Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)

* feat(swap-sagitta): add incremental RST-to-MyST swap mechanism Backport of the swap mechanism from feat/incremental-myst-swap onto the sagitta release branch. Built directly on top of origin/sagitta, so the underlying RST tree is sagitta's (not current's). Mechanism: - scripts/import_myst.py — import md from myst/* with md- prefix - scripts/swap_sources.py — rename md-{name}.md → {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile — html/dirhtml/pdf/livehtml all run swap → build → trap restore; explicit `swap` and `restore` targets too - docs/conf.py — MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content: - 202 md-prefixed pages from origin/myst/sagitta (md-{name}.md alongside each {name}.rst counterpart) - 1 plain MyST-only page from myst/sagitta where no .rst exists (already at canonical name on sagitta: docs/copyright.md) - 240 .webp images from myst/sagitta (added alongside the existing PNG/JPG so RST builds keep their assets) - docs/_swap.txt populated with all 202 stems → MyST is served by default, revert a page by removing its stem from _swap.txt 🤖 Generated by [robots](https://vyos.io) * feat(conf): copy .md sources into HTML output for plain-text serving Adds a build-finished hook that mirrors every .md file from the Sphinx source tree into the HTML output directory verbatim, making unrendered MyST sources accessible alongside HTML renders at the same URL path. 🤖 Generated by [robots](https://vyos.io) * docs: address review feedback (backport from PR #1857) Fix conversion artifacts, typos, and technical inaccuracies applicable to the sagitta branch: curly quotes, typos (deamonless, cammans, amdifferent, trough), incorrect firewall command paths, missing closing brace in zone-policy, peer name inconsistencies, hardcoded passwords replaced with vault references, and md-*.md exclusion in conf.py. 🤖 Generated by [robots](https://vyos.io) * docs: port .readthedocs.yml jobs, _ext/vyos.py fallback and swap-script tests from PR #1857 Parity backport from PR #1857 (current) — three pieces were missing on sagitta. - .readthedocs.yml: add build.jobs.pre_build / post_build hooks that run scripts/swap_sources.py --swap before the Sphinx build and --restore after. Without this, the swap mechanism ships but never runs on RTD builds for this branch — the swap is a silent no-op. - docs/_ext/vyos.py: CmdInclude.run() now falls back to nested_parse() when self.state._renderer is not present. Required for cfgcmd / opcmd / cmdincludemd directives to render correctly when included from MyST pages (the swap mechanism's whole point). Sagitta-only delta on _ext/vyos.py (the path = str(path) line on 224) is intentionally untouched. - tests/test_import_myst.py, tests/test_swap_sources.py: tests for the swap scripts. The scripts on this branch are byte-identical to current's, so the same tests apply. Travels with the branch so CI catches per-branch regressions if the scripts ever drift. 🤖 Generated by [robots](https://vyos.io) * fix(conf): skip md-*.md staging files in _copy_md_sources Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/919695a7-688d-41b9-89f0-540684625dbc Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
author: Yuriy Andamasov <yuriy@vyos.io> 2026-05-06 14:41:08 +0300
committer: GitHub <noreply@github.com> 2026-05-06 12:41:08 +0100
commit: 22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e (patch)
tree: 8d97f7766d9bbd2d0e3a55e5643a60b387308675 /docs/configuration/firewall
parent: c21b38dbe24088eaca73dbc8030cfebc898d2186 (diff)
download: vyos-documentation-22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.tar.gz
vyos-documentation-22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.zip
8 files changed, 7394 insertions, 0 deletions
diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md
new file mode 100644
index 00000000..fad81412
--- /dev/null
+++ b/docs/configuration/firewall/md-bridge.md
@@ -0,0 +1,683 @@
+lastproofread  
+2023-11-08
+
+# Bridge Firewall Configuration
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Documentation under development**
+
+</div>
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding bridge, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+<div class="cfgcmd">
+
+set firewall bridge ...
+
+</div>
+
+From main structure defined in `Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+``` none
+- set firewall
+    * bridge
+         - forward
+            + filter
+         - name
+            + custom_name
+```
+
+Traffic which is received by the router on an interface which is member of a
+bridge is processed on the **Bridge Layer**. A simplified packet flow diagram
+for this layer is shown next:
+
+<figure>
+<img src="/_static/images/firewall-bridge-packet-flow.webp" />
+</figure>
+
+For traffic that needs to be forwared internally by the bridge, base chain is
+is **forward**, and it's base command for filtering is `set firewall bridge forward filter ...`, which happens in stage 4, highlightened with red color.
+
+Custom bridge firewall chains can be create with command `set firewall bridge name <name> ...`. In order to use such custom chain, a rule with action jump,
+and the appropiate target should be defined in a base chain.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Layer 3 bridge**:
+When an IP address is assigned to the bridge interface, and if traffic
+is sent to the router to this IP (for example using such IP as
+default gateway), then rules defined for **bridge firewall** won't
+match, and firewall analysis continues at **IP layer**.
+
+</div>
+
+## Bridge Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+In firewall bridge rules, the action can be:
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | return\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | return\]
+
+This required setting defines the action of the current rule. If action is
+set to jump, then jump-target is also needed.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+queue \<0-65535\>
+
+To be used only when action is set to `queue`. Use this command to specify
+queue target to use. Queue range is also supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+queue-options bypass
+
+To be used only when action is set to `queue`. Use this command to let
+packet go through firewall when no userspace software is connected to the
+queue.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+queue-options fanout
+
+To be used only when action is set to `queue`. Use this command to
+distribute packets between several queues.
+
+</div>
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> default-action
+\[accept | continue | drop | jump | queue | return\]
+
+This set the default action of the rule-set if no rule matched a packet
+criteria. If default-action is set to `jump`, then
+`default-jump-target` is also needed. Note that for base chains, default
+action can only be set to `accept` or `drop`, while on custom chain,
+more actions are available.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> default-jump-target \<text\>
+
+To be used only when `defult-action` is set to `jump`. Use this
+command to specify jump target for default rule.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+
+</div>
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\> log
+
+Enable logging for the matched packet. If this configuration command is not
+present, then log is not enabled.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> default-log
+
+Use this command to enable the logging of the default action on
+the specified chain.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+Define log-level. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+log-options group \<0-65535\>
+
+Define log group to send message to. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+Define length of packet payload to include in netlink message. Only
+applicable if rule log is enable and log group is defined.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+Define number of packets to queue inside the kernel before sending them to
+userspace. Only applicable if rule log is enable and log group is defined.
+
+</div>
+
+### Firewall Description
+
+For reference, a description can be defined for every defined custom chain.
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> description \<text\>
+
+Provide a rule-set description to a custom firewall chain.
+
+</div>
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\> disable
+
+Command for disabling a rule but keep it in the configuration.
+
+</div>
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+destination mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+destination mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+source mac-address \<mac-address\>
+
+Match criteria based on source and/or destination mac-address.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+inbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+inbound-interface name \<iface\>
+
+Match based on inbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+Match based on inbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+outbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+outbound-interface name \<iface\>
+
+Match based on outbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+Match based on outbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+vlan id \<0-4096\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+vlan id \<0-4096\>
+
+Match based on vlan ID. Range is also supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge forward filter rule \<1-999999\>
+vlan priority \<0-7\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall bridge name \<name\> rule \<1-999999\>
+vlan priority \<0-7\>
+
+Match based on vlan priority(pcp). Range is also supported.
+
+</div>
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+In this section you can find all useful firewall op-mode commands.
+
+General commands for firewall configuration, counter and statiscits:
+
+<div class="opcmd">
+
+show firewall
+
+</div>
+
+<div class="opcmd">
+
+show firewall summary
+
+</div>
+
+<div class="opcmd">
+
+show firewall statistics
+
+</div>
+
+And, to print only bridge firewall information:
+
+<div class="opcmd">
+
+show firewall bridge
+
+</div>
+
+<div class="opcmd">
+
+show firewall bridge forward filter
+
+</div>
+
+<div class="opcmd">
+
+show firewall bridge forward filter rule \<rule\>
+
+</div>
+
+<div class="opcmd">
+
+show firewall bridge name \<name\>
+
+</div>
+
+<div class="opcmd">
+
+show firewall bridge name \<name\> rule \<rule\>
+
+</div>
+
+### Show Firewall log
+
+<div class="opcmd">
+
+show log firewall
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge forward
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge forward filter
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge name \<name\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge forward filter rule \<rule\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall bridge name \<name\> rule \<rule\>
+
+Show the logs of all firewall; show all bridge firewall logs; show all logs
+for forward hook; show all logs for forward hook and priority filter; show
+all logs for particular custom chain; show logs for specific Rule-Set.
+
+</div>
+
+### Example
+
+Configuration example:
+
+``` none
+set firewall bridge forward filter default-action 'drop'
+set firewall bridge forward filter default-log
+set firewall bridge forward filter rule 10 action 'continue'
+set firewall bridge forward filter rule 10 inbound-interface name 'eth2'
+set firewall bridge forward filter rule 10 vlan id '22'
+set firewall bridge forward filter rule 20 action 'drop'
+set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT'
+set firewall bridge forward filter rule 20 vlan id '60'
+set firewall bridge forward filter rule 30 action 'jump'
+set firewall bridge forward filter rule 30 jump-target 'TEST'
+set firewall bridge forward filter rule 30 outbound-interface name '!eth1'
+set firewall bridge forward filter rule 35 action 'accept'
+set firewall bridge forward filter rule 35 vlan id '11'
+set firewall bridge forward filter rule 40 action 'continue'
+set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11'
+set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66'
+set firewall bridge name TEST default-action 'accept'
+set firewall bridge name TEST default-log
+set firewall bridge name TEST rule 10 action 'continue'
+set firewall bridge name TEST rule 10 log
+set firewall bridge name TEST rule 10 vlan priority '0'
+```
+
+And op-mode commands:
+
+``` none
+vyos@BRI:~$ show firewall bridge
+Rulesets bridge Information
+
+---------------------------------
+bridge Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ---------------------------------------------------------------------
+10       continue  all                 0        0  iifname "eth2" vlan id 22  continue
+20       drop      all                 0        0  iifname @I_TRUNK-RIGHT vlan id 60
+30       jump      all              2130   170688  oifname != "eth1"  jump NAME_TEST
+35       accept    all              2080   168616  vlan id 11  accept
+40       continue  all                 0        0  ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66  continue
+default  drop      all                 0        0
+
+---------------------------------
+bridge Firewall "name TEST"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------------------------------------------
+10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
+default  accept    all              2130   170688
+
+vyos@BRI:~$
+vyos@BRI:~$ show firewall bridge name TEST
+Ruleset Information
+
+---------------------------------
+bridge Firewall "name TEST"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------------------------------------------
+10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
+default  accept    all              2130   170688
+
+vyos@BRI:~$
+```
+
+Inspect logs:
+
+``` none
+vyos@BRI:~$ show log firewall bridge
+Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+...
