-out | match-none-out]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out]
-
-   Match based on ipsec.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   limit burst <0-4294967295>
-
-   Match based on the maximum number of packets to allow in excess of rate.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   limit rate <text>
-
-   Specify the maximum average rate as **integer/unit**. For example:
-   **5/minutes**
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   packet-length-exclude <text>
-
-   Match based on packet length. Specify multiple values from 1 to 65535 and
-   ranges.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-
-   Match based on the packet type.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-
-   Match based on protocol number or name as defined in ``/etc/protocols``.
-   Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP
-   based packets. The ``!`` character negates the selected protocol.
-
-   .. code-block:: none
-
-      set firewall ipv4 forward filter rule 10 protocol tcp_udp
-      set firewall ipv4 forward filter rule 11 protocol !tcp_udp
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   recent time [second | minute | hour]
-
-   Match based on recently seen sources.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   tcp flags [not] <text>
-
-   Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``,
-   ``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use
-   ``not`` for inverted selection, as shown in the example.
-
-   .. code-block:: none
-
-      set firewall ipv4 input filter rule 10 tcp flags 'ack'
-      set firewall ipv4 input filter rule 12 tcp flags 'syn'
-      set firewall ipv4 input filter rule 13 tcp flags not 'fin'
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   state [established | invalid | new | related]
-
-   Match against the state of a packet.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   time weekdays <text>
-
-   Time to match the defined rule.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   ttl <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   ttl <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   ttl <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   ttl <eq | gt | lt> <0-255>
-
-   Match the time to live parameter, where 'eq' means 'equal', 'gt' means
-   'greater than', and 'lt' means 'less than'.
-```
-
-### Packet Modifications
-
-Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify
-packets before sending them out. This feature provides more flexibility in
-packet handling.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999>
-   set dscp <0-63>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   set dscp <0-63>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
-   set dscp <0-63>
-
-   Set a specific value of Differentiated Services Codepoint (DSCP).
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999>
-   set mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   set mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
-   set mark <1-2147483647>
-
-   Set a specific packet mark value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999>
-   set tcp-mss <500-1460>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   set tcp-mss <500-1460>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
-   set tcp-mss <500-1460>
-
-   Set the TCP-MSS (TCP maximum segment size) for the connection.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999>
-   set ttl <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   set ttl <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
-   set ttl <0-255>
-
-   Set the TTL (Time to Live) value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   set connection-mark <0-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
-   set connection-mark <0-2147483647>
-
-   Set connection mark value.
-```
-
-## Synproxy
-
-Synproxy connections
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
-   action synproxy
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
-   protocol tcp
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
-   synproxy tcp mss <501-65535>
-
-    Set the TCP-MSS (maximum segment size) for the connection
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
-   synproxy tcp window-scale <1-14>
-
-    Set the window scale factor for TCP window scaling
-```
-
-### Example synproxy
-
-Requirements to enable synproxy:
-
-> - Traffic must be symmetric.
-> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled.
-> - Disable conntrack loose track option.
-
-```none
-set system sysctl parameter net.ipv4.tcp_timestamps value '1'
-
-set system conntrack tcp loose disable
-set system conntrack ignore ipv4 rule 10 destination port '8080'
-set system conntrack ignore ipv4 rule 10 protocol 'tcp'
-set system conntrack ignore ipv4 rule 10 tcp flags syn
-
-set firewall global-options syn-cookies 'enable'
-set firewall ipv4 input filter rule 10 action 'synproxy'
-set firewall ipv4 input filter rule 10 destination port '8080'
-set firewall ipv4 input filter rule 10 inbound-interface name 'eth1'
-set firewall ipv4 input filter rule 10 protocol 'tcp'
-set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
-set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
-set firewall ipv4 input filter rule 1000 action 'drop'
-set firewall ipv4 input filter rule 1000 state invalid
-```
-
-## Operation-mode Firewall
-
-### Rule-set overview
-
-```{eval-rst}
-.. opcmd:: show firewall
-
-   This will show you a basic firewall overview, for all rule-sets, not
-   only for IPv4.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall
-      Rulesets Information
-
-      ---------------------------------
-      ipv4 Firewall "forward filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  -----------------------------
-      20       accept    all                 0        0  ip saddr @N_TRUSTEDv4  accept
-      21       jump      all                 0        0  jump NAME_AUX
-      default  accept    all                 0        0
-
-      ---------------------------------
-      ipv4 Firewall "input filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  -------------------------
-      10       accept    all               156    14377  iifname != @I_LAN  accept
-      default  accept    all                 0        0
-
-      ---------------------------------
-      ipv4 Firewall "name AUX"
-
-        Rule  Action    Protocol      Packets    Bytes  Conditions
-      ------  --------  ----------  ---------  -------  --------------------------------------------
-          10  accept    icmp                0        0  meta l4proto icmp  accept
-          20  accept    udp                 0        0  meta l4proto udp ip saddr @A_SERVERS  accept
-          30  drop      all                 0        0  ip saddr != @A_SERVERS iifname "eth2"
-
-      ---------------------------------
-      ipv4 Firewall "output filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  ----------------------------------------
