feat: import MyST swap mechanism + content for sagitta (replaces #1886)

Replaces the broken #1886 with a fresh, properly-converted MyST set for
the sagitta (1.4.x) docs, mirroring what landed for circinus via #1897.

This PR:

- Re-imports 210 md-*.md files for sagitta. Source: ran the pipelines
  rst-to-myst converter (chrisjsewell/rst-to-myst v0.4.0, with pandoc
  fallback) on sagittas RST. Post-processed via the pipelines
  postprocess stage (10 ordered fixes for blanks, admonitions, label
  hyphens, pandoc artifacts, structural blanks, linter markers).
  Compared to the broken #1886 content (which was left over from an
  earlier stage-1-only run): zero raw `<div class=>` remnants.

- For 23 stems where sagittas RST is byte-identical with currents RST
  (mostly stable policy/protocol pages and the 404 page), reuses currents
  already-validated md-*.md content rather than re-converting.

- Drops cli and installation/cloud/aws from sagittas swap set: their
  RST has SEVERE/4 "Title level inconsistent" errors that crash
  rst-to-myst; they need an independent RST-source fix and are kept as
  RST-only for now.

- Adds the per-page swap mechanism: scripts/swap_sources.py,
  scripts/import_myst.py, the matching tests under tests/, _swap.txt
  with 210 stems, _ext/vyos.py MyST renderer fallback, Makefile
  swap-wrapped targets, .readthedocs.yml swap pre/post hooks.

- Adds 187 .webp images and removes 235 superseded .jpg/.png/.jpeg
  static assets; flips html_logo to vyos-logo.webp.

- Adds the MyST swap-related blocks to docs/conf.py only:
  myst_enable_extensions, myst_fence_as_directive, md-*.md exclude
  patterns, _swap_exclude.txt reader, _prefer_webp and _copy_md_sources
  setup hooks. github_version fallback set to 'sagitta' to match the
  branch (parallel to currents 'current' and circinuss 'circinus').

Deliberately excluded (per user direction):

- llms.txt and sphinx-llms-txt / sphinx-sitemap config: these will
  land separately for sagitta via #1870 plus a new sagitta-specific
  llms.txt template PR. The conf.py here does not pull those extensions
  in, so the build does not depend on the new pip packages.

Verification before pushing:

- 210 md-*.md = 210 _swap.txt stems = 210 RST siblings on sagitta (1:1:1).
- 0 files contain raw `<div class=` (the breakage that took down /en/1.5/).
- conf.py copyright/version/release preserve sagittas values
  (2024 / 1.4 / "1.4.x (sagitta)") - not currents.
- html_title from currents conf.py removed - PR #1880 is the right place
  for sagittas branch-localized title.

Supersedes / closes on merge:

- #1886 (broken converter output, would break /en/1.4/ if merged).