+vyos@BRI:~$ show log firewall bridge forward filter
+Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+```
diff --git a/docs/configuration/firewall/md-flowtables.md b/docs/configuration/firewall/md-flowtables.md
new file mode 100644
index 00000000..e423eb59
--- /dev/null
+++ b/docs/configuration/firewall/md-flowtables.md
@@ -0,0 +1,229 @@
+lastproofread  
+2024-06-20
+
+# Flowtables Firewall Configuration
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Documentation under development**
+
+</div>
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding flowtables.
+
+<div class="cfgcmd">
+
+set firewall flowtables ...
+
+</div>
+
+From main structure defined in
+`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+``` none
+- set firewall
+    * flowtable
+         - custom_flow_table
+            + ...
+```
+
+Flowtables allows you to define a fastpath through the flowtable datapath.
+The flowtable supports for the layer 3 IPv4 and IPv6 and the layer 4 TCP
+and UDP protocols.
+
+<figure>
+<img src="/_static/images/firewall-flowtable-packet-flow.webp" />
+</figure>
+
+Once the first packet of the flow successfully goes through the IP forwarding
+path (black circles path), from the second packet on, you might decide to
+offload the flow to the flowtable through your ruleset. The flowtable
+infrastructure provides a rule action that allows you to specify when to add
+a flow to the flowtable (On forward filtering, red circle number 6)
+
+A packet that finds a matching entry in the flowtable (flowtable hit) is
+transmitted to the output netdevice, hence, packets bypass the classic IP
+forwarding path and uses the **Fast Path** (orange circles path). The visible
+effect is that you do not see these packets from any of the Netfilter
+hooks coming after ingress. In case that there is no matching entry in the
+flowtable (flowtable miss), the packet follows the classic IP forwarding path.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Flowtable Reference:**
+<https://docs.kernel.org/networking/nf_flowtable.html>
+
+</div>
+
+## Flowtable Configuration
+
+In order to use flowtables, the minimal configuration needed includes:
+
+> - Create flowtable: create flowtable, which includes the interfaces
+>   that are going to be used by the flowtable.
+> - Create firewall rule: create a firewall rule, setting action to
+>   `offload` and using desired flowtable for `offload-target`.
+
+Creating a flow table:
+
+<div class="cfgcmd">
+
+set firewall flowtable \<flow_table_name\> interface \<iface\>
+
+Define interfaces to be used in the flowtable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall flowtable \<flow_table_name\> description \<text\>
+
+</div>
+
+Provide a description to the flow table.
+
+<div class="cfgcmd">
+
+set firewall flowtable \<flow_table_name\> offload
+\<hardware | software\>
+
+Define type of offload to be used by the flowtable: `hardware` or
+`software`. By default, `software` offload is used.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Hardware offload:** should be supported by the NICs used.
+
+</div>
+
+Creating rules for using flow tables:
+
+<div class="cfgcmd">
+
+set firewall \[ipv4 | ipv6\] forward filter rule \<1-999999\>
+action offload
+
+Create firewall rule in forward chain, and set action to `offload`.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall \[ipv4 | ipv6\] forward filter rule \<1-999999\>
+offload-target \<flowtable\>
+
+Create firewall rule in forward chain, and define which flowtbale
+should be used. Only applicable if action is `offload`.
+
+</div>
+
+## Configuration Example
+
+Things to be considred in this setup:
+
+> - Two interfaces are going to be used in the flowtables: eth0 and eth1
+> - Minumum firewall ruleset is provided, which includes some filtering rules,
+>   and appropiate rules for using flowtable offload capabilities.
+
+As described, first packet will be evaluated by all the firewall path, so
+desired connection should be explicitely accepted. Same thing should be taken
+into account for traffic in reverse order. In most cases state policies are
+used in order to accept connection in reverse patch.
+
+We will only accept traffic comming from interface eth0, protocol tcp and
+destination port 1122. All other traffic traspassing the router should be
+blocked.
+
+### Commands
+
+``` none
+set firewall flowtable FT01 interface 'eth0'
+set firewall flowtable FT01 interface 'eth1'
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 10 action 'offload'
+set firewall ipv4 forward filter rule 10 offload-target 'FT01'
+set firewall ipv4 forward filter rule 10 state 'established'
+set firewall ipv4 forward filter rule 10 state 'related'
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 state 'established'
+set firewall ipv4 forward filter rule 20 state 'related'
+set firewall ipv4 forward filter rule 110 action 'accept'
+set firewall ipv4 forward filter rule 110 destination address '192.0.2.100'
+set firewall ipv4 forward filter rule 110 destination port '1122'
+set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0'
+set firewall ipv4 forward filter rule 110 protocol 'tcp'
+```
+
+### Explanation
+
+Analysis on what happens for desired connection:
+
+> 1\. First packet is received on eth0, with destination address 192.0.2.100,
+> protocol tcp and destination port 1122. Assume such destination address is
+> reachable through interface eth1.
+>
+> 2\. Since this is the first packet, connection status of this connection,
+> so far is **new**. So neither rule 10 nor 20 are valid.
+>
+> 3.  Rule 110 is hit, so connection is accepted.
+>
+> 4\. Once answer from server 192.0.2.100 is seen in opposite direction,
+> connection state will be triggered to **established**, so this reply is
+> accepted in rule 20.
+>
+> 5\. Second packet for this connection is received by the router. Since
+> connection state is **established**, then rule 10 is hit, and a new entry
+> in the flowtable FT01 is added for this connection.
+>
+> 6\. All the following packets will skip traditional path, and will be offloaded
+> and will use the **Fast Path**.
+
+### Checks
+
+It's time to check conntrack table, to see if any connection was accepted,
+and if was properly offloaded
+
+``` none
+vyos@FlowTables:~$ show firewall ipv4 forward filter
+Ruleset Information
+
+---------------------------------
+ipv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------------------------------
+10       offload   all                 8      468  ct state { established, related }  flow add @VYOS_FLOWTABLE_FT01
+20       accept    all                 8      468  ct state { established, related }  accept
+110      accept    tcp                 2      120  ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0"  accept
+default  drop      all                 7      420
+
+vyos@FlowTables:~$ sudo conntrack -L | grep tcp
+conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown.
+tcp      6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2
+vyos@FlowTables:~$
+```
diff --git a/docs/configuration/firewall/md-global-options.md b/docs/configuration/firewall/md-global-options.md
new file mode 100644
index 00000000..dc860894
--- /dev/null
+++ b/docs/configuration/firewall/md-global-options.md
@@ -0,0 +1,236 @@
+lastproofread  
+2023-12-26
+
+# Global Options Firewall Configuration
+
+## Overview
+
+Some firewall settings are global and have an affect on the whole system.
+In this section there's useful information about these global-options that can
+be configured using vyos cli.
+
+Configuration commands covered in this section:
+
+<div class="cfgcmd">
+
+set firewall global-options ...
+
+</div>
+
+## Configuration
+
+<div class="cfgcmd">
+
+set firewall global-options all-ping \[enable | disable\]
+
+By default, when VyOS receives an ICMP echo request packet destined for
+itself, it will answer with an ICMP echo reply, unless you avoid it
+through its firewall.
+
+With the firewall you can set rules to accept, drop or reject ICMP in,
+out or local traffic. You can also use the general **firewall all-ping**
+command. This command affects only to LOCAL (packets destined for your
+VyOS system), not to IN or OUT traffic.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**firewall global-options all-ping** affects only to LOCAL
+and it always behaves in the most restrictive way
+
+</div>
+
+``` none
+set firewall global-options all-ping enable
+```
+
+When the command above is set, VyOS will answer every ICMP echo request
+addressed to itself, but that will only happen if no other rule is
+applied dropping or rejecting local echo requests. In case of conflict,
+VyOS will not answer ICMP echo requests.
+
+``` none
+set firewall global-options all-ping disable
+```
+
+When the command above is set, VyOS will answer no ICMP echo request
+addressed to itself at all, no matter where it comes from or whether
+more specific rules are being applied to accept them.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options broadcast-ping \[enable | disable\]
+
+This setting enable or disable the response of icmp broadcast
+messages. The following system parameter will be altered:
+
+- `net.ipv4.icmp_echo_ignore_broadcasts`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options ip-src-route \[enable | disable\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options ipv6-src-route \[enable | disable\]
+
+This setting handle if VyOS accept packets with a source route
+option. The following system parameter will be altered:
+
+- `net.ipv4.conf.all.accept_source_route`
+- `net.ipv6.conf.all.accept_source_route`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options receive-redirects \[enable | disable\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options ipv6-receive-redirects
+\[enable | disable\]
+
+enable or disable of ICMPv4 or ICMPv6 redirect messages accepted
+by VyOS. The following system parameter will be altered:
+
+- `net.ipv4.conf.all.accept_redirects`
+- `net.ipv6.conf.all.accept_redirects`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options send-redirects \[enable | disable\]
+
+enable or disable ICMPv4 redirect messages send by VyOS
+The following system parameter will be altered:
+
+- `net.ipv4.conf.all.send_redirects`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options log-martians \[enable | disable\]
+
+enable or disable the logging of martian IPv4 packets.