-      10       reject    all                 0        0  oifname @I_LAN
-      20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
-      default  accept    all                72     9258
-
-      ---------------------------------
-      ipv6 Firewall "input filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  -------------------------------
-      10       accept    all                 0        0  ip6 saddr @N6_TRUSTEDv6  accept
-      default  accept    all                 2      112
-
-      vyos@vyos:~$
-```
-
-```{eval-rst}
-.. opcmd:: show firewall summary
-
-   This shows you a summary of rule-sets and groups.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall summary
-      Ruleset Summary
-
-      IPv6 Ruleset:
-
-      Ruleset Hook    Ruleset Priority      Description
-      --------------  --------------------  -------------------------
-      forward         filter
-      input           filter
-      ipv6_name       IPV6-VyOS_MANAGEMENT
-      ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
-
-      IPv4 Ruleset:
-
-      Ruleset Hook    Ruleset Priority    Description
-      --------------  ------------------  -------------------------
-      forward         filter
-      input           filter
-      name            VyOS_MANAGEMENT
-      name            WAN_IN              PUBLIC_INTERNET
-
-      Firewall Groups
-
-      Name                     Type                References               Members
-      -----------------------  ------------------  -----------------------  ----------------
-      PBX                      address_group       WAN_IN-100               198.51.100.77
-      SERVERS                  address_group       WAN_IN-110               192.0.2.10
-                                                   WAN_IN-111               192.0.2.11
-                                                   WAN_IN-112               192.0.2.12
-                                                   WAN_IN-120
-                                                   WAN_IN-121
-                                                   WAN_IN-122
-      SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
-                                                   WAN_IN-20
-      PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
-      PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
-                                                   WAN_IN-171
-      PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
-      SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
-                                                   IPV6-WAN_IN-111          2001:db8::3
-                                                   IPV6-WAN_IN-112          2001:db8::4
-                                                   IPV6-WAN_IN-120
-                                                   IPV6-WAN_IN-121
-                                                   IPV6-WAN_IN-122
-      SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
-                                                   IPV6-WAN_IN-20
-
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv4 [forward | input | output] filter
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv4 name <name>
-
-   This command will give an overview of a single rule-set.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall ipv4 input filter
-      Ruleset Information
-
-      ---------------------------------
-      IPv4 Firewall "input filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  -----------------------------------------
-      5        jump      all                 0        0  iifname "eth2"  jump NAME_VyOS_MANAGEMENT
-      default  accept    all
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv4 [forward | input | output]
-   filter rule <1-999999>
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv4 name <name> rule <1-999999>
-
-   This command gives an overview of a rule in a single rule-set, plus
-   information for default action.
-```
-
-```none
-vyos@vyos:~$show firewall ipv4 output filter rule 20
-Rule Information
-
----------------------------------
-ipv4 Firewall "output filter"
-
-Rule     Action    Protocol      Packets    Bytes  Conditions
--------  --------  ----------  ---------  -------  ----------------------------------------
-20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
-default  accept    all               286    47614
-
-vyos@vyos:~$
-```
-
-```{eval-rst}
-.. opcmd:: show firewall statistics
-
-   This will show you statistics of all rule-sets since the last boot.
-```
-
-### Show Firewall log
-
-```{eval-rst}
-.. opcmd:: show log firewall
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4 [forward | input | output | name]
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4 [forward | input | output] filter
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4 name <name>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4 [forward | input | output] filter rule <rule>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv4 name <name> rule <rule>
-
-   Show the logs of all firewall; show all IPv4 firewall logs; show all logs
-   for particular hook; show all logs for particular hook and priority;
-   show all logs for particular custom chain; show logs for specific rule-set.
-```
-
-### Example Partial Config
-
-```none
-firewall {
-    group {
-        network-group BAD-NETWORKS {
-            network 198.51.100.0/24
-            network 203.0.113.0/24
-        }
-        network-group GOOD-NETWORKS {
-            network 192.0.2.0/24
-        }
-        port-group BAD-PORTS {
-            port 65535
-        }
-    }
-    ipv4 {
-        forward {
-            filter {
-                default-action accept
-                rule 5 {
-                    action accept
-                    source {
-                        group {
-                            network-group GOOD-NETWORKS
-                        }
-                    }
-                }
-                rule 10 {
-                    action drop
-                    description "Bad Networks"
-                    protocol all
-                    source {
-                        group {
-                            network-group BAD-NETWORKS
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-```
-
-### Update geoip database
-
-```{eval-rst}
-.. opcmd:: update geoip
-
-   Command to update GeoIP database and firewall sets.
-```
diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md
deleted file mode 100644
index f732ec44..00000000
--- a/docs/configuration/firewall/md-ipv6.md
+++ /dev/null
@@ -1,2131 +0,0 @@
----
-lastproofread: '2026-04-01'
----
-
-(firewall-ipv6-configuration)=
-
-# IPv6 Firewall Configuration
-
-## Overview
-
-This section covers useful information about IPv6 firewall configuration and
-appropriate operation-mode commands.
-
-This section describes the following configuration commands:
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 ...