Generated by robots https://vyos.io

8 files changed, 5841 insertions, 0 deletions

diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md
new file mode 100644
index 00000000..ebb9287d
--- /dev/null
+++ b/docs/configuration/firewall/md-bridge.md
@@ -0,0 +1,543 @@
+---
+lastproofread: '2023-11-08'
+---
+
+(firewall-configuration)=
+
+# Bridge Firewall Configuration
+
+:::{note}
+**Documentation under development**
+:::
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding bridge, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge ...
+```
+
+From main structure defined in {doc}`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+```none
+- set firewall
+    * bridge
+         - forward
+            + filter
+         - name
+            + custom_name
+```
+
+Traffic which is received by the router on an interface which is member of a
+bridge is processed on the **Bridge Layer**. A simplified packet flow diagram
+for this layer is shown next:
+
+:::{figure} /_static/images/firewall-bridge-packet-flow.png
+:::
+
+For traffic that needs to be forwared internally by the bridge, base chain is
+is **forward**, and it's base command for filtering is `set firewall bridge
+forward filter ...`, which happens in stage 4, highlightened with red color.
+
+Custom bridge firewall chains can be create with command `set firewall bridge
+name <name> ...`. In order to use such custom chain, a rule with action jump,
+and the appropiate target should be defined in a base chain.
+
+:::{note}
+**Layer 3 bridge**:
+When an IP address is assigned to the bridge interface, and if traffic
+is sent to the router to this IP (for example using such IP as
+default gateway), then rules defined for **bridge firewall** won't
+match, and firewall analysis continues at **IP layer**.
+:::
+
+## Bridge Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+In firewall bridge rules, the action can be:
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | return]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999> action
+   [accept | continue | drop | jump | queue | return]
+
+   This required setting defines the action of the current rule. If action is
+   set to jump, then jump-target is also needed.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   queue <0-65535>
+
+   To be used only when action is set to ``queue``. Use this command to specify
+   queue target to use. Queue range is also supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   queue-options bypass
+
+   To be used only when action is set to ``queue``. Use this command to let
+   packet go through firewall when no userspace software is connected to the
+   queue.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   queue-options fanout
+
+   To be used only when action is set to ``queue``. Use this command to
+   distribute packets between several queues.
+```
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> default-action
+   [accept | continue | drop | jump | queue | return]
+
+   This set the default action of the rule-set if no rule matched a packet
+   criteria. If default-action is set to ``jump``, then
+   ``default-jump-target`` is also needed. Note that for base chains, default
+   action can only be set to ``accept`` or ``drop``, while on custom chain,
+   more actions are available.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> default-jump-target <text>
+
+   To be used only when ``defult-action`` is set to ``jump``. Use this
+   command to specify jump target for default rule.
+```
+
+:::{note}
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+:::
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999> log
+
+   Enable logging for the matched packet. If this configuration command is not
+   present, then log is not enabled.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> default-log
+
+   Use this command to enable the logging of the default action on
+   the specified chain.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+
+   Define log-level. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   log-options group <0-65535>
+
+   Define log group to send message to. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   log-options snapshot-length <0-9000>
+
+   Define length of packet payload to include in netlink message. Only
+   applicable if rule log is enable and log group is defined.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   log-options queue-threshold <0-65535>
+
+   Define number of packets to queue inside the kernel before sending them to
+   userspace. Only applicable if rule log is enable and log group is defined.
+```
+
+### Firewall Description
+
+For reference, a description can be defined for every defined custom chain.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> description <text>
+
+   Provide a rule-set description to a custom firewall chain.
+```
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999> disable
+
+   Command for disabling a rule but keep it in the configuration.
+```
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   destination mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   destination mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   source mac-address <mac-address>
+
+   Match criteria based on source and/or destination mac-address.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   inbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   inbound-interface name <iface>
+
+   Match based on inbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   inbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   inbound-interface group <iface_group>
+
+   Match based on inbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   outbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   outbound-interface name <iface>
+
+   Match based on outbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   outbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   outbound-interface group <iface_group>
+
+   Match based on outbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   vlan id <0-4096>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   vlan id <0-4096>
+
+   Match based on vlan ID. Range is also supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge forward filter rule <1-999999>
+   vlan priority <0-7>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall bridge name <name> rule <1-999999>
+   vlan priority <0-7>
+
+   Match based on vlan priority(pcp). Range is also supported.
+```
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+In this section you can find all useful firewall op-mode commands.
+
+General commands for firewall configuration, counter and statiscits:
+
+```{eval-rst}
+.. opcmd:: show firewall
+```
+
+```{eval-rst}
+.. opcmd:: show firewall summary
+```
+
+```{eval-rst}
+.. opcmd:: show firewall statistics
+```
+
+And, to print only bridge firewall information:
+
+```{eval-rst}
+.. opcmd:: show firewall bridge
+```
+
+```{eval-rst}
+.. opcmd:: show firewall bridge forward filter
+```
+
+```{eval-rst}
+.. opcmd:: show firewall bridge forward filter rule <rule>
+```
+
+```{eval-rst}
+.. opcmd:: show firewall bridge name <name>
+```
+
+```{eval-rst}
+.. opcmd:: show firewall bridge name <name> rule <rule>
+```
+
+### Show Firewall log
+
+```{eval-rst}
+.. opcmd:: show log firewall
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge forward
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge forward filter
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge name <name>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge forward filter rule <rule>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall bridge name <name> rule <rule>
+
+   Show the logs of all firewall; show all bridge firewall logs; show all logs
+   for forward hook; show all logs for forward hook and priority filter; show
+   all logs for particular custom chain; show logs for specific Rule-Set.
+```
+
+### Example
+
+Configuration example:
+
+```none
+set firewall bridge forward filter default-action 'drop'
+set firewall bridge forward filter default-log
+set firewall bridge forward filter rule 10 action 'continue'
+set firewall bridge forward filter rule 10 inbound-interface name 'eth2'
+set firewall bridge forward filter rule 10 vlan id '22'
+set firewall bridge forward filter rule 20 action 'drop'
+set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT'
+set firewall bridge forward filter rule 20 vlan id '60'
+set firewall bridge forward filter rule 30 action 'jump'
+set firewall bridge forward filter rule 30 jump-target 'TEST'
+set firewall bridge forward filter rule 30 outbound-interface name '!eth1'
+set firewall bridge forward filter rule 35 action 'accept'
+set firewall bridge forward filter rule 35 vlan id '11'
+set firewall bridge forward filter rule 40 action 'continue'
+set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11'
+set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66'
+set firewall bridge name TEST default-action 'accept'
+set firewall bridge name TEST default-log
+set firewall bridge name TEST rule 10 action 'continue'
+set firewall bridge name TEST rule 10 log
+set firewall bridge name TEST rule 10 vlan priority '0'
+```
+
+And op-mode commands:
+
+```none
+vyos@BRI:~$ show firewall bridge
+Rulesets bridge Information
+
+---------------------------------
+bridge Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ---------------------------------------------------------------------
+10       continue  all                 0        0  iifname "eth2" vlan id 22  continue
+20       drop      all                 0        0  iifname @I_TRUNK-RIGHT vlan id 60
+30       jump      all              2130   170688  oifname != "eth1"  jump NAME_TEST
+35       accept    all              2080   168616  vlan id 11  accept
+40       continue  all                 0        0  ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66  continue
+default  drop      all                 0        0
+
+---------------------------------
+bridge Firewall "name TEST"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------------------------------------------
+10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
+default  accept    all              2130   170688
+
+vyos@BRI:~$
+vyos@BRI:~$ show firewall bridge name TEST
+Ruleset Information
+
+---------------------------------
+bridge Firewall "name TEST"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------------------------------------------
+10       continue  all              2130   170688  vlan pcp 0  prefix "[bri-NAM-TEST-10-C]"  continue
+default  accept    all              2130   170688
+
+vyos@BRI:~$
+```
+
+Inspect logs:
+
+```none
+vyos@BRI:~$ show log firewall bridge
+Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102
+...
+vyos@BRI:~$ show log firewall bridge forward filter
+Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+```
diff --git a/docs/configuration/firewall/md-flowtables.md b/docs/configuration/firewall/md-flowtables.md
new file mode 100644
index 00000000..bc9fc457
--- /dev/null
+++ b/docs/configuration/firewall/md-flowtables.md
@@ -0,0 +1,195 @@
+---
+lastproofread: '2024-06-20'
+---
+
+(firewall-flowtables-configuration)=
+
+# Flowtables Firewall Configuration
+
+:::{note}
+**Documentation under development**
+:::
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding flowtables.
+
+```{eval-rst}
+.. cfgcmd:: set firewall flowtables ...
+```
+
+From main structure defined in
+{doc}`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+```none
+- set firewall
+    * flowtable
+         - custom_flow_table
+            + ...
+```
+
+Flowtables allows you to define a fastpath through the flowtable datapath.
+The flowtable supports for the layer 3 IPv4 and IPv6 and the layer 4 TCP
+and UDP protocols.
+
+:::{figure} /_static/images/firewall-flowtable-packet-flow.png
+:::
+
+Once the first packet of the flow successfully goes through the IP forwarding
+path (black circles path), from the second packet on, you might decide to
+offload the flow to the flowtable through your ruleset. The flowtable
+infrastructure provides a rule action that allows you to specify when to add
+a flow to the flowtable (On forward filtering, red circle number 6)
+
+A packet that finds a matching entry in the flowtable (flowtable hit) is
+transmitted to the output netdevice, hence, packets bypass the classic IP
+forwarding path and uses the **Fast Path** (orange circles path). The visible
+effect is that you do not see these packets from any of the Netfilter
+hooks coming after ingress. In case that there is no matching entry in the
+flowtable (flowtable miss), the packet follows the classic IP forwarding path.
+
+:::{note}
+**Flowtable Reference:**
+<https://docs.kernel.org/networking/nf_flowtable.html>
+:::
+
+## Flowtable Configuration
+
+In order to use flowtables, the minimal configuration needed includes:
+
+> - Create flowtable: create flowtable, which includes the interfaces
+>   that are going to be used by the flowtable.
+> - Create firewall rule: create a firewall rule, setting action to
+>   `offload` and using desired flowtable for `offload-target`.
+
+Creating a flow table:
+
+```{eval-rst}
+.. cfgcmd:: set firewall flowtable <flow_table_name> interface <iface>
+
+   Define interfaces to be used in the flowtable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall flowtable <flow_table_name> description <text>
+```
+
+Provide a description to the flow table.
+
+```{eval-rst}
+.. cfgcmd:: set firewall flowtable <flow_table_name> offload
+   <hardware | software>
+
+   Define type of offload to be used by the flowtable: ``hardware`` or
+   ``software``. By default, ``software`` offload is used.
+```
+
+:::{note}
+**Hardware offload:** should be supported by the NICs used.
+:::
+
+Creating rules for using flow tables:
+
+```{eval-rst}
+.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999>
+   action offload
+
+   Create firewall rule in forward chain, and set action to ``offload``.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999>
+   offload-target <flowtable>
+
+   Create firewall rule in forward chain, and define which flowtbale
+   should be used. Only applicable if action is ``offload``.
+```
+
+## Configuration Example
+
+Things to be considred in this setup:
+
+> - Two interfaces are going to be used in the flowtables: eth0 and eth1
+> - Minumum firewall ruleset is provided, which includes some filtering rules,
+>   and appropiate rules for using flowtable offload capabilities.
+
+As described, first packet will be evaluated by all the firewall path, so
+desired connection should be explicitely accepted. Same thing should be taken
+into account for traffic in reverse order. In most cases state policies are
+used in order to accept connection in reverse patch.
+
+We will only accept traffic comming from interface eth0, protocol tcp and
+destination port 1122. All other traffic traspassing the router should be
+blocked.
+
+### Commands
+
+```none
+set firewall flowtable FT01 interface 'eth0'
+set firewall flowtable FT01 interface 'eth1'
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 10 action 'offload'
+set firewall ipv4 forward filter rule 10 offload-target 'FT01'