+The following system parameter will be altered:
+
+- `net.ipv4.conf.all.log_martians`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options source-validation
+\[strict | loose | disable\]
+
+Set the IPv4 source validation mode.
+The following system parameter will be altered:
+
+- `net.ipv4.conf.all.rp_filter`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options syn-cookies \[enable | disable\]
+
+Enable or Disable if VyOS use IPv4 TCP SYN Cookies.
+The following system parameter will be altered:
+
+- `net.ipv4.tcp_syncookies`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options twa-hazards-protection
+\[enable | disable\]
+
+Enable or Disable VyOS to be `1337` conform.
+The following system parameter will be altered:
+
+- `net.ipv4.tcp_rfc1337`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy established action
+\[accept | drop | reject\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy established log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy established log-level
+\[emerg | alert | crit | err | warn | notice | info | debug\]
+
+Set the global setting for an established connection.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy invalid action
+\[accept | drop | reject\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy invalid log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy invalid log-level
+\[emerg | alert | crit | err | warn | notice | info | debug\]
+
+Set the global setting for invalid packets.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy related action
+\[accept | drop | reject\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy related log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall global-options state-policy related log-level
+\[emerg | alert | crit | err | warn | notice | info | debug\]
+
+Set the global setting for related connections.
+
+</div>
diff --git a/docs/configuration/firewall/md-groups.md b/docs/configuration/firewall/md-groups.md
new file mode 100644
index 00000000..926b503d
--- /dev/null
+++ b/docs/configuration/firewall/md-groups.md
@@ -0,0 +1,561 @@
+lastproofread  
+2023-11-08
+
+# Firewall groups
+
+## Configuration
+
+Firewall groups represent collections of IP addresses, networks, ports,
+mac addresses, domains or interfaces. Once created, a group can be referenced
+by firewall, nat and policy route rules as either a source or destination
+matcher, and/or as inbound/outbound in the case of interface group.
+
+### Address Groups
+
+In an **address group** a single IP address or IP address ranges are
+defined.
+
+<div class="cfgcmd">
+
+set firewall group address-group \<name\> address \[address |
+address range\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group ipv6-address-group \<name\> address \<address\>
+
+Define a IPv4 or a IPv6 address group
+
+``` none
+set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1
+set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8
+set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group address-group \<name\> description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group ipv6-address-group \<name\> description \<text\>
+
+Provide a IPv4 or IPv6 address group description
+
+</div>
+
+### Network Groups
+
+While **network groups** accept IP networks in CIDR notation, specific
+IP addresses can be added as a 32-bit prefix. If you foresee the need
+to add a mix of addresses and networks, the network group is
+recommended.
+
+<div class="cfgcmd">
+
+set firewall group network-group \<name\> network \<CIDR\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group ipv6-network-group \<name\> network \<CIDR\>
+
+Define a IPv4 or IPv6 Network group.
+
+``` none
+set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24
+set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
+set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group network-group \<name\> description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group ipv6-network-group \<name\> description \<text\>
+
+Provide an IPv4 or IPv6 network group description.
+
+</div>
+
+### Interface Groups
+
+An **interface group** represents a collection of interfaces.
+
+<div class="cfgcmd">
+
+set firewall group interface-group \<name\> interface \<text\>
+
+Define an interface group. Wildcard are accepted too.
+
+</div>
+
+``` none
+set firewall group interface-group LAN interface bond1001
+set firewall group interface-group LAN interface eth3*
+```
+
+<div class="cfgcmd">
+
+set firewall group interface-group \<name\> description \<text\>
+
+Provide an interface group description
+
+</div>
+
+### Port Groups
+
+A **port group** represents only port numbers, not the protocol. Port
+groups can be referenced for either TCP or UDP. It is recommended that
+TCP and UDP groups are created separately to avoid accidentally
+filtering unnecessary ports. Ranges of ports can be specified by using
+<span class="title-ref">-</span>.
+
+<div class="cfgcmd">
+
+set firewall group port-group \<name\> port
+\[portname | portnumber | startport-endport\]
+
+Define a port group. A port name can be any name defined in
+/etc/services. e.g.: http
+
+``` none
+set firewall group port-group PORT-TCP-SERVER1 port http
+set firewall group port-group PORT-TCP-SERVER1 port 443
+set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group port-group \<name\> description \<text\>
+
+Provide a port group description.
+
+</div>
+
+### MAC Groups
+
+A **mac group** represents a collection of mac addresses.
+
+<div class="cfgcmd">
+
+set firewall group mac-group \<name\> mac-address \<mac-address\>
+
+Define a mac group.
+
+</div>
+
+``` none
+set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f
+set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81
+```
+
+<div class="cfgcmd">
+
+set firewall group mac-group \<name\> description \<text\>
+
+Provide a mac group description.
+
+</div>
+
+### Domain Groups
+
+A **domain group** represents a collection of domains.
+
+<div class="cfgcmd">
+
+set firewall group domain-group \<name\> address \<domain\>
+
+Define a domain group.
+
+</div>
+
+``` none
+set firewall group domain-group DOM address example.com
+```
+
+<div class="cfgcmd">
+
+set firewall group domain-group \<name\> description \<text\>
+
+Provide a domain group description.
+
+</div>
+
+### Dynamic Groups
+
+Firewall dynamic groups are different from all the groups defined previously
+because, not only they can be used as source/destination in firewall rules,
+but members of these groups are not defined statically using vyos
+configuration.
+
+Instead, members of these groups are added dynamically using firewall
+rules.
+
+#### Defining Dynamic Address Groups
+
+Dynamic address group is supported by both IPv4 and IPv6 families.
+Commands used to define dynamic IPv4|IPv6 address groups are:
+
+<div class="cfgcmd">
+
+set firewall group dynamic-group address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group dynamic-group ipv6-address-group \<name\>
+
+</div>
+
+Add description to firewall groups:
+
+<div class="cfgcmd">
+
+set firewall group dynamic-group address-group \<name\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall group dynamic-group ipv6-address-group \<name\>
+description \<text\>
+
+</div>
+
+#### Adding elements to Dynamic Firewall Groups
+
+Once dynamic firewall groups are defined, they should be used in firewall
+rules in order to dynamically add elements to it.
+
+Commands used for this task are:
+
+- Add destination IP address of the connection to a dynamic address group:
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group destination-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> add-address-to-group
+destination-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group destination-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> add-address-to-group
+destination-address address-group \<name\>
+
+</div>
+
+- Add source IP address of the connection to a dynamic address group:
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group source-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> add-address-to-group
+source-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group source-address address-group \<name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> add-address-to-group
+source-address address-group \<name\>
+
+</div>
+
+Also, specific timeout can be defined per rule. In case rule gets a hit,
+source or destinatination address will be added to the group, and this
+element will remain in the group until timeout expires. If no timeout
+is defined, then the element will remain in the group until next reboot,
+or until a new commit that changes firewall configuration is done.
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group \[destination-address | source-address\]
+timeout \<timeout\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> add-address-to-group
+\[destination-address | source-address\] timeout \<timeout\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[forward | input | output\] filter rule
+\<1-999999\> add-address-to-group \[destination-address | source-address\]
+timeout \<timeout\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> add-address-to-group
+\[destination-address | source-address\] timeout \<timeout\>
+
+</div>
+
+Timeout can be defined using seconds, minutes, hours or days:
+
+``` none
+set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout
+Possible completions:
+<number>s            Timeout value in seconds
+<number>m            Timeout value in minutes
+<number>h            Timeout value in hours
+<number>d            Timeout value in days
+```
+
+#### Using Dynamic Firewall Groups
+
+As any other firewall group, dynamic firewall groups can be used in firewall
+rules as matching options. For example:
+
+``` none
+set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO
+set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR
+```
+
+## Examples
+
+### General example
+
+As said before, once firewall groups are created, they can be referenced
+either in firewall, nat, nat66 and/or policy-route rules.
+
+Here is an example were multiple groups are created:
+
+> ``` none
+> set firewall group address-group SERVERS address 198.51.100.101
+> set firewall group address-group SERVERS address 198.51.100.102
+> set firewall group network-group TRUSTEDv4 network 192.0.2.0/30
+> set firewall group network-group TRUSTEDv4 network 203.0.113.128/25
+> set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64
+> set firewall group interface-group LAN interface eth2.2001
+> set firewall group interface-group LAN interface bon0
+> set firewall group port-group PORT-SERVERS port http
+> set firewall group port-group PORT-SERVERS port 443
+> set firewall group port-group PORT-SERVERS port 5000-5010
+> ```
+
+And next, some configuration example where groups are used:
+
+> ``` none
+> set firewall ipv4 output filter rule 10 action accept
+> set firewall ipv4 output filter rule 10 outbound-interface group !LAN
+> set firewall ipv4 forward filter rule 20 action accept
+> set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4
+> set firewall ipv6 input filter rule 10 action accept
+> set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6
+> set nat destination rule 101 inbound-interface group LAN
+> set nat destination rule 101 destination group address-group SERVERS
+> set nat destination rule 101 protocol tcp
+> set nat destination rule 101 destination group port-group PORT-SERVERS
+> set nat destination rule 101 translation address 203.0.113.250
+> set policy route PBR rule 201 destination group port-group PORT-SERVERS
+> set policy route PBR rule 201 protocol tcp
+> set policy route PBR rule 201 set table 15
+> ```
+
+### Port knocking example
+
+Using dynamic firewall groups, we can secure access to the router, or any other
+device if needed, by using the technique of port knocking.