-```
-
-To learn about the general traffic flow in VyOS firewalls,
-see {doc}`Firewall </configuration/firewall/index>`.
-
-```none
-- set firewall
-    * ipv6
-         - forward
-            + filter
-         - input
-            + filter
-         - output
-            + filter
-            + raw
-         - prerouting
-            + raw
-         - name
-            + custom_name
-```
-
-The router first receives all traffic and processes it in the **prerouting**
-section.
-
-This stage includes:
-
-> - **Firewall Prerouting**: commands found under `set firewall ipv6
->   prerouting raw ...`
-> - {doc}`Conntrack Ignore</configuration/system/conntrack>`: `set system
->   conntrack ignore ipv6...`
-> - {doc}`Policy Route</configuration/policy/route>`: commands found under
->   `set policy route6 ...`
-> - {doc}`Destination NAT</configuration/nat/nat44>`: commands found under
->   `set nat66 destination ...`
-
-For transit traffic that the router receives and forwards, the base chain is
-**forward**. The following diagram shows a simplified packet flow for transit
-traffic:
-
-:::{figure} /_static/images/firewall-fwd-packet-flow.webp
-:::
-
-Use `set firewall ipv6 forward filter ...` to configure filtering rules for
-transit traffic. This command corresponds to stage 5 and is highlighted in red
-in the diagram.
-
-For traffic destined to the router, use the **input** chain. For traffic the
-router generates, use the **output** chain. The following diagram shows the
-packet flow for traffic destined to the router and traffic generated by the
-router (starting from circle number 6):
-
-:::{figure} /_static/images/firewall-input-packet-flow.webp
-:::
-
-Use `set firewall ipv6 input filter ...` to configure traffic destined to
-the router.
-
-Use `set firewall ipv6 output ...` to configure traffic the router generates.
-Two sub-chains are available: **filter** and **raw**:
-
-- **Output Prerouting**: `set firewall ipv6 output raw ...`.
-  As described in **Prerouting**, the firewall processes rules in this
-  section before the connection tracking subsystem.
-- **Output Filter**: `set firewall ipv6 output filter ...`. The firewall
-  processes rules in this section after the connection tracking subsystem.
-
-:::{note}
-**Important note about default-actions:**
-If you do not define a default action for a base chain, the system sets
-the default action to **accept** for that chain. For custom chains, if you
-do not define a default action, the system sets the default-action to
-**drop**
-:::
-
-Create custom firewall chains using the commands
-`set firewall ipv6 name <name> ...`. To use the custom chain, define a
-rule with **action jump** and the appropriate **target** in a base chain.
-
-## Firewall - IPv6 Rules
-
-Create firewall rules for firewall filtering. Each rule is numbered and has
-an action to apply when the rule is matched. You can specify multiple matching
-criteria. Packets go through rules from 1 - 999999, so order is crucial. The
-firewall executes the action of the first matching rule.
-
-### Actions
-
-If you define a rule, you must define an action for it. The action tells the
-firewall what to do when all criteria for that rule are met.
-
-The action can be :
-
-> - `accept`: accept the packet.
-> - `continue`: continue parsing next rule.
-> - `drop`: drop the packet.
-> - `reject`: reject the packet.
-> - `jump`: jump to another custom chain.
-> - `return`: Return from the current chain and continue at the next rule
->   of the last chain.
-> - `queue`: Enqueue packet to userspace.
-> - `synproxy`: synproxy the packet.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return | synproxy]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return | synproxy]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> action
-   [accept | continue | drop | jump | queue | reject | return]
-
-   This required setting defines the action of the current rule. If you set
-   the action to jump, you must also define a jump-target.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   jump-target <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   jump-target <text>
-
-   Use this command only when action is set to ``jump``. Specify the jump
-   target.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   queue <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   queue <0-65535>
-
-   Use this command only when action is set to ``queue``. Specify the queue
-   target. Queue ranges are also supported.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   queue-options bypass
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   queue-options bypass
-
-   Use this command only when action is set to ``queue``. This command allows
-   the packet to go through the firewall when no userspace software is connected
-   to the queue.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   queue-options fanout
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   queue-options fanout
-
-   Use this command only when action is set to ``queue``. This command
-   distributes packets among multiple queues.
-```
-
-Also, **default-action** is an action that takes place whenever a packet does
-not match any rule in its chain. For base chains, possible options for
-**default-action** are **accept** or **drop**.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter default-action
-   [accept | drop]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> default-action
-   [accept | drop | jump | queue | reject | return]
-
-   Set the default action of the rule-set if a packet does not match any rule
-   criteria. If you set default-action to ``jump``, you must also define
-   ``default-jump-target``. For base chains, you can only set the default
-   action to ``accept`` or ``drop``. For custom chains, more actions are
-   available.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> default-jump-target <text>
-
-   To be used only when ``default-action`` is set to ``jump``. Use this
-   command to specify the jump target for the default rule.
-```
-
-:::{note}
-**Important note about default-actions:**
-If you do not define the default action for a base chain, the system sets
-the default action to **accept** for that chain. For custom chains, if you
-do not define a default action, the system sets the default-action to
-**drop**.