+set firewall ipv4 forward filter rule 10 state 'established'
+set firewall ipv4 forward filter rule 10 state 'related'
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 state 'established'
+set firewall ipv4 forward filter rule 20 state 'related'
+set firewall ipv4 forward filter rule 110 action 'accept'
+set firewall ipv4 forward filter rule 110 destination address '192.0.2.100'
+set firewall ipv4 forward filter rule 110 destination port '1122'
+set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0'
+set firewall ipv4 forward filter rule 110 protocol 'tcp'
+```
+
+### Explanation
+
+Analysis on what happens for desired connection:
+
+> 1\. First packet is received on eth0, with destination address 192.0.2.100,
+> protocol tcp and destination port 1122. Assume such destination address is
+> reachable through interface eth1.
+>
+> 2\. Since this is the first packet, connection status of this connection,
+> so far is **new**. So neither rule 10 nor 20 are valid.
+>
+> 3. Rule 110 is hit, so connection is accepted.
+>
+> 4\. Once answer from server 192.0.2.100 is seen in opposite direction,
+> connection state will be triggered to **established**, so this reply is
+> accepted in rule 20.
+>
+> 5\. Second packet for this connection is received by the router. Since
+> connection state is **established**, then rule 10 is hit, and a new entry
+> in the flowtable FT01 is added for this connection.
+>
+> 6\. All the following packets will skip traditional path, and will be offloaded
+> and will use the **Fast Path**.
+
+### Checks
+
+It's time to check conntrack table, to see if any connection was accepted,
+and if was properly offloaded
+
+```none
+vyos@FlowTables:~$ show firewall ipv4 forward filter
+Ruleset Information
+
+---------------------------------
+ipv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------------------------------
+10       offload   all                 8      468  ct state { established, related }  flow add @VYOS_FLOWTABLE_FT01
+20       accept    all                 8      468  ct state { established, related }  accept
+110      accept    tcp                 2      120  ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0"  accept
+default  drop      all                 7      420
+
+vyos@FlowTables:~$ sudo conntrack -L | grep tcp
+conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown.
+tcp      6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2
+vyos@FlowTables:~$
+```
diff --git a/docs/configuration/firewall/md-global-options.md b/docs/configuration/firewall/md-global-options.md
new file mode 100644
index 00000000..6ca5a0e2
--- /dev/null
+++ b/docs/configuration/firewall/md-global-options.md
@@ -0,0 +1,187 @@
+---
+lastproofread: '2023-12-26'
+---
+
+(firewall-global-options-configuration)=
+
+# Global Options Firewall Configuration
+
+## Overview
+
+Some firewall settings are global and have an affect on the whole system.
+In this section there's useful information about these global-options that can
+be configured using vyos cli.
+
+Configuration commands covered in this section:
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options ...
+```
+
+## Configuration
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options all-ping [enable | disable]
+
+   By default, when VyOS receives an ICMP echo request packet destined for
+   itself, it will answer with an ICMP echo reply, unless you avoid it
+   through its firewall.
+
+   With the firewall you can set rules to accept, drop or reject ICMP in,
+   out or local traffic. You can also use the general **firewall all-ping**
+   command. This command affects only to LOCAL (packets destined for your
+   VyOS system), not to IN or OUT traffic.
+
+   .. note:: **firewall global-options all-ping** affects only to LOCAL
+      and it always behaves in the most restrictive way
+
+   .. code-block:: none
+
+      set firewall global-options all-ping enable
+
+   When the command above is set, VyOS will answer every ICMP echo request
+   addressed to itself, but that will only happen if no other rule is
+   applied dropping or rejecting local echo requests. In case of conflict,
+   VyOS will not answer ICMP echo requests.
+
+   .. code-block:: none
+
+      set firewall global-options all-ping disable
+
+   When the command above is set, VyOS will answer no ICMP echo request
+   addressed to itself at all, no matter where it comes from or whether
+   more specific rules are being applied to accept them.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options broadcast-ping [enable | disable]
+
+   This setting enable or disable the response of icmp broadcast
+   messages. The following system parameter will be altered:
+
+   * ``net.ipv4.icmp_echo_ignore_broadcasts``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options ip-src-route [enable | disable]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options ipv6-src-route [enable | disable]
+
+   This setting handle if VyOS accept packets with a source route
+   option. The following system parameter will be altered:
+
+   * ``net.ipv4.conf.all.accept_source_route``
+   * ``net.ipv6.conf.all.accept_source_route``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options receive-redirects [enable | disable]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options ipv6-receive-redirects
+   [enable | disable]
+
+   enable or disable of ICMPv4 or ICMPv6 redirect messages accepted
+   by VyOS. The following system parameter will be altered:
+
+   * ``net.ipv4.conf.all.accept_redirects``
+   * ``net.ipv6.conf.all.accept_redirects``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options send-redirects [enable | disable]
+
+   enable or disable ICMPv4 redirect messages send by VyOS
+   The following system parameter will be altered:
+
+   * ``net.ipv4.conf.all.send_redirects``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options log-martians [enable | disable]
+
+   enable or disable the logging of martian IPv4 packets.
+   The following system parameter will be altered:
+
+   * ``net.ipv4.conf.all.log_martians``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options source-validation
+   [strict | loose | disable]
+
+   Set the IPv4 source validation mode.
+   The following system parameter will be altered:
+
+   * ``net.ipv4.conf.all.rp_filter``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options syn-cookies [enable | disable]
+
+   Enable or Disable if VyOS use IPv4 TCP SYN Cookies.
+   The following system parameter will be altered:
+
+   * ``net.ipv4.tcp_syncookies``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options twa-hazards-protection
+   [enable | disable]
+
+   Enable or Disable VyOS to be {rfc}`1337` conform.
+   The following system parameter will be altered:
+
+   * ``net.ipv4.tcp_rfc1337``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy established action
+   [accept | drop | reject]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy established log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy established log-level
+   [emerg | alert | crit | err | warn | notice | info | debug]
+
+   Set the global setting for an established connection.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy invalid action
+   [accept | drop | reject]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy invalid log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy invalid log-level
+   [emerg | alert | crit | err | warn | notice | info | debug]
+
+   Set the global setting for invalid packets.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy related action
+   [accept | drop | reject]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy related log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall global-options state-policy related log-level
+   [emerg | alert | crit | err | warn | notice | info | debug]
+
+   Set the global setting for related connections.
+```
diff --git a/docs/configuration/firewall/md-groups.md b/docs/configuration/firewall/md-groups.md
new file mode 100644
index 00000000..d3c2db6e
--- /dev/null
+++ b/docs/configuration/firewall/md-groups.md
@@ -0,0 +1,495 @@
+---
+lastproofread: '2023-11-08'
+---
+
+(firewall-groups-configuration)=
+
+# Firewall groups
+
+## Configuration
+
+Firewall groups represent collections of IP addresses, networks, ports,
+mac addresses, domains or interfaces. Once created, a group can be referenced
+by firewall, nat and policy route rules as either a source or destination
+matcher, and/or as inbound/outbound in the case of interface group.
+
+### Address Groups
+
+In an **address group** a single IP address or IP address ranges are
+defined.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group address-group <name> address [address |
+   address range]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group ipv6-address-group <name> address <address>
+
+   Define a IPv4 or a IPv6 address group
+
+   .. code-block:: none
+
+      set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1
+      set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8
+      set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group address-group <name> description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group ipv6-address-group <name> description <text>
+
+   Provide a IPv4 or IPv6 address group description
+```
+
+### Network Groups
+
+While **network groups** accept IP networks in CIDR notation, specific
+IP addresses can be added as a 32-bit prefix. If you foresee the need
+to add a mix of addresses and networks, the network group is
+recommended.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group network-group <name> network <CIDR>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group ipv6-network-group <name> network <CIDR>
+
+   Define a IPv4 or IPv6 Network group.
+
+   .. code-block:: none
+
+      set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24
+      set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
+      set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group network-group <name> description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group ipv6-network-group <name> description <text>
+
+   Provide an IPv4 or IPv6 network group description.
+```
+
+### Interface Groups
+
+An **interface group** represents a collection of interfaces.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group interface-group <name> interface <text>
+
+   Define an interface group. Wildcard are accepted too.
+```
+
+```none
+set firewall group interface-group LAN interface bond1001
+set firewall group interface-group LAN interface eth3*
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group interface-group <name> description <text>
+
+   Provide an interface group description
+```
+
+### Port Groups
+
+A **port group** represents only port numbers, not the protocol. Port
+groups can be referenced for either TCP or UDP. It is recommended that
+TCP and UDP groups are created separately to avoid accidentally
+filtering unnecessary ports. Ranges of ports can be specified by using
+`-`.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group port-group <name> port
+   [portname | portnumber | startport-endport]
+
+   Define a port group. A port name can be any name defined in
+   /etc/services. e.g.: http
+
+   .. code-block:: none
+
+      set firewall group port-group PORT-TCP-SERVER1 port http
+      set firewall group port-group PORT-TCP-SERVER1 port 443
+      set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group port-group <name> description <text>
+
+   Provide a port group description.
+```
+
+### MAC Groups
+
+A **mac group** represents a collection of mac addresses.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group mac-group <name> mac-address <mac-address>
+
+   Define a mac group.
+```
+
+```none
+set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f
+set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group mac-group <name> description <text>
+
+   Provide a mac group description.
+```
+
+### Domain Groups
+
+A **domain group** represents a collection of domains.
+
+```{eval-rst}
+.. cfgcmd:: set firewall group domain-group <name> address <domain>
+
+   Define a domain group.
+```
+
+```none
+set firewall group domain-group DOM address example.com
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group domain-group <name> description <text>
+
+   Provide a domain group description.
+```
+
+### Dynamic Groups
+
+Firewall dynamic groups are different from all the groups defined previously
+because, not only they can be used as source/destination in firewall rules,
+but members of these groups are not defined statically using vyos
+configuration.
+
+Instead, members of these groups are added dynamically using firewall
+rules.
+
+#### Defining Dynamic Address Groups
+
+Dynamic address group is supported by both IPv4 and IPv6 families.
+Commands used to define dynamic IPv4|IPv6 address groups are:
+
+```{eval-rst}
+.. cfgcmd:: set firewall group dynamic-group address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group dynamic-group ipv6-address-group <name>
+```
+
+Add description to firewall groups:
+
+```{eval-rst}
+.. cfgcmd:: set firewall group dynamic-group address-group <name>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall group dynamic-group ipv6-address-group <name>
+   description <text>
+```
+
+#### Adding elements to Dynamic Firewall Groups
+
+Once dynamic firewall groups are defined, they should be used in firewall
+rules in order to dynamically add elements to it.
+
+Commands used for this task are:
+
+- Add destination IP address of the connection to a dynamic address group:
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
+   <1-999999> add-address-to-group destination-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
+   destination-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
+   <1-999999> add-address-to-group destination-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
+   destination-address address-group <name>
+```
+
+- Add source IP address of the connection to a dynamic address group:
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
+   <1-999999> add-address-to-group source-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
+   source-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
+   <1-999999> add-address-to-group source-address address-group <name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
+   source-address address-group <name>
+```
+
+Also, specific timeout can be defined per rule. In case rule gets a hit,
+source or destinatination address will be added to the group, and this
+element will remain in the group until timeout expires. If no timeout
+is defined, then the element will remain in the group until next reboot,
+or until a new commit that changes firewall configuration is done.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule
+   <1-999999> add-address-to-group [destination-address | source-address]
+   timeout <timeout>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> add-address-to-group
+   [destination-address | source-address] timeout <timeout>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule
+   <1-999999> add-address-to-group [destination-address | source-address]
+   timeout <timeout>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> add-address-to-group
+   [destination-address | source-address] timeout <timeout>
+```
+
+Timeout can be defined using seconds, minutes, hours or days:
+
+```none
+set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout
+Possible completions:
+<number>s            Timeout value in seconds
+<number>m            Timeout value in minutes
+<number>h            Timeout value in hours
+<number>d            Timeout value in days
+```
+
+#### Using Dynamic Firewall Groups
+
+As any other firewall group, dynamic firewall groups can be used in firewall
+rules as matching options. For example:
+
+```none set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR
+
+```
+
+## Examples
+
+### General example
+
+As said before, once firewall groups are created, they can be referenced
+either in firewall, nat, nat66 and/or policy-route rules.
+
+Here is an example were multiple groups are created:
+
+> ```none
+> set firewall group address-group SERVERS address 198.51.100.101
+> set firewall group address-group SERVERS address 198.51.100.102
+> set firewall group network-group TRUSTEDv4 network 192.0.2.0/30
+> set firewall group network-group TRUSTEDv4 network 203.0.113.128/25
+> set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64
+> set firewall group interface-group LAN interface eth2.2001
+> set firewall group interface-group LAN interface bon0
+> set firewall group port-group PORT-SERVERS port http
+> set firewall group port-group PORT-SERVERS port 443
+> set firewall group port-group PORT-SERVERS port 5000-5010
+> ```
+
+And next, some configuration example where groups are used:
+
+> ```none
+> set firewall ipv4 output filter rule 10 action accept
+> set firewall ipv4 output filter rule 10 outbound-interface group !LAN
+> set firewall ipv4 forward filter rule 20 action accept
+> set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4
+> set firewall ipv6 input filter rule 10 action accept
+> set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6
+> set nat destination rule 101 inbound-interface group LAN
+> set nat destination rule 101 destination group address-group SERVERS
+> set nat destination rule 101 protocol tcp
+> set nat destination rule 101 destination group port-group PORT-SERVERS
+> set nat destination rule 101 translation address 203.0.113.250
+> set policy route PBR rule 201 destination group port-group PORT-SERVERS
+> set policy route PBR rule 201 protocol tcp
+> set policy route PBR rule 201 set table 15
+> ```
+
+### Port knocking example
+
+Using dynamic firewall groups, we can secure access to the router, or any other
+device if needed, by using the technique of port knocking.
+
+A 4 step port knocking example is shown next:
+
+> ```none
+> set firewall global-options state-policy established action 'accept'
+> set firewall global-options state-policy invalid action 'drop'
+> set firewall global-options state-policy related action 'accept'
+> set firewall group dynamic-group address-group ALLOWED
+> set firewall group dynamic-group address-group PN_01
+> set firewall group dynamic-group address-group PN_02
+> set firewall ipv4 input filter default-action 'drop'
+> set firewall ipv4 input filter rule 5 action 'accept'
+> set firewall ipv4 input filter rule 5 protocol 'icmp'
+> set firewall ipv4 input filter rule 10 action 'drop'
+> set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01'
+> set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m'
+> set firewall ipv4 input filter rule 10 description 'Port_nock 01'
+> set firewall ipv4 input filter rule 10 destination port '9990'
+> set firewall ipv4 input filter rule 10 protocol 'tcp'
+> set firewall ipv4 input filter rule 20 action 'drop'
+> set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02'
+> set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m'
+> set firewall ipv4 input filter rule 20 description 'Port_nock 02'
+> set firewall ipv4 input filter rule 20 destination port '9991'
+> set firewall ipv4 input filter rule 20 protocol 'tcp'
+> set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01'
+> set firewall ipv4 input filter rule 30 action 'drop'
+> set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED'
+> set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h'
+> set firewall ipv4 input filter rule 30 description 'Port_nock 03'
+> set firewall ipv4 input filter rule 30 destination port '9992'
+> set firewall ipv4 input filter rule 30 protocol 'tcp'
+> set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02'
+> set firewall ipv4 input filter rule 99 action 'accept'
+> set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh'
+> set firewall ipv4 input filter rule 99 destination port '22'
+> set firewall ipv4 input filter rule 99 protocol 'tcp'
+> set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED'
+> ```
+
+Before testing, we can check members of firewall groups:
+
+> ```none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  N/D            N/D        N/D
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
+> [edit]
+> vyos@vyos#
+> ```
+
+With this configuration, in order to get ssh access to the router, user
+needs to:
+
+1\. Generate a new TCP connection with destination port 9990. As shown next,
+a new entry was added to dynamic firewall group **PN_01**
+
+> ```none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        119
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  N/D            N/D        N/D
+> [edit]
+> vyos@vyos#
+> ```
+
+2\. Generate a new TCP connection with destination port 9991. As shown next,
+a new entry was added to dynamic firewall group **PN_02**
+
+> ```none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  N/D            N/D        N/D
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31  120        106
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31  180        179
+> [edit]
+> vyos@vyos#
+> ```
+
+3\. Generate a new TCP connection with destination port 9992. As shown next,
+a new entry was added to dynamic firewall group **ALLOWED**
+
+> ```none
+> vyos@vyos# run show firewall group
+> Firewall Groups
+>
+> Name     Type                    References            Members        Timeout    Expires
+> -------  ----------------------  --------------------  -------------  ---------  ---------
+> ALLOWED  address_group(dynamic)  ipv4-input-filter-30  192.168.89.31       7200       7199
+> PN_01    address_group(dynamic)  ipv4-input-filter-10  192.168.89.31        120         89
+> PN_02    address_group(dynamic)  ipv4-input-filter-20  192.168.89.31        180        170
+> [edit]
+> vyos@vyos#
+> ```
+
+4. Now user can connect through ssh to the router (assuming ssh is configured).
+
+## Operation-mode
+
+```{eval-rst}
+.. opcmd:: show firewall group
+```
+
+```{eval-rst}
+.. opcmd:: show firewall group <name>
+
+   Overview of defined groups. You see the firewall group name, type,
+   references (where the group is used), members, timeout and expiration (last
+   two only present in dynamic firewall groups).
+```
+
+Here is an example of such command:
+
+> ```none
+> vyos@vyos:~$ show firewall group
+> Firewall Groups
+>
+> Name          Type                    References              Members             Timeout    Expires
+> ------------  ----------------------  ----------------------  ----------------  ---------  ---------
+> SERVERS       address_group           nat-destination-101     198.51.100.101
+>                                                               198.51.100.102
+> ALLOWED       address_group(dynamic)  ipv4-input-filter-30    192.168.77.39          7200       7174
+> PN_01         address_group(dynamic)  ipv4-input-filter-10    192.168.0.245           120        112
+>                                                               192.168.77.39           120         85
+> PN_02         address_group(dynamic)  ipv4-input-filter-20    192.168.77.39           180        151
+> LAN           interface_group         ipv4-output-filter-10   bon0
+>                                       nat-destination-101     eth2.2001
+> TRUSTEDv6     ipv6_network_group      ipv6-input-filter-10    2001:db8::/64
+> TRUSTEDv4     network_group           ipv4-forward-filter-20  192.0.2.0/30
+>                                                               203.0.113.128/25
+> PORT-SERVERS  port_group              route-PBR-201           443
+>                                       route-PBR-201           5000-5010
+>                                       nat-destination-101     http
+> vyos@vyos:~$
+> ```
diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md
new file mode 100644
index 00000000..53c5a7fc
--- /dev/null
+++ b/docs/configuration/firewall/md-index.md
@@ -0,0 +1,181 @@
+---
+lastproofread: '2023-11-23'
+---
+
+# Firewall
+
+As VyOS is based on Linux it leverages its firewall. The Netfilter project
+created iptables and its successor nftables for the Linux kernel to
+work directly on packet data flows. This now extends the concept of
+zone-based security to allow for manipulating the data at multiple stages once
+accepted by the network interface and the driver before being handed off to
+the destination (e.g., a web server OR another device).
+
+A simplified traffic flow diagram, based on Netfilter packet flow, is shown
+next, in order to have a full view and understanding of how packets are
+processed, and what possible paths traffic can take.
+
+:::{figure} /_static/images/firewall-gral-packet-flow.png
+:::
+
+The main points regarding this packet flow and terminology used in VyOS
+firewall are covered below:
+
+> - **Bridge Port?**: choose appropriate path based on whether interface
+>   where the packet was received is part of a bridge, or not.
+
+If the interface where the packet was received isn't part of a bridge, then
+packetis processed at the **IP Layer**:
+
+> - **Prerouting**: several actions can be done in this stage, and currently
+>   these actions are defined in different parts in VyOS configuration. Order
+>   is important, and all these actions are performed before any actions
+>   defined under `firewall` section. Relevant configuration that acts in
+>   this stage are:
+>
+>   > - **Conntrack Ignore**: rules defined under `set system conntrack ignore
+>   >   [ipv4 | ipv6] ...`.
+>   > - **Policy Route**: rules defined under `set policy [route | route6]
+>   >   ...`.
+>   > - **Destination NAT**: rules defined under `set [nat | nat66]
+>   >   destination...`.
+>
+> - **Destination is the router?**: choose appropriate path based on
+>   destination IP address. Transit forward continues to **forward**,
+>   while traffic that destination IP address is configured on the router
+>   continues to **input**.
+>
+> - **Input**: stage where traffic destined for the router itself can be
+>   filtered and controlled. This is where all rules for securing the router
+>   should take place. This includes ipv4 and ipv6 filtering rules, defined
+>   in:
+>
+>   - `set firewall ipv4 input filter ...`.
+>   - `set firewall ipv6 input filter ...`.
+>
+> - **Forward**: stage where transit traffic can be filtered and controlled.
+>   This includes ipv4 and ipv6 filtering rules, defined in:
+>
+>   - `set firewall ipv4 forward filter ...`.
+>   - `set firewall ipv6 forward filter ...`.
+>
+> - **Output**: stage where traffic that originates from the router itself
+>   can be filtered and controlled. Bear in mind that this traffic can be a
+>   new connection originated by a internal process running on VyOS router,
+>   such as NTP, or a response to traffic received externaly through
+>   **input** (for example response to an ssh login attempt to the router).
+>   This includes ipv4 and ipv6 filtering rules, defined in:
+>
+>   - `set firewall ipv4 output filter ...`.
+>   - `set firewall ipv6 output filter ...`.
+>
+> - **Postrouting**: as in **Prerouting**, several actions defined in
+>   different parts of VyOS configuration are performed in this
+>   stage. This includes:
+>
+>   - **Source NAT**: rules defined under `set [nat | nat66]
+>     destination...`.
+
+If the interface where the packet was received is part of a bridge, then
+the packet is processed at the **Bridge Layer**, which contains a basic setup for
+bridge filtering:
+
+> - **Forward (Bridge)**: stage where traffic that is trespasing through the
+>   bridge is filtered and controlled:
+>
+>   - `set firewall bridge forward filter ...`.
+
+The main structure of the VyOS firewall CLI is shown next:
+
+```none
+- set firewall
+    * bridge
+         - forward
+            + filter
+    * flowtable
+         - custom_flow_table
+            + ...
+    * global-options
+         + all-ping
+         + broadcast-ping
+         + ...
+    * group
+         - address-group
+         - ipv6-address-group
+         - network-group
+         - ipv6-network-group
+         - interface-group
+         - mac-group
+         - port-group
+         - domain-group
+    * ipv4
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+    * ipv6
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - ipv6-name
+            + custom_name
+    * zone
+         - custom_zone_name
+            + ...
+```
+
+Please, refer to appropriate section for more information about firewall
+configuration:
+
+```{eval-rst}
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   global-options
+   groups
+   bridge
+   ipv4
+   ipv6
+   flowtables
+```
+
+:::{note}
+**For more information**
+of Netfilter hooks and Linux networking packet flows can be
+found in [Netfilter-Hooks](https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks)
+:::
+
+## Zone-based firewall
+
+```{eval-rst}
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   zone
+```
+
+With zone-based firewalls a new concept was implemented, in addition to the
+standard in and out traffic flows, a local flow was added. This local was for
+traffic originating and destined to the router itself. Which means additional
+rules were required to secure the firewall itself from the network, in
+addition to the existing inbound and outbound rules from the traditional
+concept above.
+
+To configure VyOS with the
+{doc}`zone-based firewall configuration </configuration/firewall/zone>`
+
+As the example image below shows, the device now needs rules to allow/block
+traffic to or from the services running on the device that have open
+connections on that interface.
+
+:::{figure} /_static/images/firewall-zonebased.png
+:::
diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md
new file mode 100644
index 00000000..23ff6c39
--- /dev/null
+++ b/docs/configuration/firewall/md-ipv4.md
@@ -0,0 +1,2037 @@
+---
+lastproofread: '2023-11-08'
+---
+
+(firewall-ipv4-configuration)=
+
+# IPv4 Firewall Configuration
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding IPv4, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 ...
+```
+
+From main structure defined in
+{doc}`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+```none
+- set firewall
+    * ipv4
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+```