+
+A 4 step port knocking example is shown next:
+
+> ``` none
+> set firewall global-options state-policy established action 'accept'
+> set firewall global-options state-policy invalid action 'drop'
+> set firewall global-options state-policy related action 'accept'
+> set firewall group dynamic-group address-group ALLOWED
+> set firewall group dynamic-group address-group PN_01
+> set firewall group dynamic-group address-group PN_02
+> set firewall ipv4 input filter default-action 'drop'
+> set firewall ipv4 input filter rule 5 action 'accept'
+> set firewall ipv4 input filter rule 5 protocol 'icmp'
+> set firewall ipv4 input filter rule 10 action 'drop'
+> set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01'
+> set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m'
+> set firewall ipv4 input filter rule 10 description 'Port_nock 01'
+> set firewall ipv4 input filter rule 10 destination port '9990'
+> set firewall ipv4 input filter rule 10 protocol 'tcp'
+> set firewall ipv4 input filter rule 20 action 'drop'
+> set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02'
+> set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m'
+> set firewall ipv4 input filter rule 20 description 'Port_nock 02'
+> set firewall ipv4 input filter rule 20 destination port '9991'
+> set firewall ipv4 input filter rule 20 protocol 'tcp'
+> set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01'
+> set firewall ipv4 input filter rule 30 action 'drop'
+> set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED'
+> set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h'
+> set firewall ipv4 input filter rule 30 description 'Port_nock 03'
+> set firewall ipv4 input filter rule 30 destination port '9992'
+> set firewall ipv4 input filter rule 30 protocol 'tcp'
+> set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02'
+> set firewall ipv4 input filter rule 99 action 'accept'
+> set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh'
+> set firewall ipv4 input filter rule 99 destination port '22'
+> set firewall ipv4 input filter rule 99 protocol 'tcp'
+> set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED'
+> ```
+
+Before testing, we can check members of firewall groups:
+
+> ``` none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  N/D            N/D        N/D
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
+> [edit]
+> vyos@vyos#
+> ```
+
+With this configuration, in order to get ssh access to the router, user
+needs to:
+
+1\. Generate a new TCP connection with destination port 9990. As shown next,
+a new entry was added to dynamic firewall group **PN_01**
+
+> ``` none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        119
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
+> [edit]
+> vyos@vyos#
+> ```
+
+2\. Generate a new TCP connection with destination port 9991. As shown next,
+a new entry was added to dynamic firewall group **PN_02**
+
+> ``` none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        106
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31  180        179
+> [edit]
+> vyos@vyos#
+> ```
+
+3\. Generate a new TCP connection with destination port 9992. As shown next,
+a new entry was added to dynamic firewall group **ALLOWED**
+
+> ``` none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  192.168.89.31       7200       7199
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31        120         89
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31        180        170
+> [edit]
+> vyos@vyos#
+> ```
+
+4.  Now user can connect through ssh to the router (assuming ssh is configured).
+
+## Operation-mode
+
+<div class="opcmd">
+
+show firewall group
+
+</div>
+
+<div class="opcmd">
+
+show firewall group \<name\>
+
+Overview of defined groups. You see the firewall group name, type,
+references (where the group is used), members, timeout and expiration (last
+two only present in dynamic firewall groups).
+
+</div>
+
+Here is an example of such command:
+
+> ``` none
+> vyos@vyos:~$ show firewall group
+> Firewall Groups
+>
+> Name          Type                    References              Members             Timeout    Expires
+> ------------  ----------------------  ----------------------  ----------------  ---------  ---------
+> SERVERS       address_group           nat-destination-101     198.51.100.101
+>                                                               198.51.100.102
+> ALLOWED       address_group(dynamic)  ipv4-input-filter-30    192.168.77.39          7200       7174
+> PN_01         address_group(dynamic)  ipv4-input-filter-10    192.168.0.245           120        112
+>                                                               192.168.77.39           120         85
+> PN_02         address_group(dynamic)  ipv4-input-filter-20    192.168.77.39           180        151
+> LAN           interface_group         ipv4-output-filter-10   bon0
+>                                       nat-destination-101     eth2.2001
+> TRUSTEDv6     ipv6_network_group      ipv6-input-filter-10    2001:db8::/64
+> TRUSTEDv4     network_group           ipv4-forward-filter-20  192.0.2.0/30
+>                                                               203.0.113.128/25
+> PORT-SERVERS  port_group              route-PBR-201           443
+>                                       route-PBR-201           5000-5010
+>                                       nat-destination-101     http
+> vyos@vyos:~$
+> ```
diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md
new file mode 100644
index 00000000..a7511536
--- /dev/null
+++ b/docs/configuration/firewall/md-index.md
@@ -0,0 +1,181 @@
+lastproofread  
+2023-11-23
+
+# Firewall
+
+As VyOS is based on Linux it leverages its firewall. The Netfilter project
+created iptables and its successor nftables for the Linux kernel to
+work directly on packet data flows. This now extends the concept of
+zone-based security to allow for manipulating the data at multiple stages once
+accepted by the network interface and the driver before being handed off to
+the destination (e.g., a web server OR another device).
+
+A simplified traffic flow diagram, based on Netfilter packet flow, is shown
+next, in order to have a full view and understanding of how packets are
+processed, and what possible paths traffic can take.
+
+<figure>
+<img src="/_static/images/firewall-gral-packet-flow.webp" />
+</figure>
+
+The main points regarding this packet flow and terminology used in VyOS
+firewall are covered below:
+
+> - **Bridge Port?**: choose appropriate path based on whether interface
+>   where the packet was received is part of a bridge, or not.
+
+If the interface where the packet was received isn't part of a bridge, then
+packetis processed at the **IP Layer**:
+
+> - **Prerouting**: several actions can be done in this stage, and currently
+>   these actions are defined in different parts in VyOS configuration. Order
+>   is important, and all these actions are performed before any actions
+>   defined under `firewall` section. Relevant configuration that acts in
+>   this stage are:
+>
+>   > - **Conntrack Ignore**: rules defined under `set system conntrack ignore [ipv4 | ipv6] ...`.
+>   > - **Policy Route**: rules defined under `set policy [route | route6] ...`.
+>   > - **Destination NAT**: rules defined under `set [nat | nat66] destination...`.
+>
+> - **Destination is the router?**: choose appropriate path based on
+>   destination IP address. Transit forward continues to **forward**,
+>   while traffic that destination IP address is configured on the router
+>   continues to **input**.
+>
+> - **Input**: stage where traffic destined for the router itself can be
+>   filtered and controlled. This is where all rules for securing the router
+>   should take place. This includes ipv4 and ipv6 filtering rules, defined
+>   in:
+>
+>   - `set firewall ipv4 input filter ...`.
+>   - `set firewall ipv6 input filter ...`.
+>
+> - **Forward**: stage where transit traffic can be filtered and controlled.
+>   This includes ipv4 and ipv6 filtering rules, defined in:
+>
+>   - `set firewall ipv4 forward filter ...`.
+>   - `set firewall ipv6 forward filter ...`.
+>
+> - **Output**: stage where traffic that originates from the router itself
+>   can be filtered and controlled. Bear in mind that this traffic can be a
+>   new connection originated by a internal process running on VyOS router,
+>   such as NTP, or a response to traffic received externaly through
+>   **input** (for example response to an ssh login attempt to the router).
+>   This includes ipv4 and ipv6 filtering rules, defined in:
+>
+>   - `set firewall ipv4 output filter ...`.
+>   - `set firewall ipv6 output filter ...`.
+>
+> - **Postrouting**: as in **Prerouting**, several actions defined in
+>   different parts of VyOS configuration are performed in this
+>   stage. This includes:
+>
+>   - **Source NAT**: rules defined under `set [nat | nat66] source...`.
+
+If the interface where the packet was received is part of a bridge, then
+the packet is processed at the **Bridge Layer**, which contains a basic setup for
+bridge filtering:
+
+> - **Forward (Bridge)**: stage where traffic that is trespasing through the
+>   bridge is filtered and controlled:
+>   - `set firewall bridge forward filter ...`.
+
+The main structure of the VyOS firewall CLI is shown next:
+
+``` none
+- set firewall
+    * bridge
+         - forward
+            + filter
+    * flowtable
+         - custom_flow_table
+            + ...
+    * global-options
+         + all-ping
+         + broadcast-ping
+         + ...
+    * group
+         - address-group
+         - ipv6-address-group
+         - network-group
+         - ipv6-network-group
+         - interface-group
+         - mac-group
+         - port-group
+         - domain-group
+    * ipv4
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+    * ipv6
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - ipv6-name
+            + custom_name
+    * zone
+         - custom_zone_name
+            + ...
+```
+
+Please, refer to appropriate section for more information about firewall
+configuration:
+
+<div class="toctree" maxdepth="1" includehidden="">
+
+global-options
+groups
+bridge
+ipv4
+ipv6
+flowtables
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**For more information**
+of Netfilter hooks and Linux networking packet flows can be
+found in [Netfilter-Hooks](https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks)
+
+</div>
+
+## Zone-based firewall
+
+<div class="toctree" maxdepth="1" includehidden="">
+
+zone
+
+</div>
+
+With zone-based firewalls a new concept was implemented, in addition to the
+standard in and out traffic flows, a local flow was added. This local was for
+traffic originating and destined to the router itself. Which means additional
+rules were required to secure the firewall itself from the network, in
+addition to the existing inbound and outbound rules from the traditional
+concept above.
+
+To configure VyOS with the
+`zone-based firewall configuration </configuration/firewall/zone>`
+
+As the example image below shows, the device now needs rules to allow/block
+traffic to or from the services running on the device that have open
+connections on that interface.
+
+<figure>
+<img src="/_static/images/firewall-zonebased.webp" />
+</figure>
diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md
new file mode 100644
index 00000000..7ac0ff49
--- /dev/null
+++ b/docs/configuration/firewall/md-ipv4.md
@@ -0,0 +1,2657 @@
+lastproofread  
+2023-11-08
+
+# IPv4 Firewall Configuration
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding IPv4, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+<div class="cfgcmd">
+
+set firewall ipv4 ...