-:::
-
-### Firewall Logs
-
-You can enable logging for each firewall rule. When enabled, you can also
-define other log options.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> log
-
-   Enable logging for matched packets. If this configuration command is not
-   present, logging is disabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter default-log
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> default-log
-
-   Use this command to enable the logging of the default action on
-   the specified chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   log-options level [emerg | alert | crit | err | warn | notice
-   | info | debug]
-
-   Define log-level. Only applicable if rule log is enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   log-options group <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   log-options group <0-65535>
-
-   Define the log group to send messages to. Only applicable if rule log is
-   enabled.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   log-options snapshot-length <0-9000>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   log-options snapshot-length <0-9000>
-
-   Define the length of packet payload to include in a netlink message. Only
-   applicable when rule logging is enabled and log group is defined.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   log-options queue-threshold <0-65535>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   log-options queue-threshold <0-65535>
-
-   Define the number of packets to queue inside the kernel before sending them
-   to userspace. Only applicable when rule logging is enabled and log group is
-   defined.
-```
-
-### Firewall Description
-
-For reference, you can define descriptions on every rule and custom chain.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> description <text>
-
-   Provide a rule-set description to a custom firewall chain.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   description <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> description <text>
-
-   Provide a description for each rule.
-```
-
-### Rule Status
-
-New rules are enabled by default. In some cases, you may want to disable a
-rule rather than remove it.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> disable
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> disable
-
-   Command for disabling a rule but keep it in the configuration.
-```
-
-### Matching criteria
-
-There are a lot of matching criteria against which the packet can be tested.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   connection-status nat [destination | source]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   connection-status nat [destination | source]
-
-   Match packets based on NAT connection status.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   connection-mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   connection-mark <1-2147483647>
-
-   Match packets based on connection mark.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination address [address | addressrange | CIDR]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination address [address | addressrange | CIDR]
-
-   Match based on source or destination address. This is similar to network
-   groups, but you can negate the matching addresses here.
-
-   .. code-block:: none
-
-      set firewall ipv6 name FOO rule 100 source address 2001:db8::202
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination address-mask [address]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination address-mask [address]
-
-   Apply an arbitrary netmask to mask addresses and match only a specific
-   portion. This is useful for IPv6 because rules remain valid when the IPv6
-   prefix changes if the host portion of the system's IPv6 address is static.
-   Examples include SLAAC and `tokenised IPv6 addresses
-   <https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-
-   identifiers-02.txt>`_
-
-   This function works for both individual addresses and address groups.
-
-   .. stop_vyoslinter
-   .. code-block:: none
-
-      # Match any IPv6 address with the suffix ::0000:0000:0000:beef
-      set firewall ipv6 forward filter rule 100 destination address ::beef
-      set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff
-      # Address groups
-      set firewall group ipv6-address-group WEBSERVERS address ::1000
-      set firewall group ipv6-address-group WEBSERVERS address ::2000
-      set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS
-      set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff
-
-   .. start_vyoslinter
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination fqdn <fqdn>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination fqdn <fqdn>
-
-   Specify a Fully Qualified Domain Name as source or destination to match.
-   Ensure that the router can resolve the DNS query.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination geoip country-code <country>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination geoip inverse-match
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination geoip inverse-match
-
-   Match IP addresses based on their geolocation. For more information, see
-   `GeoIP matching <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_
-   matching>`_. Use inverse-match to match anything except the specified
-   country codes.
-```
-
-DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and
-redistribution is permitted, allowing VyOS to include a database in images
-(approximately 3 MB compressed). The package includes a cron script that you
-can manually call through op-mode update geoip to keep the database and rules
-updated.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source mac-address <mac-address>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source mac-address <mac-address>
-
-   You can specify only a source MAC address to match.
-
-   .. code-block:: none
-
-      set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33
-      set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination port [1-65535 | portname | start-end]
-
-   Specify a port by number or by name as defined in ``/etc/services``.
-
-   .. code-block:: none
-
-      set firewall ipv6 forward filter rule 10 source port '22'
-      set firewall ipv6 forward filter rule 11 source port '!http'
-      set firewall ipv6 forward filter rule 12 source port 'https'
-
-   Multiple source ports can be specified as a comma-separated list.