+
+For transit traffic, which is received by the router and forwarded, base chain
+is **forward**. A simplified packet flow diagram for transit traffic is shown
+next:
+
+:::{figure} /_static/images/firewall-fwd-packet-flow.png
+:::
+
+Where firewall base chain to configure firewall filtering rules for transit
+traffic is `set firewall ipv4 forward filter ...`, which happens in stage 5,
+highlightened with red color.
+
+For traffic towards the router itself, base chain is **input**, while traffic
+originated by the router, base chain is **output**.
+A new simplified packet flow diagram is shown next, which shows the path
+for traffic destinated to the router itself, and traffic generated by the
+router (starting from circle number 6):
+
+:::{figure} /_static/images/firewall-input-packet-flow.png
+:::
+
+Base chain is for traffic toward the router is `set firewall ipv4 input
+filter ...`
+
+And base chain for traffic generated by the router is `set firewall ipv4
+output filter ...`
+
+:::{note}
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**
+:::
+
+Custom firewall chains can be created, with commands
+`set firewall ipv4 name <name> ...`. In order to use
+such custom chain, a rule with **action jump**, and the appropiate **target**
+should be defined in a base chain.
+
+## Firewall - IPv4 Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+The action can be :
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `reject`: reject the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+> - `synproxy`: synproxy the packet.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return | synproxy]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return | synproxy]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return]
+
+   This required setting defines the action of the current rule. If action is
+   set to jump, then jump-target is also needed.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   jump-target <text>
+
+   To be used only when action is set to ``jump``. Use this command to specify
+   jump target.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   queue <0-65535>
+
+   To be used only when action is set to ``queue``. Use this command to specify
+   queue target to use. Queue range is also supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   queue-options bypass
+
+   To be used only when action is set to ``queue``. Use this command to let
+   packet go through firewall when no userspace software is connected to the
+   queue.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   queue-options fanout
+
+   To be used only when action is set to ``queue``. Use this command to
+   distribute packets between several queues.
+```
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> default-action
+   [accept | drop | jump | queue | reject | return]
+
+   This set the default action of the rule-set if no rule matched a packet
+   criteria. If default-action is set to ``jump``, then
+   ``default-jump-target`` is also needed. Note that for base chains, default
+   action can only be set to ``accept`` or ``drop``, while on custom chain,
+   more actions are available.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> default-jump-target <text>
+
+   To be used only when ``defult-action`` is set to ``jump``. Use this
+   command to specify jump target for default rule.
+```
+
+:::{note}
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+:::
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> log
+
+   Enable logging for the matched packet. If this configuration command is not
+   present, then log is not enabled.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> default-log
+
+   Use this command to enable the logging of the default action on
+   the specified chain.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+
+   Define log-level. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   log-options group <0-65535>
+
+   Define log group to send message to. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   log-options snapshot-length <0-9000>
+
+   Define length of packet payload to include in netlink message. Only
+   applicable if rule log is enable and log group is defined.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   log-options queue-threshold <0-65535>
+
+   Define number of packets to queue inside the kernel before sending them to
+   userspace. Only applicable if rule log is enable and log group is defined.
+```
+
+### Firewall Description
+
+For reference, a description can be defined for every single rule, and for
+every defined custom chain.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> description <text>
+
+   Provide a rule-set description to a custom firewall chain.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> description <text>
+
+   Provide a description for each rule.
+```
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999> disable
+
+   Command for disabling a rule but keep it in the configuration.
+```
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   connection-status nat [destination | source]
+
+   Match criteria based on nat connection status.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   connection-mark <1-2147483647>
+
+   Match criteria based on connection mark.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination address [address | addressrange | CIDR]
+
+   Match criteria based on source and/or destination address. This is similar
+   to the network groups part, but here you are able to negate the matching
+   addresses.
+
+   .. code-block:: none
+
+      set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11
+      # with a '!' the rule match everything except the specified subnet
+      set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination address-mask [address]
+
+   An arbitrary netmask can be applied to mask addresses to only match against
+   a specific portion.
+
+   This functions for both individual addresses and address groups.
+
+   .. code-block:: none
+
+      # Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet
+      set firewall ipv4 name FOO rule 100 destination address 0.11.0.13
+      set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination fqdn <fqdn>
+
+   Specify a Fully Qualified Domain Name as source/destination matcher. Ensure
+   router is able to resolve such dns query.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination geoip inverse-match
+
+   Match IP addresses based on its geolocation. More info: `geoip matching
+   <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_.
+   Use inverse-match to match anything except the given country-codes.
+```
+
+Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required,
+permits redistribution so we can include a database in images(~3MB
+compressed). Includes cron script (manually callable by op-mode update
+geoip) to keep database and rules updated.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source mac-address <mac-address>
+
+   Only in the source criteria, you can specify a mac-address.
+
+   .. code-block:: none
+
+      set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33
+      set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34
+
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+
+   A port can be set with a port number or a name which is here
+   defined: ``/etc/services``.
+
+   .. code-block:: none
+
+      set firewall ipv4 forward filter rule 10 source port '22'
+      set firewall ipv4 forward filter rule 11 source port '!http'
+      set firewall ipv4 forward filter rule 12 source port 'https'
+
+   Multiple source ports can be specified as a comma-separated list.
+   The whole list can also be "negated" using ``!``. For example:
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group address-group <name | !name>
+
+   Use a specific address-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+
+   Use a specific dynamic-address-group. Prepend character ``!`` for inverted
+   matching criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group network-group <name | !name>
+
+   Use a specific network-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group port-group <name | !name>
+
+   Use a specific port-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group domain-group <name | !name>
+
+   Use a specific domain-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   destination group mac-group <name | !name>
+
+   Use a specific mac-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+
+   Match based on dscp value.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   fragment [match-frag | match-non-frag]
+
+   Match based on fragment criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   icmp [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   icmp [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   icmp [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   icmp [code | type] <0-255>
+
+   Match based on icmp code and type.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   icmp type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   icmp type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   icmp type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   icmp type-name <text>
+
+   Match based on icmp type-name criteria. Use tab for information
+   about what **type-name** criteria are supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   inbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   inbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   inbound-interface name <iface>
+
+   Match based on inbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+:::{note}
+If an interface is attached to a non-default vrf, when using
+**inbound-interface**, vrf name must be used. For example `set firewall
+ipv4 forward filter rule 10 inbound-interface name MGMT`
+:::
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   inbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   inbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   inbound-interface group <iface_group>
+
+   Match based on inbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   outbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   outbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   outbound-interface name <iface>
+
+   Match based on outbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+:::{note}
+If an interface is attached to a non-default vrf, when using
+**outbound-interface**, real interface name must be used. For example
+`set firewall ipv4 forward filter rule 10 outbound-interface name eth0`
+:::
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   outbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   outbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   outbound-interface group <iface_group>
+
+   Match based on outbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   ipsec [match-ipsec | match-none]
+
+   Match based on ipsec criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   limit burst <0-4294967295>
+
+   Match based on the maximum number of packets to allow in excess of rate.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   limit rate <text>
+
+   Match based on the maximum average rate, specified as **integer/unit**.
+   For example **5/minutes**
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   packet-length-exclude <text>
+
+   Match based on packet length criteria. Multiple values from 1 to 65535
+   and ranges are supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+
+   Match based on packet type criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+
+   Match a protocol criteria. A protocol number or a name which is here
+   defined: ``/etc/protocols``.
+   Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp
+   based packets. The ``!`` negate the selected protocol.
+
+   .. code-block:: none
+
+      set firewall ipv4 forward fitler rule 10 protocol tcp_udp
+      set firewall ipv4 forward fitler rule 11 protocol !tcp_udp
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   recent time [second | minute | hour]
+
+   Match bases on recently seen sources.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   tcp flags [not] <text>
+
+   Allowed values fpr TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``,
+   ``rst``, ``syn`` and ``urg``. Multiple values are supported, and for
+   inverted selection use ``not``, as shown in the example.
+
+   .. code-block:: none
+
+      set firewall ipv4 input filter rule 10 tcp flags 'ack'
+      set firewall ipv4 input filter rule 12 tcp flags 'syn'
+      set firewall ipv4 input filter rule 13 tcp flags not 'fin'
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   state [established | invalid | new | related]
+
+   Match against the state of a packet.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   time weekdays <text>
+
+   Time to match the defined rule.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   ttl <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   ttl <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   ttl <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   ttl <eq | gt | lt> <0-255>
+
+   Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for
+   'greater than', and 'lt' stands for 'less than'.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   recent time <second | minute | hour>
+
+   Match when 'count' amount of connections are seen within 'time'. These
+   matching criteria can be used to block brute-force attempts.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   conntrack-helper <module>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   conntrack-helper <module>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   conntrack-helper <module>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   conntrack-helper <module>
+
+   Match based on connection tracking protocol helper module to secure use of
+   that helper module. See below for possible completions `<module>`.
+
+   .. code-block:: none
+
+      Possible completions:
+          ftp                  Related traffic from FTP helper
+          h323                 Related traffic from H.323 helper
+          pptp                 Related traffic from PPTP helper
+          nfs                  Related traffic from NFS helper
+          sip                  Related traffic from SIP helper
+          tftp                 Related traffic from TFTP helper
+          sqlnet               Related traffic from SQLNet helper
+
+```
+
+## Synproxy
+
+Synproxy connections
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
+   action synproxy
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
+   protocol tcp
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
+   synproxy tcp mss <501-65535>
+
+    Set TCP-MSS (maximum segment size) for the connection
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999>
+   synproxy tcp window-scale <1-14>
+
+    Set the window scale factor for TCP window scaling
+```
+
+### Example synproxy
+
+Requirements to enable synproxy:
+
+> - Traffic must be symmetric
+> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
+> - Disable conntrack loose track option