+
+</div>
+
+From main structure defined in
+`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+``` none
+- set firewall
+    * ipv4
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+```
+
+For transit traffic, which is received by the router and forwarded, base chain
+is **forward**. A simplified packet flow diagram for transit traffic is shown
+next:
+
+<figure>
+<img src="/_static/images/firewall-fwd-packet-flow.webp" />
+</figure>
+
+Where firewall base chain to configure firewall filtering rules for transit
+traffic is `set firewall ipv4 forward filter ...`, which happens in stage 5,
+highlightened with red color.
+
+For traffic towards the router itself, base chain is **input**, while traffic
+originated by the router, base chain is **output**.
+A new simplified packet flow diagram is shown next, which shows the path
+for traffic destinated to the router itself, and traffic generated by the
+router (starting from circle number 6):
+
+<figure>
+<img src="/_static/images/firewall-input-packet-flow.webp" />
+</figure>
+
+Base chain is for traffic toward the router is `set firewall ipv4 input filter ...`
+
+And base chain for traffic generated by the router is `set firewall ipv4 output filter ...`
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**
+
+</div>
+
+Custom firewall chains can be created, with commands
+`set firewall ipv4 name <name> ...`. In order to use
+such custom chain, a rule with **action jump**, and the appropiate **target**
+should be defined in a base chain.
+
+## Firewall - IPv4 Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+The action can be :
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `reject`: reject the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+> - `synproxy`: synproxy the packet.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return | synproxy\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return | synproxy\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return\]
+
+This required setting defines the action of the current rule. If action is
+set to jump, then jump-target is also needed.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+jump-target \<text\>
+
+To be used only when action is set to `jump`. Use this command to specify
+jump target.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+queue \<0-65535\>
+
+To be used only when action is set to `queue`. Use this command to specify
+queue target to use. Queue range is also supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+queue-options bypass
+
+To be used only when action is set to `queue`. Use this command to let
+packet go through firewall when no userspace software is connected to the
+queue.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+queue-options fanout
+
+To be used only when action is set to `queue`. Use this command to
+distribute packets between several queues.
+
+</div>
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> default-action
+\[accept | drop | jump | queue | reject | return\]
+
+This set the default action of the rule-set if no rule matched a packet
+criteria. If default-action is set to `jump`, then
+`default-jump-target` is also needed. Note that for base chains, default
+action can only be set to `accept` or `drop`, while on custom chain,
+more actions are available.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> default-jump-target \<text\>
+
+To be used only when `defult-action` is set to `jump`. Use this
+command to specify jump target for default rule.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+
+</div>
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> log
+
+Enable logging for the matched packet. If this configuration command is not
+present, then log is not enabled.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> default-log
+
+Use this command to enable the logging of the default action on
+the specified chain.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+Define log-level. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+log-options group \<0-65535\>
+
+Define log group to send message to. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+Define length of packet payload to include in netlink message. Only
+applicable if rule log is enable and log group is defined.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+Define number of packets to queue inside the kernel before sending them to
+userspace. Only applicable if rule log is enable and log group is defined.
+
+</div>
+
+### Firewall Description
+
+For reference, a description can be defined for every single rule, and for
+every defined custom chain.
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> description \<text\>
+
+Provide a rule-set description to a custom firewall chain.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> description \<text\>
+
+Provide a description for each rule.
+
+</div>
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\> disable
+
+Command for disabling a rule but keep it in the configuration.
+
+</div>
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+Match criteria based on nat connection status.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+Match criteria based on connection mark.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+Match criteria based on source and/or destination address. This is similar
+to the network groups part, but here you are able to negate the matching
+addresses.
+
+``` none
+set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11
+# with a '!' the rule match everything except the specified subnet
+set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination address-mask \[address\]
+
+An arbitrary netmask can be applied to mask addresses to only match against
+a specific portion.
+
+This functions for both individual addresses and address groups.
+
+``` none
+# Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet
+set firewall ipv4 name FOO rule 100 destination address 0.11.0.13
+set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+Specify a Fully Qualified Domain Name as source/destination matcher. Ensure
+router is able to resolve such dns query.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination geoip inverse-match
+
+Match IP addresses based on its geolocation. More info: [geoip matching](https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching).
+Use inverse-match to match anything except the given country-codes.
+
+</div>
+
+Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required,
+permits redistribution so we can include a database in images(~3MB
+compressed). Includes cron script (manually callable by op-mode update
+geoip) to keep database and rules updated.
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source mac-address \<mac-address\>
+
+Only in the source criteria, you can specify a mac-address.
+
+``` none
+set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33
+set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+A port can be set with a port number or a name which is here
+defined: `/etc/services`.
+
+``` none
+set firewall ipv4 forward filter rule 10 source port '22'
+set firewall ipv4 forward filter rule 11 source port '!http'
+set firewall ipv4 forward filter rule 12 source port 'https'
+```
+
+Multiple source ports can be specified as a comma-separated list.
+The whole list can also be "negated" using `!`. For example:
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+Use a specific address-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+Use a specific dynamic-address-group. Prepend character `!` for inverted
+matching criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+Use a specific network-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+Use a specific port-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+Use a specific domain-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+Use a specific mac-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+Match based on dscp value.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+Match based on fragment criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+icmp \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+icmp \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+icmp \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+icmp \[code | type\] \<0-255\>
+
+Match based on icmp code and type.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+icmp type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+icmp type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+icmp type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+icmp type-name \<text\>
+
+Match based on icmp type-name criteria. Use tab for information
+about what **type-name** criteria are supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+inbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+inbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+inbound-interface name \<iface\>
+
+Match based on inbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If an interface is attached to a non-default vrf, when using
+**inbound-interface**, vrf name must be used. For example `set firewall ipv4 forward filter rule 10 inbound-interface name MGMT`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+Match based on inbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+outbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+outbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+outbound-interface name \<iface\>
+
+Match based on outbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If an interface is attached to a non-default vrf, when using
+**outbound-interface**, real interface name must be used. For example
+`set firewall ipv4 forward filter rule 10 outbound-interface name eth0`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+Match based on outbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+Match based on ipsec criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+Match based on the maximum number of packets to allow in excess of rate.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+limit rate \<text\>
+
+Match based on the maximum average rate, specified as **integer/unit**.
+For example **5/minutes**
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+packet-length-exclude \<text\>
+
+Match based on packet length criteria. Multiple values from 1 to 65535
+and ranges are supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+Match based on packet type criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+Match a protocol criteria. A protocol number or a name which is here
+defined: `/etc/protocols`.
+Special names are `all` for all protocols and `tcp_udp` for tcp and udp
+based packets. The `!` negate the selected protocol.
+
+``` none
+set firewall ipv4 forward fitler rule 10 protocol tcp_udp
+set firewall ipv4 forward fitler rule 11 protocol !tcp_udp
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+Match bases on recently seen sources.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+Allowed values fpr TCP flags: `ack`, `cwr`, `ecn`, `fin`, `psh`,
+`rst`, `syn` and `urg`. Multiple values are supported, and for
+inverted selection use `not`, as shown in the example.
+
+``` none
+set firewall ipv4 input filter rule 10 tcp flags 'ack'
+set firewall ipv4 input filter rule 12 tcp flags 'syn'
+set firewall ipv4 input filter rule 13 tcp flags not 'fin'
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+Match against the state of a packet.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+time weekdays \<text\>
+
+Time to match the defined rule.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+ttl \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+ttl \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+ttl \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+ttl \<eq | gt | lt\> \<0-255\>
+
+Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for
+'greater than', and 'lt' stands for 'less than'.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+Match when 'count' amount of connections are seen within 'time'. These
+matching criteria can be used to block brute-force attempts.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 forward filter rule \<1-999999\>
+conntrack-helper \<module\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 input filter rule \<1-999999\>
+conntrack-helper \<module\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 output filter rule \<1-999999\>
+conntrack-helper \<module\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 name \<name\> rule \<1-999999\>
+conntrack-helper \<module\>
+
+Match based on connection tracking protocol helper module to secure use of
+that helper module. See below for possible completions <span class="title-ref">\<module\></span>.