-   The whole list can also be "negated" using ``!``. For example:
-
-   .. code-block:: none
-
-      set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338'
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group address-group <name | !name>
-
-   Specify an address group. You can prepend the character ``!`` to invert the
-   matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group dynamic-address-group <name | !name>
-
-   Specify a dynamic address group. You can prepend the character ``!`` to
-   invert the matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group network-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group network-group <name | !name>
-
-   Specify a network group. You can prepend the character ``!`` to invert the
-   matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group port-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group port-group <name | !name>
-
-   Specify a port group. You can prepend the character ``!`` to invert the
-   matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group domain-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group domain-group <name | !name>
-
-   Specify a domain group. You can prepend the character ``!`` to invert the
-   matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   source group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   destination group mac-group <name | !name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   destination group mac-group <name | !name>
-
-   Specify a MAC group. You can prepend the character ``!`` to invert the
-   matching criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   dscp [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   dscp-exclude [0-63 | start-end]
-
-   Match based on dscp value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   fragment [match-frag | match-non-frag]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   fragment [match-frag | match-non-frag]
-
-   Match packets based on fragmentation.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   icmpv6 [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   icmpv6 [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   icmpv6 [code | type] <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   icmpv6 [code | type] <0-255>
-
-   Match packets based on ICMP or ICMPv6 code and type.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   icmpv6 type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   icmpv6 type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   icmpv6 type-name <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   icmpv6 type-name <text>
-
-   Match based on ICMPv6 type-name. Press **Tab** for information about
-   supported **type-name** criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   inbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   inbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   inbound-interface name <iface>
-
-   Match based on inbound interface. You can use the wildcard ``*``. For
-   example: ``eth2*``. You can prepend the character ``!`` to invert the
-   matching criteria. For example ``!eth2``
-```
-
-:::{note}
-If an interface is attached to a non-default VRF, when using
-**inbound-interface**, use the VRF name. For example:
-`set firewall ipv6 forward filter rule 10 inbound-interface name MGMT`
-:::
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   inbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   inbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   inbound-interface group <iface_group>
-
-   Match based on the inbound interface group. You can prepend the character
-   ``!`` to invert the matching criteria. For example ``!IFACE_GROUP``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   outbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   outbound-interface name <iface>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   outbound-interface name <iface>
-
-   Match based on outbound interface. You can use the wildcard ``*``. For
-   example: ``eth2*``. You can prepend the character ``!`` to invert the
-   matching criteria. For example ``!eth2``
-```
-
-:::{note}
-If an interface is attached to a non-default VRF, when using
-**outbound-interface**, use the physical interface name. For example:
-`set firewall ipv6 forward filter rule 10 outbound-interface name eth0`
-:::
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   outbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   outbound-interface group <iface_group>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   outbound-interface group <iface_group>
-
-   Match based on outbound interface group. You can prepend the character ``!``
-   to invert the matching criteria. For example ``!IFACE_GROUP``
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   ipsec [match-ipsec-in | match-none-in]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   ipsec [match-ipsec-out | match-none-out]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out]
-
-   Match packets based on IPsec.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   limit burst <0-4294967295>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   limit burst <0-4294967295>
-
-   Match based on the maximum number of packets allowed to exceed the rate
-   limit.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   limit rate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   limit rate <text>
-
-   Match based on the maximum average rate, specified as ``integer/unit``.
-   For example, specify ``5/minutes``.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   packet-length <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   packet-length-exclude <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   packet-length-exclude <text>
-
-   Match based on packet length. You can specify multiple values from 1 to
-   65535 and ranges.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   packet-type [broadcast | host | multicast | other]
-
-   Match based on packet type.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   protocol [<text> | <0-255> | all | tcp_udp]
-
-   Match based on protocol number or name as defined in ``/etc/protocols``.
-   Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets.
-   Prepend ``!`` to negate the protocol selection.
-
-   .. code-block:: none
-
-      set firewall ipv6 input filter rule 10 protocol tcp
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   recent time [second | minute | hour]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   recent time [second | minute | hour]
-
-   Match packets based on recently seen sources.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   tcp flags [not] <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   tcp flags [not] <text>
-
-   Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``,
-   ``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert
-   the selection, use ``not``, as shown in the following example.
-
-   .. code-block:: none
-
-      set firewall ipv6 input filter rule 10 tcp flags 'ack'
-      set firewall ipv6 input filter rule 12 tcp flags 'syn'
-      set firewall ipv6 input filter rule 13 tcp flags not 'fin'
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   state [established | invalid | new | related]
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   state [established | invalid | new | related]
-
-   Match based on packet state.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   time startdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   time starttime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   time stopdate <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   time stoptime <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   time weekdays <text>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   time weekdays <text>
-
-   Match packets based on time criteria.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   hop-limit <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   hop-limit <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   hop-limit <eq | gt | lt> <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   hop-limit <eq | gt | lt> <0-255>
-
-   Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than,
-   and ``lt`` for less than.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
-   recent time <second | minute | hour>
-
-   Match when the specified number of connections occur within the specified
-   time period. Use these criteria to block brute-force attempts.
-```
-
-### Packet Modifications
-
-The firewall can modify packets before sending them.
-This feature provides more flexibility for packet handling.
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999>
-   set dscp <0-63>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   set dscp <0-63>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
-   set dscp <0-63>
-
-   Set a specific value of Differentiated Services Codepoint (DSCP).
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999>
-   set mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   set mark <1-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
-   set mark <1-2147483647>
-
-   Set a specific packet mark value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999>
-   set tcp-mss <500-1460>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   set tcp-mss <500-1460>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
-   set tcp-mss <500-1460>
-
-   Set the TCP-MSS (TCP maximum segment size) for the connection.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999>
-   set hop-limit <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   set hop-limit <0-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
-   set hop-limit <0-255>
-
-   Set hop limit value.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
-   set connection-mark <0-2147483647>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
-   set connection-mark <0-2147483647>
-
-   Set connection mark value.