+
+```none
+set system sysctl parameter net.ipv4.tcp_timestamps value '1'
+
+set system conntrack tcp loose disable
+set system conntrack ignore ipv4 rule 10 destination port '8080'
+set system conntrack ignore ipv4 rule 10 protocol 'tcp'
+set system conntrack ignore ipv4 rule 10 tcp flags syn
+
+set firewall global-options syn-cookies 'enable'
+set firewall ipv4 input filter rule 10 action 'synproxy'
+set firewall ipv4 input filter rule 10 destination port '8080'
+set firewall ipv4 input filter rule 10 inbound-interface name 'eth1'
+set firewall ipv4 input filter rule 10 protocol 'tcp'
+set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
+set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
+set firewall ipv4 input filter rule 1000 action 'drop'
+set firewall ipv4 input filter rule 1000 state invalid
+```
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+```{eval-rst}
+.. opcmd:: show firewall
+
+   This will show you a basic firewall overview, for all ruleset, and not
+   only for ipv4
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall
+      Rulesets Information
+
+      ---------------------------------
+      ipv4 Firewall "forward filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  -----------------------------
+      20       accept    all                 0        0  ip saddr @N_TRUSTEDv4  accept
+      21       jump      all                 0        0  jump NAME_AUX
+      default  accept    all                 0        0
+
+      ---------------------------------
+      ipv4 Firewall "input filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  -------------------------
+      10       accept    all               156    14377  iifname != @I_LAN  accept
+      default  accept    all                 0        0
+
+      ---------------------------------
+      ipv4 Firewall "name AUX"
+
+        Rule  Action    Protocol      Packets    Bytes  Conditions
+      ------  --------  ----------  ---------  -------  --------------------------------------------
+          10  accept    icmp                0        0  meta l4proto icmp  accept
+          20  accept    udp                 0        0  meta l4proto udp ip saddr @A_SERVERS  accept
+          30  drop      all                 0        0  ip saddr != @A_SERVERS iifname "eth2"
+
+      ---------------------------------
+      ipv4 Firewall "output filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  ----------------------------------------
+      10       reject    all                 0        0  oifname @I_LAN
+      20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
+      default  accept    all                72     9258
+
+      ---------------------------------
+      ipv6 Firewall "input filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  -------------------------------
+      10       accept    all                 0        0  ip6 saddr @N6_TRUSTEDv6  accept
+      default  accept    all                 2      112
+
+      vyos@vyos:~$
+```
+
+```{eval-rst}
+.. opcmd:: show firewall summary
+
+   This will show you a summary of rule-sets and groups
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall summary
+      Ruleset Summary
+
+      IPv6 Ruleset:
+
+      Ruleset Hook    Ruleset Priority      Description
+      --------------  --------------------  -------------------------
+      forward         filter
+      input           filter
+      ipv6_name       IPV6-VyOS_MANAGEMENT
+      ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
+
+      IPv4 Ruleset:
+
+      Ruleset Hook    Ruleset Priority    Description
+      --------------  ------------------  -------------------------
+      forward         filter
+      input           filter
+      name            VyOS_MANAGEMENT
+      name            WAN_IN              PUBLIC_INTERNET
+
+      Firewall Groups
+
+      Name                     Type                References               Members
+      -----------------------  ------------------  -----------------------  ----------------
+      PBX                      address_group       WAN_IN-100               198.51.100.77
+      SERVERS                  address_group       WAN_IN-110               192.0.2.10
+                                                   WAN_IN-111               192.0.2.11
+                                                   WAN_IN-112               192.0.2.12
+                                                   WAN_IN-120
+                                                   WAN_IN-121
+                                                   WAN_IN-122
+      SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
+                                                   WAN_IN-20
+      PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
+      PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+                                                   WAN_IN-171
+      PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
+      SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
+                                                   IPV6-WAN_IN-111          2001:db8::3
+                                                   IPV6-WAN_IN-112          2001:db8::4
+                                                   IPV6-WAN_IN-120
+                                                   IPV6-WAN_IN-121
+                                                   IPV6-WAN_IN-122
+      SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
+                                                   IPV6-WAN_IN-20
+
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv4 [forward | input | output] filter
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv4 name <name>
+
+   This command will give an overview of a single rule-set.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall ipv4 input filter
+      Ruleset Information
+
+      ---------------------------------
+      IPv4 Firewall "input filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  -----------------------------------------
+      5        jump      all                 0        0  iifname "eth2"  jump NAME_VyOS_MANAGEMENT
+      default  accept    all
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv4 [forward | input | output]
+   filter rule <1-999999>
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv4 name <name> rule <1-999999>
+
+   This command will give an overview of a rule in a single rule-set, plus
+   information for default action.
+```
+
+```none
+vyos@vyos:~$show firewall ipv4 output filter rule 20
+Rule Information
+
+---------------------------------
+ipv4 Firewall "output filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------
+20       accept    icmp                2      168  meta l4proto icmp oifname "eth0"  accept
+default  accept    all               286    47614
+
+vyos@vyos:~$
+```
+
+```{eval-rst}
+.. opcmd:: show firewall statistics
+
+   This will show you a statistic of all rule-sets since the last boot.
+```
+
+### Show Firewall log
+
+```{eval-rst}
+.. opcmd:: show log firewall
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4 [forward | input | output | name]
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4 [forward | input | output] filter
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4 name <name>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4 [forward | input | output] filter rule <rule>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv4 name <name> rule <rule>
+
+   Show the logs of all firewall; show all ipv4 firewall logs; show all logs
+   for particular hook; show all logs for particular hook and priority;
+   show all logs for particular custom chain; show logs for specific Rule-Set.
+```
+
+### Example Partial Config
+
+```none
+firewall {
+    group {
+        network-group BAD-NETWORKS {
+            network 198.51.100.0/24
+            network 203.0.113.0/24
+        }
+        network-group GOOD-NETWORKS {
+            network 192.0.2.0/24
+        }
+        port-group BAD-PORTS {
+            port 65535
+        }
+    }
+    ipv4 {
+        forward {
+            filter {
+                default-action accept
+                rule 5 {
+                    action accept
+                    source {
+                        group {
+                            network-group GOOD-NETWORKS
+                        }
+                    }
+                }
+                rule 10 {
+                    action drop
+                    description "Bad Networks"
+                    protocol all
+                    source {
+                        group {
+                            network-group BAD-NETWORKS
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+### Update geoip database
+
+```{eval-rst}
+.. opcmd:: update geoip
+
+   Command used to update GeoIP database and firewall sets.
+```
diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md
new file mode 100644
index 00000000..e2db7928
--- /dev/null
+++ b/docs/configuration/firewall/md-ipv6.md
@@ -0,0 +1,2026 @@
+---
+lastproofread: '2023-11-08'
+---
+
+(firewall-ipv6-configuration)=
+
+# IPv6 Firewall Configuration
+
+## Overview
+
+In this section there's useful information of all firewall configuration that
+can be done regarding IPv6, and appropiate op-mode commands.
+Configuration commands covered in this section:
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 ...
+```
+
+From main structure defined in
+{doc}`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+```none
+- set firewall
+    * ipv6
+         - forward
+            + filter
+         - input
+            + filter
+         - output
+            + filter
+         - name
+            + custom_name
+```
+
+For transit traffic, which is received by the router and forwarded, base chain
+is **forward**. A simplified packet flow diagram for transit traffic is shown
+next:
+
+:::{figure} /_static/images/firewall-fwd-packet-flow.png
+:::
+
+Where firewall base chain to configure firewall filtering rules for transit
+traffic is `set firewall ipv6 forward filter ...`, which happens in stage 5,
+highlightened with red color.
+
+For traffic towards the router itself, base chain is **input**, while traffic
+originated by the router, base chain is **output**.
+A new simplified packet flow diagram is shown next, which shows the path
+for traffic destinated to the router itself, and traffic generated by the
+router (starting from circle number 6):
+
+:::{figure} /_static/images/firewall-input-packet-flow.png
+:::
+
+Base chain is for traffic toward the router is `set firewall ipv6 input
+filter ...`
+
+And base chain for traffic generated by the router is `set firewall ipv6
+output filter ...`
+
+:::{note}
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**
+:::
+
+Custom firewall chains can be created, with commands
+`set firewall ipv6 name <name> ...`. In order to use
+such custom chain, a rule with **action jump**, and the appropiate **target**
+should be defined in a base chain.
+
+## Firewall - IPv6 Rules
+
+For firewall filtering, firewall rules needs to be created. Each rule is
+numbered, has an action to apply if the rule is matched, and the ability
+to specify multiple criteria matchers. Data packets go through the rules
+from 1 - 999999, so order is crucial. At the first match the action of the
+rule will be executed.
+
+### Actions
+
+If a rule is defined, then an action must be defined for it. This tells the
+firewall what to do if all criteria matchers defined for such rule do match.
+
+The action can be :
+
+> - `accept`: accept the packet.
+> - `continue`: continue parsing next rule.
+> - `drop`: drop the packet.
+> - `reject`: reject the packet.
+> - `jump`: jump to another custom chain.
+> - `return`: Return from the current chain and continue at the next rule
+>   of the last chain.
+> - `queue`: Enqueue packet to userspace.
+> - `synproxy`: synproxy the packet.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return | synproxy]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return | synproxy]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> action
+   [accept | continue | drop | jump | queue | reject | return]
+
+   This required setting defines the action of the current rule. If action is
+   set to jump, then jump-target is also needed.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   jump-target <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   jump-target <text>
+
+   To be used only when action is set to ``jump``. Use this command to specify
+   jump target.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   queue <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   queue <0-65535>
+
+   To be used only when action is set to ``queue``. Use this command to specify
+   queue target to use. Queue range is also supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   queue-options bypass
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   queue-options bypass
+
+   To be used only when action is set to ``queue``. Use this command to let
+   packet go through firewall when no userspace software is connected to the
+   queue.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   queue-options fanout
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   queue-options fanout
+
+   To be used only when action is set to ``queue``. Use this command to
+   distribute packets between several queues.
+```
+
+Also, **default-action** is an action that takes place whenever a packet does
+not match any rule in it's chain. For base chains, possible options for
+**default-action** are **accept** or **drop**.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter default-action
+   [accept | drop]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> default-action
+   [accept | drop | jump | queue | reject | return]
+
+   This set the default action of the rule-set if no rule matched a packet
+   criteria. If default-action is set to ``jump``, then
+   ``default-jump-target`` is also needed. Note that for base chains, default
+   action can only be set to ``accept`` or ``drop``, while on custom chain,
+   more actions are available.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> default-jump-target <text>
+
+   To be used only when ``defult-action`` is set to ``jump``. Use this
+   command to specify jump target for default rule.
+```
+
+:::{note}
+**Important note about default-actions:**
+If default action for any base chain is not defined, then the default
+action is set to **accept** for that chain. For custom chains, if default
+action is not defined, then the default-action is set to **drop**.
+:::
+
+### Firewall Logs
+
+Logging can be enable for every single firewall rule. If enabled, other
+log options can be defined.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> log
+
+   Enable logging for the matched packet. If this configuration command is not
+   present, then log is not enabled.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter default-log
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> default-log
+
+   Use this command to enable the logging of the default action on
+   the specified chain.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   log-options level [emerg | alert | crit | err | warn | notice