+
+``` none
+Possible completions:
+    ftp                  Related traffic from FTP helper
+    h323                 Related traffic from H.323 helper
+    pptp                 Related traffic from PPTP helper
+    nfs                  Related traffic from NFS helper
+    sip                  Related traffic from SIP helper
+    tftp                 Related traffic from TFTP helper
+    sqlnet               Related traffic from SQLNet helper
+```
+
+</div>
+
+## Synproxy
+
+Synproxy connections
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[input | forward\] filter rule \<1-999999\>
+action synproxy
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[input | forward\] filter rule \<1-999999\>
+protocol tcp
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[input | forward\] filter rule \<1-999999\>
+synproxy tcp mss \<501-65535\>
+
+Set TCP-MSS (maximum segment size) for the connection
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv4 \[input | forward\] filter rule \<1-999999\>
+synproxy tcp window-scale \<1-14\>
+
+Set the window scale factor for TCP window scaling
+
+</div>
+
+### Example synproxy
+
+Requirements to enable synproxy:
+
+> - Traffic must be symmetric
+> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
+> - Disable conntrack loose track option
+
+``` none
+set system sysctl parameter net.ipv4.tcp_timestamps value '1'
+
+set system conntrack tcp loose disable
+set system conntrack ignore ipv4 rule 10 destination port '8080'
+set system conntrack ignore ipv4 rule 10 protocol 'tcp'
+set system conntrack ignore ipv4 rule 10 tcp flags syn
+
+set firewall global-options syn-cookies 'enable'
+set firewall ipv4 input filter rule 10 action 'synproxy'
+set firewall ipv4 input filter rule 10 destination port '8080'
+set firewall ipv4 input filter rule 10 inbound-interface name 'eth1'
+set firewall ipv4 input filter rule 10 protocol 'tcp'
+set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
+set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
+set firewall ipv4 input filter rule 1000 action 'drop'
+set firewall ipv4 input filter rule 1000 state invalid
+```
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+<div class="opcmd">
+
+show firewall
+
+This will show you a basic firewall overview, for all ruleset, and not
+only for ipv4
+
+``` none
+vyos@vyos:~$ show firewall
+Rulesets Information
+
+---------------------------------
+ipv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------
+20       accept    all                 0        0  ip saddr @N_TRUSTEDv4  accept
+21       jump      all                 0        0  jump NAME_AUX
+default  accept    all                 0        0
+
+---------------------------------
+ipv4 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -------------------------
+10       accept    all               156    14377  iifname != @I_LAN  accept
+default  accept    all                 0        0
+
+---------------------------------
+ipv4 Firewall "name AUX"
+
+  Rule  Action    Protocol      Packets    Bytes  Conditions
+------  --------  ----------  ---------  -------  --------------------------------------------
+    10  accept    icmp                0        0  meta l4proto icmp  accept
+    20  accept    udp                 0        0  meta l4proto udp ip saddr @A_SERVERS  accept
+    30  drop      all                 0        0  ip saddr != @A_SERVERS iifname "eth2"
+
+---------------------------------
+ipv4 Firewall "output filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------
+10       reject    all                 0        0  oifname @I_LAN
+20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
+default  accept    all                72     9258
+
+---------------------------------
+ipv6 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -------------------------------
+10       accept    all                 0        0  ip6 saddr @N6_TRUSTEDv6  accept
+default  accept    all                 2      112
+
+vyos@vyos:~$ 
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall summary
+
+This will show you a summary of rule-sets and groups
+
+``` none
+vyos@vyos:~$ show firewall summary 
+Ruleset Summary
+
+IPv6 Ruleset:
+
+Ruleset Hook    Ruleset Priority      Description
+--------------  --------------------  -------------------------
+forward         filter
+input           filter
+ipv6_name       IPV6-VyOS_MANAGEMENT
+ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
+
+IPv4 Ruleset:
+
+Ruleset Hook    Ruleset Priority    Description
+--------------  ------------------  -------------------------
+forward         filter
+input           filter
+name            VyOS_MANAGEMENT
+name            WAN_IN              PUBLIC_INTERNET
+
+Firewall Groups
+
+Name                     Type                References               Members
+-----------------------  ------------------  -----------------------  ----------------
+PBX                      address_group       WAN_IN-100               198.51.100.77
+SERVERS                  address_group       WAN_IN-110               192.0.2.10
+                                             WAN_IN-111               192.0.2.11
+                                             WAN_IN-112               192.0.2.12
+                                             WAN_IN-120
+                                             WAN_IN-121
+                                             WAN_IN-122
+SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
+                                             WAN_IN-20
+PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
+PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+                                             WAN_IN-171
+PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
+SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
+                                             IPV6-WAN_IN-111          2001:db8::3
+                                             IPV6-WAN_IN-112          2001:db8::4
+                                             IPV6-WAN_IN-120
+                                             IPV6-WAN_IN-121
+                                             IPV6-WAN_IN-122
+SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
+                                             IPV6-WAN_IN-20
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv4 \[forward | input | output\] filter
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv4 name \<name\>
+
+This command will give an overview of a single rule-set.
+
+``` none
+vyos@vyos:~$ show firewall ipv4 input filter 
+Ruleset Information
+
+---------------------------------
+IPv4 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------------------
+5        jump      all                 0        0  iifname "eth2"  jump NAME_VyOS_MANAGEMENT
+default  accept    all
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv4 \[forward | input | output\]
+filter rule \<1-999999\>
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv4 name \<name\> rule \<1-999999\>
+
+This command will give an overview of a rule in a single rule-set, plus
+information for default action.
+
+</div>
+
+``` none
+vyos@vyos:~$show firewall ipv4 output filter rule 20
+Rule Information
+
+---------------------------------
+ipv4 Firewall "output filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------
+20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
+default  accept    all               286    47614
+
+vyos@vyos:~$
+```
+
+<div class="opcmd">
+
+show firewall statistics
+
+This will show you a statistic of all rule-sets since the last boot.
+
+</div>
+
+### Show Firewall log
+
+<div class="opcmd">
+
+show log firewall
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4 \[forward | input | output | name\]
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4 \[forward | input | output\] filter
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4 name \<name\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4 \[forward | input | output\] filter rule \<rule\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv4 name \<name\> rule \<rule\>
+
+Show the logs of all firewall; show all ipv4 firewall logs; show all logs
+for particular hook; show all logs for particular hook and priority;
+show all logs for particular custom chain; show logs for specific Rule-Set.
+
+</div>
+
+### Example Partial Config
+
+``` none
+firewall {
+    group {
+        network-group BAD-NETWORKS {
+            network 198.51.100.0/24
+            network 203.0.113.0/24
+        }
+        network-group GOOD-NETWORKS {
+            network 192.0.2.0/24
+        }
+        port-group BAD-PORTS {
+            port 65535
+        }
+    }
+    ipv4 {
+        forward {
+            filter {
+                default-action accept
+                rule 5 {
+                    action accept
+                    source {
+                        group {
+                            network-group GOOD-NETWORKS
+                        }
+                    }
+                }
+                rule 10 {
+                    action drop
+                    description "Bad Networks"
+                    protocol all
+                    source {
+                        group {
+                            network-group BAD-NETWORKS
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+### Update geoip database
+
+<div class="opcmd">
+
+update geoip
+
+Command used to update GeoIP database and firewall sets.
+
+</div>
diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md
new file mode 100644
index 00000000..a6c2aabf
--- /dev/null
+++ b/docs/configuration/firewall/md-ipv6.md
@@ -0,0 +1,2638 @@
+lastproofread  
+2023-11-08
+
+# IPv6 Firewall Configuration
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding IPv6, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+<div class="cfgcmd">
+
+set firewall ipv6 ...
+
+</div>
+
+From main structure defined in
+`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+``` none
+- set firewall
+    * ipv6
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+```
+
+For transit traffic, which is received by the router and forwarded, base chain
+is **forward**. A simplified packet flow diagram for transit traffic is shown
+next:
+
+<figure>
+<img src="/_static/images/firewall-fwd-packet-flow.webp" />
+</figure>
+
+Where firewall base chain to configure firewall filtering rules for transit
+traffic is `set firewall ipv6 forward filter ...`, which happens in stage 5,
+highlightened with red color.
+
+For traffic towards the router itself, base chain is **input**, while traffic
+originated by the router, base chain is **output**.
+A new simplified packet flow diagram is shown next, which shows the path
+for traffic destinated to the router itself, and traffic generated by the
+router (starting from circle number 6):
+
+<figure>
+<img src="/_static/images/firewall-input-packet-flow.webp" />
+</figure>
+
+Base chain is for traffic toward the router is `set firewall ipv6 input filter ...`
+
+And base chain for traffic generated by the router is `set firewall ipv6 output filter ...`
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**
+
+</div>
+
+Custom firewall chains can be created, with commands
+`set firewall ipv6 name <name> ...`. In order to use
+such custom chain, a rule with **action jump**, and the appropiate **target**
+should be defined in a base chain.
+
+## Firewall - IPv6 Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+The action can be :
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `reject`: reject the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+> - `synproxy`: synproxy the packet.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return | synproxy\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return | synproxy\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> action
+\[accept | continue | drop | jump | queue | reject | return\]
+
+This required setting defines the action of the current rule. If action is
+set to jump, then jump-target is also needed.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+jump-target \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+jump-target \<text\>
+
+To be used only when action is set to `jump`. Use this command to specify
+jump target.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+queue \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+queue \<0-65535\>
+
+To be used only when action is set to `queue`. Use this command to specify
+queue target to use. Queue range is also supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+queue-options bypass
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+queue-options bypass
+
+To be used only when action is set to `queue`. Use this command to let
+packet go through firewall when no userspace software is connected to the
+queue.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+queue-options fanout
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+queue-options fanout
+
+To be used only when action is set to `queue`. Use this command to
+distribute packets between several queues.
+
+</div>
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter default-action
+\[accept | drop\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> default-action
+\[accept | drop | jump | queue | reject | return\]
+
+This set the default action of the rule-set if no rule matched a packet
+criteria. If default-action is set to `jump`, then
+`default-jump-target` is also needed. Note that for base chains, default
+action can only be set to `accept` or `drop`, while on custom chain,
+more actions are available.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> default-jump-target \<text\>
+
+To be used only when `defult-action` is set to `jump`. Use this
+command to specify jump target for default rule.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+
+</div>
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\> log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> log
+
+Enable logging for the matched packet. If this configuration command is not
+present, then log is not enabled.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter default-log
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> default-log
+
+Use this command to enable the logging of the default action on
+the specified chain.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+log-options level \[emerg | alert | crit | err | warn | notice
+| info | debug\]
+
+Define log-level. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+log-options group \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+log-options group \<0-65535\>
+
+Define log group to send message to. Only applicable if rule log is enable.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+log-options snapshot-length \<0-9000\>
+
+Define length of packet payload to include in netlink message. Only
+applicable if rule log is enable and log group is defined.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+log-options queue-threshold \<0-65535\>
+
+Define number of packets to queue inside the kernel before sending them to
+userspace. Only applicable if rule log is enable and log group is defined.
+
+</div>
+
+### Firewall Description
+
+For reference, a description can be defined for every single rule, and for
+every defined custom chain.
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> description \<text\>
+
+Provide a rule-set description to a custom firewall chain.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+description \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> description \<text\>
+
+Provide a description for each rule.
+
+</div>
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\> disable
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\> disable
+
+Command for disabling a rule but keep it in the configuration.
+
+</div>
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+connection-status nat \[destination | source\]
+
+Match criteria based on nat connection status.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+connection-mark \<1-2147483647\>
+
+Match criteria based on connection mark.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination address \[address | addressrange | CIDR\]
+
+Match criteria based on source and/or destination address. This is similar
+to the network groups part, but here you are able to negate the matching
+addresses.