-```
-
-## Synproxy
-
-Synproxy connections
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
-   action synproxy
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
-   protocol tcp
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
-   synproxy tcp mss <501-65535>
-
-    Set the TCP MSS (maximum segment size) for the connection.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
-   synproxy tcp window-scale <1-14>
-
-    Set the window scale factor for TCP window scaling.
-```
-
-### Example synproxy
-
-Requirements to enable synproxy:
-
-> - Traffic must be symmetric
-> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
-> - Disable conntrack loose track option
-
-```none
-set system sysctl parameter net.ipv4.tcp_timestamps value '1'
-
-set system conntrack tcp loose disable
-set system conntrack ignore ipv6 rule 10 destination port '8080'
-set system conntrack ignore ipv6 rule 10 protocol 'tcp'
-set system conntrack ignore ipv6 rule 10 tcp flags syn
-
-set firewall global-options syn-cookies 'enable'
-set firewall ipv6 input filter rule 10 action 'synproxy'
-set firewall ipv6 input filter rule 10 destination port '8080'
-set firewall ipv6 input filter rule 10 inbound-interface name 'eth1'
-set firewall ipv6 input filter rule 10 protocol 'tcp'
-set firewall ipv6 input filter rule 10 synproxy tcp mss '1460'
-set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7'
-set firewall ipv6 input filter rule 1000 action 'drop'
-set firewall ipv6 input filter rule 1000 state invalid
-```
-
-## Operation-mode Firewall
-
-### Rule-set overview
-
-```{eval-rst}
-.. opcmd:: show firewall
-
-   Show a basic firewall overview for all rule-sets, not only for IPv6:
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall
-      Rulesets Information
-
-      ---------------------------------
-      IPv4 Firewall "forward filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  -----------------------------------------
-      5        jump      all                 0        0  iifname "eth1"  jump NAME_VyOS_MANAGEMENT
-      10       jump      all                 0        0  oifname "eth1"  jump NAME_WAN_IN
-      15       jump      all                 0        0  iifname "eth3"  jump NAME_WAN_IN
-      default  accept    all
-
-      ---------------------------------
-      IPv4 Firewall "name VyOS_MANAGEMENT"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  --------------------------------
-      5        accept    all                 0        0  ct state established  accept
-      10       drop      all                 0        0  ct state invalid
-      20       accept    all                 0        0  ip saddr @A_GOOD_GUYS  accept
-      30       accept    all                 0        0  ip saddr @N_ENTIRE_RANGE  accept
-      40       accept    all                 0        0  ip saddr @A_VyOS_SERVERS  accept
-      50       accept    icmp                0        0  meta l4proto icmp  accept
-      default  drop      all                 0        0
-
-      ---------------------------------
-      IPv6 Firewall "forward filter"
-
-      Rule     Action    Protocol
-      -------  --------  ----------
-      5        jump      all
-      10       jump      all
-      15       jump      all
-      default  accept    all
-
-      ---------------------------------
-      IPv6 Firewall "input filter"
-
-      Rule     Action    Protocol
-      -------  --------  ----------
-      5        jump      all
-      default  accept    all
-
-      ---------------------------------
-      IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT"
-
-      Rule     Action    Protocol
-      -------  --------  ----------
-      5        accept    all
-      10       drop      all
-      20       accept    all
-      30       accept    all
-      40       accept    all
-      50       accept    ipv6-icmp
-      default  drop      all
-```
-
-```{eval-rst}
-.. opcmd:: show firewall summary
-
-   This will show you a summary of rule-sets and groups
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall summary
-      Ruleset Summary
-
-      IPv6 Ruleset:
-
-      Ruleset Hook    Ruleset Priority      Description
-      --------------  --------------------  -------------------------
-      forward         filter
-      input           filter
-      ipv6_name       IPV6-VyOS_MANAGEMENT
-      ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
-
-      IPv4 Ruleset:
-
-      Ruleset Hook    Ruleset Priority    Description
-      --------------  ------------------  -------------------------
-      forward         filter
-      input           filter
-      name            VyOS_MANAGEMENT
-      name            WAN_IN              PUBLIC_INTERNET
-
-      Firewall Groups
-
-      Name                     Type                References               Members
-      -----------------------  ------------------  -----------------------  ----------------
-      PBX                      address_group       WAN_IN-100               198.51.100.77
-      SERVERS                  address_group       WAN_IN-110               192.0.2.10
-                                                   WAN_IN-111               192.0.2.11
-                                                   WAN_IN-112               192.0.2.12
-                                                   WAN_IN-120
-                                                   WAN_IN-121
-                                                   WAN_IN-122
-      SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
-                                                   WAN_IN-20
-      PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
-      PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
-                                                   WAN_IN-171
-      PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
-      SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
-                                                   IPV6-WAN_IN-111          2001:db8::3
-                                                   IPV6-WAN_IN-112          2001:db8::4
-                                                   IPV6-WAN_IN-120
-                                                   IPV6-WAN_IN-121