+   | info | debug]
+
+   Define log-level. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   log-options group <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   log-options group <0-65535>
+
+   Define log group to send message to. Only applicable if rule log is enable.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   log-options snapshot-length <0-9000>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   log-options snapshot-length <0-9000>
+
+   Define length of packet payload to include in netlink message. Only
+   applicable if rule log is enable and log group is defined.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   log-options queue-threshold <0-65535>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   log-options queue-threshold <0-65535>
+
+   Define number of packets to queue inside the kernel before sending them to
+   userspace. Only applicable if rule log is enable and log group is defined.
+```
+
+### Firewall Description
+
+For reference, a description can be defined for every single rule, and for
+every defined custom chain.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> description <text>
+
+   Provide a rule-set description to a custom firewall chain.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   description <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> description <text>
+
+   Provide a description for each rule.
+```
+
+### Rule Status
+
+When defining a rule, it is enable by default. In some cases, it is useful to
+just disable the rule, rather than removing it.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> disable
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999> disable
+
+   Command for disabling a rule but keep it in the configuration.
+```
+
+### Matching criteria
+
+There are a lot of matching criteria against which the packet can be tested.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   connection-status nat [destination | source]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   connection-status nat [destination | source]
+
+   Match criteria based on nat connection status.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   connection-mark <1-2147483647>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   connection-mark <1-2147483647>
+
+   Match criteria based on connection mark.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination address [address | addressrange | CIDR]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination address [address | addressrange | CIDR]
+
+   Match criteria based on source and/or destination address. This is similar
+   to the network groups part, but here you are able to negate the matching
+   addresses.
+
+   .. code-block:: none
+
+      set firewall ipv6 name FOO rule 100 source address 2001:db8::202
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination address-mask [address]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination address-mask [address]
+
+   An arbitrary netmask can be applied to mask addresses to only match against
+   a specific portion. This is particularly useful with IPv6 as rules will
+   remain valid if the IPv6 prefix changes and the host
+   portion of systems IPv6 address is static (for example, with SLAAC or
+   `tokenised IPv6 addresses
+   <https://datatracker.ietf.org
+   /doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)
+
+   This functions for both individual addresses and address groups.
+
+   .. stop_vyoslinter
+   .. code-block:: none
+
+      # Match any IPv6 address with the suffix ::0000:0000:0000:beef
+      set firewall ipv6 forward filter rule 100 destination address ::beef
+      set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff
+      # Address groups
+      set firewall group ipv6-address-group WEBSERVERS address ::1000
+      set firewall group ipv6-address-group WEBSERVERS address ::2000
+      set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS
+      set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff
+
+   .. start_vyoslinter
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination fqdn <fqdn>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination fqdn <fqdn>
+
+   Specify a Fully Qualified Domain Name as source/destination matcher. Ensure
+   router is able to resolve such dns query.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination geoip country-code <country>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination geoip inverse-match
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination geoip inverse-match
+
+   Match IP addresses based on its geolocation. More info: `geoip matching
+   <https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching>`_.
+   Use inverse-match to match anything except the given country-codes.
+```
+
+Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required,
+permits redistribution so we can include a database in images(~3MB
+compressed). Includes cron script (manually callable by op-mode update
+geoip) to keep database and rules updated.
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source mac-address <mac-address>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source mac-address <mac-address>
+
+   Only in the source criteria, you can specify a mac-address.
+
+   .. code-block:: none
+
+      set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33
+      set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination port [1-65535 | portname | start-end]
+
+   A port can be set with a port number or a name which is here
+   defined: ``/etc/services``.
+
+   .. code-block:: none
+
+      set firewall ipv6 forward filter rule 10 source port '22'
+      set firewall ipv6 forward filter rule 11 source port '!http'
+      set firewall ipv6 forward filter rule 12 source port 'https'
+
+   Multiple source ports can be specified as a comma-separated list.
+   The whole list can also be "negated" using ``!``. For example:
+
+   .. code-block:: none
+
+      set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338'
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group address-group <name | !name>
+
+   Use a specific address-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group dynamic-address-group <name | !name>
+
+   Use a specific dynamic-address-group. Prepend character ``!`` for inverted
+   matching criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group network-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group network-group <name | !name>
+
+   Use a specific network-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group port-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group port-group <name | !name>
+
+   Use a specific port-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group domain-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group domain-group <name | !name>
+
+   Use a specific domain-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   source group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   destination group mac-group <name | !name>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   destination group mac-group <name | !name>
+
+   Use a specific mac-group. Prepend character ``!`` for inverted matching
+   criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   dscp [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   dscp-exclude [0-63 | start-end]
+
+   Match based on dscp value.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   fragment [match-frag | match-non-frag]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   fragment [match-frag | match-non-frag]
+
+   Match based on fragment criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   icmpv6 [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   icmpv6 [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   icmpv6 [code | type] <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   icmpv6 [code | type] <0-255>
+
+   Match based on icmp|icmpv6 code and type.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   icmpv6 type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   icmpv6 type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   icmpv6 type-name <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   icmpv6 type-name <text>
+
+   Match based on icmpv6 type-name criteria. Use tab for information
+   about what **type-name** criteria are supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   inbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   inbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   inbound-interface name <iface>
+
+   Match based on inbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+:::{note}
+If an interface is attached to a non-default vrf, when using
+**inbound-interface**, vrf name must be used. For example `set firewall
+ipv6 forward filter rule 10 inbound-interface name MGMT`
+:::
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   inbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   inbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   inbound-interface group <iface_group>
+
+   Match based on inbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   outbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   outbound-interface name <iface>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   outbound-interface name <iface>
+
+   Match based on outbound interface. Wilcard ``*`` can be used.
+   For example: ``eth2*``. Prepending character ``!`` for inverted matching
+   criteria is also supportd. For example ``!eth2``
+```
+
+:::{note}
+If an interface is attached to a non-default vrf, when using
+**outbound-interface**, real interface name must be used. For example
+`set firewall ipv6 forward filter rule 10 outbound-interface name eth0`
+:::
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   outbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   outbound-interface group <iface_group>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   outbound-interface group <iface_group>
+
+   Match based on outbound interface group. Prepending character ``!`` for
+   inverted matching criteria is also supportd. For example ``!IFACE_GROUP``
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   ipsec [match-ipsec | match-none]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   ipsec [match-ipsec | match-none]
+
+   Match based on ipsec criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   limit burst <0-4294967295>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   limit burst <0-4294967295>
+
+   Match based on the maximum number of packets to allow in excess of rate.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   limit rate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   limit rate <text>
+
+   Match based on the maximum average rate, specified as **integer/unit**.
+   For example **5/minutes**
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   packet-length <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   packet-length-exclude <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   packet-length-exclude <text>
+
+   Match based on packet length criteria. Multiple values from 1 to 65535
+   and ranges are supported.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   packet-type [broadcast | host | multicast | other]
+
+   Match based on packet type criteria.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   protocol [<text> | <0-255> | all | tcp_udp]
+
+   Match a protocol criteria. A protocol number or a name which is here
+   defined: ``/etc/protocols``.
+   Special names are ``all`` for all protocols and ``tcp_udp`` for tcp and udp
+   based packets. The ``!`` negate the selected protocol.
+
+   .. code-block:: none
+
+      set firewall ipv6 input filter rule 10 protocol tcp
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   recent time [second | minute | hour]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   recent time [second | minute | hour]
+
+   Match bases on recently seen sources.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   tcp flags [not] <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   tcp flags [not] <text>
+
+   Allowed values fpr TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``,
+   ``rst``, ``syn`` and ``urg``. Multiple values are supported, and for
+   inverted selection use ``not``, as shown in the example.
+
+   .. code-block:: none
+
+      set firewall ipv6 input filter rule 10 tcp flags 'ack'
+      set firewall ipv6 input filter rule 12 tcp flags 'syn'
+      set firewall ipv6 input filter rule 13 tcp flags not 'fin'
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   state [established | invalid | new | related]
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   state [established | invalid | new | related]
+
+   Match against the state of a packet.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   time startdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   time starttime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   time stopdate <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   time stoptime <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   time weekdays <text>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   time weekdays <text>
+
+   Time to match the defined rule.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   hop-limit <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   hop-limit <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   hop-limit <eq | gt | lt> <0-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   hop-limit <eq | gt | lt> <0-255>
+
+   Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for
+   'greater than', and 'lt' stands for 'less than'.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   recent count <1-255>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
+   recent time <second | minute | hour>
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
+   recent time <second | minute | hour>
+
+   Match when 'count' amount of connections are seen within 'time'. These
+   matching criteria can be used to block brute-force attempts.
+```
+
+## Synproxy
+
+Synproxy connections
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
+   action synproxy
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
+   protocol tcp
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
+   synproxy tcp mss <501-65535>
+
+    Set TCP-MSS (maximum segment size) for the connection
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999>
+   synproxy tcp window-scale <1-14>
+
+    Set the window scale factor for TCP window scaling
+```
+
+### Example synproxy
+
+Requirements to enable synproxy:
+
+> - Traffic must be symmetric
+> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
+> - Disable conntrack loose track option
+
+```none
+set system sysctl parameter net.ipv4.tcp_timestamps value '1'
+
+set system conntrack tcp loose disable
+set system conntrack ignore ipv6 rule 10 destination port '8080'
+set system conntrack ignore ipv6 rule 10 protocol 'tcp'
+set system conntrack ignore ipv6 rule 10 tcp flags syn
+