+
+``` none
+set firewall ipv6 name FOO rule 100 source address 2001:db8::202
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination address-mask \[address\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination address-mask \[address\]
+
+An arbitrary netmask can be applied to mask addresses to only match against
+a specific portion. This is particularly useful with IPv6 as rules will
+remain valid if the IPv6 prefix changes and the host
+portion of systems IPv6 address is static (for example, with SLAAC or
+[tokenised IPv6 addresses](https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt))
+
+This functions for both individual addresses and address groups.
+
+``` none
+# Match any IPv6 address with the suffix ::0000:0000:0000:beef
+set firewall ipv6 forward filter rule 100 destination address ::beef
+set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff
+# Address groups
+set firewall group ipv6-address-group WEBSERVERS address ::1000
+set firewall group ipv6-address-group WEBSERVERS address ::2000
+set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS
+set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination fqdn \<fqdn\>
+
+Specify a Fully Qualified Domain Name as source/destination matcher. Ensure
+router is able to resolve such dns query.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination geoip country-code \<country\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination geoip inverse-match
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination geoip inverse-match
+
+Match IP addresses based on its geolocation. More info: [geoip matching](https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching).
+Use inverse-match to match anything except the given country-codes.
+
+</div>
+
+Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required,
+permits redistribution so we can include a database in images(~3MB
+compressed). Includes cron script (manually callable by op-mode update
+geoip) to keep database and rules updated.
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source mac-address \<mac-address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source mac-address \<mac-address\>
+
+Only in the source criteria, you can specify a mac-address.
+
+``` none
+set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33
+set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination port \[1-65535 | portname | start-end\]
+
+A port can be set with a port number or a name which is here
+defined: `/etc/services`.
+
+``` none
+set firewall ipv6 forward filter rule 10 source port '22'
+set firewall ipv6 forward filter rule 11 source port '!http'
+set firewall ipv6 forward filter rule 12 source port 'https'
+```
+
+Multiple source ports can be specified as a comma-separated list.
+The whole list can also be "negated" using `!`. For example:
+
+``` none
+set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338'
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group address-group \<name | !name\>
+
+Use a specific address-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group dynamic-address-group \<name | !name\>
+
+Use a specific dynamic-address-group. Prepend character `!` for inverted
+matching criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group network-group \<name | !name\>
+
+Use a specific network-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group port-group \<name | !name\>
+
+Use a specific port-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group domain-group \<name | !name\>
+
+Use a specific domain-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+source group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+destination group mac-group \<name | !name\>
+
+Use a specific mac-group. Prepend character `!` for inverted matching
+criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+dscp \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+dscp-exclude \[0-63 | start-end\]
+
+Match based on dscp value.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+fragment \[match-frag | match-non-frag\]
+
+Match based on fragment criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+icmpv6 \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+icmpv6 \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+icmpv6 \[code | type\] \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+icmpv6 \[code | type\] \<0-255\>
+
+Match based on icmp|icmpv6 code and type.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+icmpv6 type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+icmpv6 type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+icmpv6 type-name \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+icmpv6 type-name \<text\>
+
+Match based on icmpv6 type-name criteria. Use tab for information
+about what **type-name** criteria are supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+inbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+inbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+inbound-interface name \<iface\>
+
+Match based on inbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If an interface is attached to a non-default vrf, when using
+**inbound-interface**, vrf name must be used. For example `set firewall ipv6 forward filter rule 10 inbound-interface name MGMT`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+inbound-interface group \<iface_group\>
+
+Match based on inbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+outbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+outbound-interface name \<iface\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+outbound-interface name \<iface\>
+
+Match based on outbound interface. Wilcard `*` can be used.
+For example: `eth2*`. Prepending character `!` for inverted matching
+criteria is also supportd. For example `!eth2`
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If an interface is attached to a non-default vrf, when using
+**outbound-interface**, real interface name must be used. For example
+`set firewall ipv6 forward filter rule 10 outbound-interface name eth0`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+outbound-interface group \<iface_group\>
+
+Match based on outbound interface group. Prepending character `!` for
+inverted matching criteria is also supportd. For example `!IFACE_GROUP`
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+ipsec \[match-ipsec | match-none\]
+
+Match based on ipsec criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+limit burst \<0-4294967295\>
+
+Match based on the maximum number of packets to allow in excess of rate.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+limit rate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+limit rate \<text\>
+
+Match based on the maximum average rate, specified as **integer/unit**.
+For example **5/minutes**
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+packet-length \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+packet-length-exclude \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+packet-length-exclude \<text\>
+
+Match based on packet length criteria. Multiple values from 1 to 65535
+and ranges are supported.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+packet-type \[broadcast | host | multicast | other\]
+
+Match based on packet type criteria.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+protocol \[\<text\> | \<0-255\> | all | tcp_udp\]
+
+Match a protocol criteria. A protocol number or a name which is here
+defined: `/etc/protocols`.
+Special names are `all` for all protocols and `tcp_udp` for tcp and udp
+based packets. The `!` negate the selected protocol.
+
+``` none
+set firewall ipv6 input filter rule 10 protocol tcp
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+recent time \[second | minute | hour\]
+
+Match bases on recently seen sources.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+tcp flags \[not\] \<text\>
+
+Allowed values fpr TCP flags: `ack`, `cwr`, `ecn`, `fin`, `psh`,
+`rst`, `syn` and `urg`. Multiple values are supported, and for
+inverted selection use `not`, as shown in the example.
+
+``` none
+set firewall ipv6 input filter rule 10 tcp flags 'ack'
+set firewall ipv6 input filter rule 12 tcp flags 'syn'
+set firewall ipv6 input filter rule 13 tcp flags not 'fin'
+```
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+state \[established | invalid | new | related\]
+
+Match against the state of a packet.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+time startdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+time starttime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+time stopdate \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+time stoptime \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+time weekdays \<text\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+time weekdays \<text\>
+
+Time to match the defined rule.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+hop-limit \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+hop-limit \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+hop-limit \<eq | gt | lt\> \<0-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+hop-limit \<eq | gt | lt\> \<0-255\>
+
+Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for
+'greater than', and 'lt' stands for 'less than'.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+recent count \<1-255\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 forward filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 input filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 output filter rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 name \<name\> rule \<1-999999\>
+recent time \<second | minute | hour\>
+
+Match when 'count' amount of connections are seen within 'time'. These
+matching criteria can be used to block brute-force attempts.
+
+</div>
+
+## Synproxy
+
+Synproxy connections
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[input | forward\] filter rule \<1-999999\>
+action synproxy
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[input | forward\] filter rule \<1-999999\>
+protocol tcp
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[input | forward\] filter rule \<1-999999\>
+synproxy tcp mss \<501-65535\>
+
+Set TCP-MSS (maximum segment size) for the connection
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall ipv6 \[input | forward\] filter rule \<1-999999\>
+synproxy tcp window-scale \<1-14\>
+
+Set the window scale factor for TCP window scaling
+
+</div>
+
+### Example synproxy
+
+Requirements to enable synproxy:
+
+> - Traffic must be symmetric
+> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
+> - Disable conntrack loose track option
+
+``` none
+set system sysctl parameter net.ipv4.tcp_timestamps value '1'
+
+set system conntrack tcp loose disable
+set system conntrack ignore ipv6 rule 10 destination port '8080'
+set system conntrack ignore ipv6 rule 10 protocol 'tcp'
+set system conntrack ignore ipv6 rule 10 tcp flags syn
+
+set firewall global-options syn-cookies 'enable'
+set firewall ipv6 input filter rule 10 action 'synproxy'
+set firewall ipv6 input filter rule 10 destination port '8080'
+set firewall ipv6 input filter rule 10 inbound-interface name 'eth1'
+set firewall ipv6 input filter rule 10 protocol 'tcp'
+set firewall ipv6 input filter rule 10 synproxy tcp mss '1460'
+set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7'
+set firewall ipv6 input filter rule 1000 action 'drop'
+set firewall ipv6 input filter rule 1000 state invalid
+```
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+<div class="opcmd">
+
+show firewall
+
+This will show you a basic firewall overview
+
+``` none
+vyos@vyos:~$ show firewall
+Rulesets Information
+
+---------------------------------
+IPv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------------------
+5        jump      all                 0        0  iifname "eth1"  jump NAME_VyOS_MANAGEMENT
+10       jump      all                 0        0  oifname "eth1"  jump NAME_WAN_IN
+15       jump      all                 0        0  iifname "eth3"  jump NAME_WAN_IN
+default  accept    all
+
+---------------------------------
+IPv4 Firewall "name VyOS_MANAGEMENT"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------------------------
+5        accept    all                 0        0  ct state established  accept
+10       drop      all                 0        0  ct state invalid
+20       accept    all                 0        0  ip saddr @A_GOOD_GUYS  accept
+30       accept    all                 0        0  ip saddr @N_ENTIRE_RANGE  accept
+40       accept    all                 0        0  ip saddr @A_VyOS_SERVERS  accept
+50       accept    icmp                0        0  meta l4proto icmp  accept
+default  drop      all                 0        0
+
+---------------------------------
+IPv6 Firewall "forward filter"
+
+Rule     Action    Protocol
+-------  --------  ----------
+5        jump      all
+10       jump      all
+15       jump      all
+default  accept    all
+
+---------------------------------
+IPv6 Firewall "input filter"
+
+Rule     Action    Protocol
+-------  --------  ----------
+5        jump      all
+default  accept    all
+
+---------------------------------
+IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT"
+
+Rule     Action    Protocol
+-------  --------  ----------
+5        accept    all
+10       drop      all
+20       accept    all
+30       accept    all
+40       accept    all
+50       accept    ipv6-icmp
+default  drop      all
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall summary
+
+This will show you a summary of rule-sets and groups
+
+``` none
+vyos@vyos:~$ show firewall summary
+Ruleset Summary
+
+IPv6 Ruleset:
+
+Ruleset Hook    Ruleset Priority      Description
+--------------  --------------------  -------------------------
+forward         filter
+input           filter
+ipv6_name       IPV6-VyOS_MANAGEMENT
+ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
+
+IPv4 Ruleset:
+
+Ruleset Hook    Ruleset Priority    Description
+--------------  ------------------  -------------------------
+forward         filter
+input           filter
+name            VyOS_MANAGEMENT
+name            WAN_IN              PUBLIC_INTERNET
+
+Firewall Groups
+
+Name                     Type                References               Members
+-----------------------  ------------------  -----------------------  ----------------
+PBX                      address_group       WAN_IN-100               198.51.100.77
+SERVERS                  address_group       WAN_IN-110               192.0.2.10
+                                             WAN_IN-111               192.0.2.11
+                                             WAN_IN-112               192.0.2.12
+                                             WAN_IN-120
+                                             WAN_IN-121
+                                             WAN_IN-122
+SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
+                                             WAN_IN-20
+PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
+PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+                                             WAN_IN-171
+PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
+SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
+                                             IPV6-WAN_IN-111          2001:db8::3
+                                             IPV6-WAN_IN-112          2001:db8::4
+                                             IPV6-WAN_IN-120
+                                             IPV6-WAN_IN-121
+                                             IPV6-WAN_IN-122
+SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
+                                             IPV6-WAN_IN-20
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv6 \[forward | input | output\] filter
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv6 ipv6-name \<name\>
+
+This command will give an overview of a single rule-set.