-                                                   IPV6-WAN_IN-122
-      SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
-                                                   IPV6-WAN_IN-20
-
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv6 [forward | input | output] filter
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv6 ipv6-name <name>
-
-   This command will give an overview of a single rule-set.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall ipv6 input filter
-      Ruleset Information
-
-      ---------------------------------
-      ipv6 Firewall "input filter"
-
-      Rule     Action    Protocol      Packets    Bytes  Conditions
-      -------  --------  ----------  ---------  -------  ------------------------------------------------------------------------------
-      10       jump      all                13     1456  iifname "eth1"  jump NAME6_INP-ETH1
-      20       accept    ipv6-icmp          10     1112  meta l4proto ipv6-icmp iifname "eth0"  prefix "[ipv6-INP-filter-20-A]"  accept
-      default  accept    all                14     1584
-
-      vyos@vyos:~$
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv6 [forward | input | output]
-   filter rule <1-999999>
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv6 name <name> rule <1-999999>
-```
-
-```{eval-rst}
-.. opcmd:: show firewall ipv6 ipv6-name <name> rule <1-999999>
-
-   This command will give an overview of a rule in a single rule-set
-```
-
-```{eval-rst}
-.. opcmd:: show firewall group <name>
-
-   Show an overview of defined groups, including the type, members, and where
-   the group is used.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall group LAN
-      Firewall Groups
-
-      Name          Type                References               Members
-      ------------  ------------------  -----------------------  ----------------
-      LAN           ipv6_network_group  IPV6-VyOS_MANAGEMENT-30  2001:db8::0/64
-                                        IPV6-WAN_IN-30
-      LAN           network_group       VyOS_MANAGEMENT-30       192.168.200.0/24
-                                        WAN_IN-30
-
-```
-
-```{eval-rst}
-.. opcmd:: show firewall statistics
-
-   Show statistics of all rule-sets since the last boot.
-```
-
-### Show Firewall log
-
-```{eval-rst}
-.. opcmd:: show log firewall
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6 [forward | input | output | name]
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6 [forward | input | output] filter
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6 name <name>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6 [forward | input | output] filter rule <rule>
-```
-
-```{eval-rst}
-.. opcmd:: show log firewall ipv6 name <name> rule <rule>
-
-   Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks,
-   specific priorities, specific custom chains, or specific rule-sets.
-```
-
-### Example Partial Config
-
-```none
-firewall {
-    ipv6 {
-        input {
-            filter {
-                rule 10 {
-                    action jump
-                    inbound-interface {
-                        name eth1
-                    }
-                    jump-target INP-ETH1
-                }
-                rule 20 {
-                    action accept
-                    inbound-interface {
-                        name eth0
-                    }
-                    log
-                    protocol ipv6-icmp
-                }
-            }
-        }
-        name INP-ETH1 {
-            default-action drop
-            default-log
-            rule 10 {
-                action accept
-                protocol tcp_udp
-            }
-        }
-    }
-}
-```
-
-### Update geoip database
-
-```{eval-rst}
-.. opcmd:: update geoip
-
-   Command used to update GeoIP database and firewall sets.
-```
diff --git a/docs/configuration/firewall/md-zone.md b/docs/configuration/firewall/md-zone.md
deleted file mode 100644
index 948c5b43..00000000
--- a/docs/configuration/firewall/md-zone.md
+++ /dev/null
@@ -1,221 +0,0 @@
----
-lastproofread: '2026-03-30'
----
-
-(firewall-zone)=
-
-# Zone-Based Firewall
-
-## Overview
-
-:::{note}
-All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support
-this feature.
-:::
-
-This section provides information on firewall configuration for the
-zone-based firewall. This section covers the following configuration
-commands:
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone ...
-```
-
-To learn about the general traffic flow in VyOS firewalls,
-see {doc}`Firewall </configuration/firewall/index>`.
-
-```none
-- set firewall
-    * zone
-         - custom_zone_name
-            + ...
-```
-
-In zone-based policy, you assign interfaces to zones and apply inspection
-policy to traffic moving between zones. The firewall acts on traffic
-according to rules. A zone is a group of interfaces that have similar
-functions or features. It establishes the security borders of a network.
-A zone defines a boundary where the system subjects traffic to policy
-restrictions as it crosses to another region of a network.
-
-Key Points:
-
-- A zone must be configured before you assign an interface to it, and you
-  can assign an interface to only a single zone.
-- All traffic to and from an interface within a zone flows freely.
-- Existing policies affect all traffic between zones.
-- Traffic cannot flow between a zone member interface and any interface that
-  is not a zone member.
-- You must define 2 separate firewalls to define traffic: one for each
-  direction.
-
-:::{note}
-In {vytask}`T2199` the syntax of the zone configuration was changed.
-The zone configuration moved from `zone-policy zone <name>` to `firewall
-zone <name>`.
-:::
-
-## Configuration
-
-As an alternative to applying policy to an interface directly, you can
-create a zone-based firewall to simplify configuration when multiple
-interfaces belong to the same security zone. Instead of applying rule-sets
-to interfaces, you apply them to source-destination zone pairs.
-
-You can find a basic introduction to zone-based firewalls in the
-[VyOS Knowledge Base](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall),
-and an example at {ref}`examples-zone-policy`.