+
+``` none
+vyos@vyos:~$ show firewall ipv6 input filter
+Ruleset Information
+
+---------------------------------
+ipv6 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ------------------------------------------------------------------------------
+10       jump      all                13     1456  iifname "eth1"  jump NAME6_INP-ETH1
+20       accept    ipv6-icmp          10     1112  meta l4proto ipv6-icmp iifname "eth0"  prefix "[ipv6-INP-filter-20-A]"  accept
+default  accept    all                14     1584
+
+vyos@vyos:~$
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv6 \[forward | input | output\]
+filter rule \<1-999999\>
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv6 name \<name\> rule \<1-999999\>
+
+</div>
+
+<div class="opcmd">
+
+show firewall ipv6 ipv6-name \<name\> rule \<1-999999\>
+
+This command will give an overview of a rule in a single rule-set
+
+</div>
+
+<div class="opcmd">
+
+show firewall group \<name\>
+
+Overview of defined groups. You see the type, the members, and where the
+group is used.
+
+``` none
+vyos@vyos:~$ show firewall group LAN
+Firewall Groups
+
+Name          Type                References               Members
+------------  ------------------  -----------------------  ----------------
+LAN           ipv6_network_group  IPV6-VyOS_MANAGEMENT-30  2001:db8::0/64
+                                  IPV6-WAN_IN-30
+LAN           network_group       VyOS_MANAGEMENT-30       192.168.200.0/24
+                                  WAN_IN-30
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall statistics
+
+This will show you a statistic of all rule-sets since the last boot.
+
+</div>
+
+### Show Firewall log
+
+<div class="opcmd">
+
+show log firewall
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6 \[forward | input | output | name\]
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6 \[forward | input | output\] filter
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6 name \<name\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6 \[forward | input | output\] filter rule \<rule\>
+
+</div>
+
+<div class="opcmd">
+
+show log firewall ipv6 name \<name\> rule \<rule\>
+
+Show the logs of all firewall; show all ipv6 firewall logs; show all logs
+for particular hook; show all logs for particular hook and priority;
+show all logs for particular custom chain; show logs for specific Rule-Set.
+
+</div>
+
+### Example Partial Config
+
+``` none
+firewall {
+    ipv6 {
+        input {
+            filter {
+                rule 10 {
+                    action jump
+                    inbound-interface {
+                        name eth1
+                    }
+                    jump-target INP-ETH1
+                }
+                rule 20 {
+                    action accept
+                    inbound-interface {
+                        name eth0
+                    }
+                    log
+                    protocol ipv6-icmp
+                }
+            }
+        }
+        name INP-ETH1 {
+            default-action drop
+            default-log
+            rule 10 {
+                action accept
+                protocol tcp_udp
+            }
+        }
+    }
+}
+```
+
+### Update geoip database
+
+<div class="opcmd">
+
+update geoip
+
+Command used to update GeoIP database and firewall sets.
+
+</div>
diff --git a/docs/configuration/firewall/md-zone.md b/docs/configuration/firewall/md-zone.md
new file mode 100644
index 00000000..6eb27b6c
--- /dev/null
+++ b/docs/configuration/firewall/md-zone.md
@@ -0,0 +1,209 @@
+lastproofread  
+2023-11-01
+
+# Zone Based Firewall
+
+## Overview
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Starting from VyOS 1.4-rolling-202308040557, a new firewall
+structure can be found on all vyos instalations. Zone based firewall was
+removed in that version, but re introduced in VyOS 1.4 and 1.5. All
+versions built after 2023-10-22 has this feature.
+Documentation for most of the new firewall CLI can be
+found in the [firewall](https://docs.vyos.io/en/latest/configuration/firewall/general.html)
+chapter. The legacy firewall is still available for versions before
+1.4-rolling-202308040557 and can be found in the
+`legacy firewall configuration </configuration/firewall/general-legacy>`
+chapter.
+
+</div>
+
+In this section there's useful information of all firewall configuration that
+is needed for zone-based firewall.
+Configuration commands covered in this section:
+
+<div class="cfgcmd">
+
+set firewall zone ...
+
+</div>
+
+From main structure defined in
+`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+``` none
+- set firewall
+    * zone
+         - custom_zone_name
+            + ...
+```
+
+In zone-based policy, interfaces are assigned to zones, and inspection policy
+is applied to traffic moving between the zones and acted on according to
+firewall rules. A zone is a group of interfaces that have similar functions or
+features. It establishes the security borders of a network. A zone defines a
+boundary where traffic is subjected to policy restrictions as it crosses to
+another region of a network.
+
+Key Points:
+
+- A zone must be configured before an interface is assigned to it and an
+  interface can be assigned to only a single zone.
+- All traffic to and from an interface within a zone is permitted.
+- All traffic between zones is affected by existing policies
+- Traffic cannot flow between zone member interface and any interface that is
+  not a zone member.
+- You need 2 separate firewalls to define traffic: one for each direction.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+In `T2199` the syntax of the zone configuration was changed.
+The zone configuration moved from `zone-policy zone <name>` to `firewall zone <name>`.
+
+</div>
+
+## Configuration
+
+As an alternative to applying policy to an interface directly, a zone-based
+firewall can be created to simplify configuration when multiple interfaces
+belong to the same security zone. Instead of applying rule-sets to interfaces,
+they are applied to source zone-destination zone pairs.
+
+A basic introduction to zone-based firewalls can be found [here](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall),
+and an example at `examples-zone-policy`.
+
+### Define a Zone
+
+To define a zone setup either one with interfaces or a local zone.
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> interface \<interface\>
+
+Set interfaces to a zone. A zone can have multiple interfaces.
+But an interface can only be a member in one zone.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> local-zone
+
+Define the zone as a local zone. A local zone has no interfaces and
+will be applied to the router itself.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> default-action \[drop | reject\]
+
+Change the default-action with this setting.
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> description
+
+Set a meaningful description.
+
+</div>
+
+### Applying a Rule-Set to a Zone
+
+Before you are able to apply a rule-set to a zone you have to create the zones
+first.
+
+It helps to think of the syntax as: (see below). The 'rule-set' should be
+written from the perspective of: *Source Zone*-to-\>\*Destination Zone\*
+
+<div class="cfgcmd">
+
+set firewall zone \<Destination Zone\> from \<Source Zone\>
+firewall name \<rule-set\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> from \<name\> firewall name
+\<rule-set\>
+
+</div>
+
+<div class="cfgcmd">
+
+set firewall zone \<name\> from \<name\> firewall ipv6-name
+\<rule-set\>
+
+You apply a rule-set always to a zone from an other zone, it is recommended
+to create one rule-set for each zone pair.
+
+``` none
+set firewall zone DMZ from LAN firewall name LANv4-to-DMZv4
+set firewall zone LAN from DMZ firewall name DMZv4-to-LANv4
+```
+
+</div>
+
+## Operation-mode
+
+<div class="opcmd">
+
+show firewall zone-policy
+
+This will show you a basic summary of zones configuration.
+
+``` none
+vyos@vyos:~$ show firewall zone-policy
+Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+------  ------------  -----------  ---------------  ---------------
+LAN     eth1          WAN          WAN_to_LAN
+        eth2
+LOCAL   LOCAL         LAN          LAN_to_LOCAL
+                      WAN          WAN_to_LOCAL     WAN_to_LOCAL_v6
+WAN     eth3          LAN          LAN_to_WAN
+        eth0          LOCAL        LOCAL_to_WAN
+vyos@vyos:~$
+```
+
+</div>
+
+<div class="opcmd">
+
+show firewall zone-policy zone \<zone\>
+
+This will show you a basic summary of a particular zone.
+
+``` none
+vyos@vyos:~$ show firewall zone-policy zone WAN
+Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+------  ------------  -----------  ---------------  ---------------
+WAN     eth3          LAN          LAN_to_WAN
+        eth0          LOCAL        LOCAL_to_WAN
+vyos@vyos:~$ show firewall zone-policy zone LOCAL
+Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+------  ------------  -----------  ---------------  ---------------
+LOCAL   LOCAL         LAN          LAN_to_LOCAL
+                      WAN          WAN_to_LOCAL     WAN_to_LOCAL_v6
+vyos@vyos:~$
+```
+
+</div>
author	Yuriy Andamasov <yuriy@vyos.io>	2026-05-06 14:41:08 +0300
committer	GitHub <noreply@github.com>	2026-05-06 12:41:08 +0100
commit	22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e (patch)
tree	8d97f7766d9bbd2d0e3a55e5643a60b387308675 /docs/configuration/firewall
parent	c21b38dbe24088eaca73dbc8030cfebc898d2186 (diff)
download	vyos-documentation-22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.tar.gz vyos-documentation-22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.zip