-
-The following steps are required to create a zone-based firewall:
-
-1. Define both the source and destination zones
-2. Define the rule-set
-3. Apply the rule-set to the zones
-
-### Define a Zone
-
-To define a zone, set up either one with interfaces or as the local zone.
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <name> interface <interface>
-
-   Assign interfaces as a member of a zone.
-
-   .. note::
-
-      * An interface can only be a member of one zone.
-      * You can have multiple interfaces in a zone. Traffic between
-        interfaces in the same zone follows the intra-zone-filtering
-        policy (allowed by default).
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <name> local-zone
-
-   Define the zone as the local zone for traffic that originates from or is
-   destined to the router itself.
-
-   .. note::
-
-      * A local zone cannot have any member interfaces
-      * You cannot have multiple local zones
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <name> default-action [drop | reject]
-
-   Modify the zone default-action, which applies to traffic destined to this
-   zone that does not match any of the source zone rulesets applied.
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <name> default-log
-
-   Enable logging of packets that match this zone's default-action (disabled
-   by default).
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <name> description
-
-   Add a meaningful description.
-```
-
-### Defining a Rule-Set
-
-Zone-based firewall rule-sets define traffic from a *Source Zone* to a
-*Destination Zone*.
-
-You create rule-sets as a custom firewall chain using the commands below
-(refer to the firewall IPv4/IPv6 sections for the full syntax):
-
-- For {ref}`IPv4<configuration/firewall/ipv4:Firewall - IPv4 Rules>`:
-  `set firewall ipv4 name <name> ...`
-- For {ref}`IPv6<configuration/firewall/ipv6:Firewall - IPv6 Rules>`:
-  `set firewall ipv6 name <name> ...`
-
-It is helpful to name the rule-sets in the format
-`<Source Zone>-<Destination Zone>-<v4 | v6>` to make them easily
-identifiable.
-
-### Applying a Rule-Set to a Zone
-
-After you define a rule-set, apply it to the source and destination zones.
-The configuration syntax anchors to the destination zone, with each of the
-source zone rule-sets listed against the destination.
-
-```{eval-rst}
-.. cfgcmd::  set firewall zone <Destination Zone> from <Source Zone>
-   firewall name <ipv4-rule-set-name>
-```
-
-```{eval-rst}
-.. cfgcmd::  set firewall zone <Destination Zone> from <Source Zone>
-   firewall ipv6-name <ipv6-rule-set-name>
-```
-
-You should create two rule-sets for each source-destination zone
-pair.
-
-```none
-set firewall zone DMZ from LAN firewall name LAN-DMZ-v4
-set firewall zone LAN from DMZ firewall name DMZ-LAN-v4
-```
-
-### Applying a Default Rule-Set to a Zone
-
-When a destination zone shares a common rule-set for multiple source zones,
-or when you require a complex set of default policies, you can apply an
-optional default rule-set. The default rule-set applies to all zones that do
-not have a rule-set configured as defined in
-{ref}`IPv4<configuration/firewall/zone:Applying a Rule-Set to a Zone>`
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <Destination Zone> default-firewall name
-   <ipv4-rule-set-name>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall zone <Destination Zone> default-firewall ipv6-name
-   <ipv6-rule-set-name>
-```
-
-## Operation-mode
-
-```{eval-rst}
-.. opcmd:: show firewall zone-policy
-
-   Display a basic summary of the zone configuration.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall zone-policy
-      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
-      ------  ------------  -----------  ---------------  ---------------
-      LAN     eth1          WAN          WAN-LAN-v4
-              eth2
-      LOCAL   LOCAL         LAN          LAN-LOCAL-v4
-                            WAN          WAN-LOCAL-v4     WAN-LOCAL-v6
-      WAN     eth3          LAN          LAN-WAN-v4
-              eth0          LOCAL        LOCAL-WAN-v4
-```
-
-```{eval-rst}
-.. opcmd:: show firewall zone-policy zone <zone>
-
-   Display a basic summary of a particular zone.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show firewall zone-policy zone WAN
-      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
-      ------  ------------  -----------  ---------------  ---------------
-      WAN     eth3          LAN          LAN-WAN-v4
-              eth0          LOCAL        LOCAL-WAN-v4
-
-      vyos@vyos:~$ show firewall zone-policy zone LOCAL
-      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
-      ------  ------------  -----------  ---------------  ---------------
-      LOCAL   LOCAL         LAN          LAN-LOCAL-v4
-                            WAN          WAN-LOCAL-v4     WAN-LOCAL-v6
-```
author	Daniil Baturin <daniil@vyos.io>	2026-05-06 14:08:35 +0100
committer	GitHub <noreply@github.com>	2026-05-06 14:08:35 +0100
commit	9d0341379184622b3da2e7e05aeeceed4bbf83e9 (patch)
tree	3c881338b1f6e0ec369a138e4c53772fcbaa8253 /docs/configuration/firewall
parent	5eb383a10ec92c65eed525bc174785a6852e997f (diff)
download	vyos-documentation-9d0341379184622b3da2e7e05aeeceed4bbf83e9.tar.gz vyos-documentation-9d0341379184622b3da2e7e05aeeceed4bbf83e9.zip