+set firewall global-options syn-cookies 'enable'
+set firewall ipv6 input filter rule 10 action 'synproxy'
+set firewall ipv6 input filter rule 10 destination port '8080'
+set firewall ipv6 input filter rule 10 inbound-interface name 'eth1'
+set firewall ipv6 input filter rule 10 protocol 'tcp'
+set firewall ipv6 input filter rule 10 synproxy tcp mss '1460'
+set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7'
+set firewall ipv6 input filter rule 1000 action 'drop'
+set firewall ipv6 input filter rule 1000 state invalid
+```
+
+## Operation-mode Firewall
+
+### Rule-set overview
+
+```{eval-rst}
+.. opcmd:: show firewall
+
+   This will show you a basic firewall overview
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall
+      Rulesets Information
+
+      ---------------------------------
+      IPv4 Firewall "forward filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  -----------------------------------------
+      5        jump      all                 0        0  iifname "eth1"  jump NAME_VyOS_MANAGEMENT
+      10       jump      all                 0        0  oifname "eth1"  jump NAME_WAN_IN
+      15       jump      all                 0        0  iifname "eth3"  jump NAME_WAN_IN
+      default  accept    all
+
+      ---------------------------------
+      IPv4 Firewall "name VyOS_MANAGEMENT"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  --------------------------------
+      5        accept    all                 0        0  ct state established  accept
+      10       drop      all                 0        0  ct state invalid
+      20       accept    all                 0        0  ip saddr @A_GOOD_GUYS  accept
+      30       accept    all                 0        0  ip saddr @N_ENTIRE_RANGE  accept
+      40       accept    all                 0        0  ip saddr @A_VyOS_SERVERS  accept
+      50       accept    icmp                0        0  meta l4proto icmp  accept
+      default  drop      all                 0        0
+
+      ---------------------------------
+      IPv6 Firewall "forward filter"
+
+      Rule     Action    Protocol
+      -------  --------  ----------
+      5        jump      all
+      10       jump      all
+      15       jump      all
+      default  accept    all
+
+      ---------------------------------
+      IPv6 Firewall "input filter"
+
+      Rule     Action    Protocol
+      -------  --------  ----------
+      5        jump      all
+      default  accept    all
+
+      ---------------------------------
+      IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT"
+
+      Rule     Action    Protocol
+      -------  --------  ----------
+      5        accept    all
+      10       drop      all
+      20       accept    all
+      30       accept    all
+      40       accept    all
+      50       accept    ipv6-icmp
+      default  drop      all
+```
+
+```{eval-rst}
+.. opcmd:: show firewall summary
+
+   This will show you a summary of rule-sets and groups
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall summary
+      Ruleset Summary
+
+      IPv6 Ruleset:
+
+      Ruleset Hook    Ruleset Priority      Description
+      --------------  --------------------  -------------------------
+      forward         filter
+      input           filter
+      ipv6_name       IPV6-VyOS_MANAGEMENT
+      ipv6_name       IPV6-WAN_IN           PUBLIC_INTERNET
+
+      IPv4 Ruleset:
+
+      Ruleset Hook    Ruleset Priority    Description
+      --------------  ------------------  -------------------------
+      forward         filter
+      input           filter
+      name            VyOS_MANAGEMENT
+      name            WAN_IN              PUBLIC_INTERNET
+
+      Firewall Groups
+
+      Name                     Type                References               Members
+      -----------------------  ------------------  -----------------------  ----------------
+      PBX                      address_group       WAN_IN-100               198.51.100.77
+      SERVERS                  address_group       WAN_IN-110               192.0.2.10
+                                                   WAN_IN-111               192.0.2.11
+                                                   WAN_IN-112               192.0.2.12
+                                                   WAN_IN-120
+                                                   WAN_IN-121
+                                                   WAN_IN-122
+      SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
+                                                   WAN_IN-20
+      PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
+      PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+                                                   WAN_IN-171
+      PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
+      SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
+                                                   IPV6-WAN_IN-111          2001:db8::3
+                                                   IPV6-WAN_IN-112          2001:db8::4
+                                                   IPV6-WAN_IN-120
+                                                   IPV6-WAN_IN-121
+                                                   IPV6-WAN_IN-122
+      SUPPORT                  ipv6_address_group  IPV6-VyOS_MANAGEMENT-20  2001:db8::5
+                                                   IPV6-WAN_IN-20
+
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv6 [forward | input | output] filter
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv6 ipv6-name <name>
+
+   This command will give an overview of a single rule-set.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall ipv6 input filter
+      Ruleset Information
+
+      ---------------------------------
+      ipv6 Firewall "input filter"
+
+      Rule     Action    Protocol      Packets    Bytes  Conditions
+      -------  --------  ----------  ---------  -------  ------------------------------------------------------------------------------
+      10       jump      all                13     1456  iifname "eth1"  jump NAME6_INP-ETH1
+      20       accept    ipv6-icmp          10     1112  meta l4proto ipv6-icmp iifname "eth0"  prefix "[ipv6-INP-filter-20-A]"  accept
+      default  accept    all                14     1584
+
+      vyos@vyos:~$
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv6 [forward | input | output]
+   filter rule <1-999999>
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv6 name <name> rule <1-999999>
+```
+
+```{eval-rst}
+.. opcmd:: show firewall ipv6 ipv6-name <name> rule <1-999999>
+
+   This command will give an overview of a rule in a single rule-set
+```
+
+```{eval-rst}
+.. opcmd:: show firewall group <name>
+
+   Overview of defined groups. You see the type, the members, and where the
+   group is used.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall group LAN
+      Firewall Groups
+
+      Name          Type                References               Members
+      ------------  ------------------  -----------------------  ----------------
+      LAN           ipv6_network_group  IPV6-VyOS_MANAGEMENT-30  2001:db8::0/64
+                                        IPV6-WAN_IN-30
+      LAN           network_group       VyOS_MANAGEMENT-30       192.168.200.0/24
+                                        WAN_IN-30
+
+```
+
+```{eval-rst}
+.. opcmd:: show firewall statistics
+
+   This will show you a statistic of all rule-sets since the last boot.
+```
+
+### Show Firewall log
+
+```{eval-rst}
+.. opcmd:: show log firewall
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6 [forward | input | output | name]
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6 [forward | input | output] filter
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6 name <name>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6 [forward | input | output] filter rule <rule>
+```
+
+```{eval-rst}
+.. opcmd:: show log firewall ipv6 name <name> rule <rule>
+
+   Show the logs of all firewall; show all ipv6 firewall logs; show all logs
+   for particular hook; show all logs for particular hook and priority;
+   show all logs for particular custom chain; show logs for specific Rule-Set.
+```
+
+### Example Partial Config
+
+```none
+firewall {
+    ipv6 {
+        input {
+            filter {
+                rule 10 {
+                    action jump
+                    inbound-interface {
+                        name eth1
+                    }
+                    jump-target INP-ETH1
+                }
+                rule 20 {
+                    action accept
+                    inbound-interface {
+                        name eth0
+                    }
+                    log
+                    protocol ipv6-icmp
+                }
+            }
+        }
+        name INP-ETH1 {
+            default-action drop
+            default-log
+            rule 10 {
+                action accept
+                protocol tcp_udp
+            }
+        }
+    }
+}
+```
+
+### Update geoip database
+
+```{eval-rst}
+.. opcmd:: update geoip
+
+   Command used to update GeoIP database and firewall sets.
+```
diff --git a/docs/configuration/firewall/md-zone.md b/docs/configuration/firewall/md-zone.md
new file mode 100644
index 00000000..40ffd4b4
--- /dev/null
+++ b/docs/configuration/firewall/md-zone.md
@@ -0,0 +1,177 @@
+---
+lastproofread: '2023-11-01'
+---
+
+(firewall-zone)=
+
+# Zone Based Firewall
+
+## Overview
+
+:::{note}
+Starting from VyOS 1.4-rolling-202308040557, a new firewall
+structure can be found on all vyos instalations. Zone based firewall was
+removed in that version, but re introduced in VyOS 1.4 and 1.5. All
+versions built after 2023-10-22 has this feature.
+Documentation for most of the new firewall CLI can be
+found in the [firewall](https://docs.vyos.io/en/latest/configuration/firewall/general.html)
+chapter. The legacy firewall is still available for versions before
+1.4-rolling-202308040557 and can be found in the
+{doc}`legacy firewall configuration </configuration/firewall/general-legacy>`
+chapter.
+:::
+
+In this section there's useful information of all firewall configuration that
+is needed for zone-based firewall.
+Configuration commands covered in this section:
+
+```{eval-rst}
+.. cfgcmd:: set firewall zone ...
+```
+
+From main structure defined in
+{doc}`Firewall Overview</configuration/firewall/index>`
+in this section you can find detailed information only for the next part
+of the general structure:
+
+```none
+- set firewall
+    * zone
+         - custom_zone_name
+            + ...
+```
+
+In zone-based policy, interfaces are assigned to zones, and inspection policy
+is applied to traffic moving between the zones and acted on according to
+firewall rules. A zone is a group of interfaces that have similar functions or
+features. It establishes the security borders of a network. A zone defines a
+boundary where traffic is subjected to policy restrictions as it crosses to
+another region of a network.
+
+Key Points:
+
+- A zone must be configured before an interface is assigned to it and an
+  interface can be assigned to only a single zone.
+- All traffic to and from an interface within a zone is permitted.
+- All traffic between zones is affected by existing policies
+- Traffic cannot flow between zone member interface and any interface that is
+  not a zone member.
+- You need 2 separate firewalls to define traffic: one for each direction.
+
+:::{note}
+In {vytask}`T2199` the syntax of the zone configuration was changed.
+The zone configuration moved from `zone-policy zone <name>` to `firewall
+zone <name>`.
+:::
+
+## Configuration
+
+As an alternative to applying policy to an interface directly, a zone-based
+firewall can be created to simplify configuration when multiple interfaces
+belong to the same security zone. Instead of applying rule-sets to interfaces,
+they are applied to source zone-destination zone pairs.
+
+A basic introduction to zone-based firewalls can be found [here](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall),
+and an example at {ref}`examples-zone-policy`.
+
+### Define a Zone
+
+To define a zone setup either one with interfaces or a local zone.
+
+```{eval-rst}
+.. cfgcmd:: set firewall zone <name> interface <interface>
+
+   Set interfaces to a zone. A zone can have multiple interfaces.
+   But an interface can only be a member in one zone.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall zone <name> local-zone
+
+   Define the zone as a local zone. A local zone has no interfaces and
+   will be applied to the router itself.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall zone <name> default-action [drop | reject]
+
+   Change the default-action with this setting.
+```
+
+```{eval-rst}
+.. cfgcmd:: set firewall zone <name> description
+
+   Set a meaningful description.
+```
+
+### Applying a Rule-Set to a Zone
+
+Before you are able to apply a rule-set to a zone you have to create the zones
+first.
+
+It helps to think of the syntax as: (see below). The 'rule-set' should be
+written from the perspective of: *Source Zone*-to->\*Destination Zone\*
+
+```{eval-rst}
+.. cfgcmd::  set firewall zone <Destination Zone> from <Source Zone>
+   firewall name <rule-set>
+```
+
+```{eval-rst}
+.. cfgcmd::  set firewall zone <name> from <name> firewall name
+   <rule-set>
+```
+
+```{eval-rst}
+.. cfgcmd::  set firewall zone <name> from <name> firewall ipv6-name
+   <rule-set>
+
+   You apply a rule-set always to a zone from an other zone, it is recommended
+   to create one rule-set for each zone pair.
+
+   .. code-block:: none
+
+      set firewall zone DMZ from LAN firewall name LANv4-to-DMZv4
+      set firewall zone LAN from DMZ firewall name DMZv4-to-LANv4
+```
+
+## Operation-mode
+
+```{eval-rst}
+.. opcmd:: show firewall zone-policy
+
+   This will show you a basic summary of zones configuration.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall zone-policy
+      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+      ------  ------------  -----------  ---------------  ---------------
+      LAN     eth1          WAN          WAN_to_LAN
+              eth2
+      LOCAL   LOCAL         LAN          LAN_to_LOCAL
+                            WAN          WAN_to_LOCAL     WAN_to_LOCAL_v6
+      WAN     eth3          LAN          LAN_to_WAN
+              eth0          LOCAL        LOCAL_to_WAN
+      vyos@vyos:~$
+```
+
+```{eval-rst}
+.. opcmd:: show firewall zone-policy zone <zone>
+
+   This will show you a basic summary of a particular zone.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show firewall zone-policy zone WAN
+      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+      ------  ------------  -----------  ---------------  ---------------
+      WAN     eth3          LAN          LAN_to_WAN
+              eth0          LOCAL        LOCAL_to_WAN
+      vyos@vyos:~$ show firewall zone-policy zone LOCAL
+      Zone    Interfaces    From Zone    Firewall IPv4    Firewall IPv6
+      ------  ------------  -----------  ---------------  ---------------
+      LOCAL   LOCAL         LAN          LAN_to_LOCAL
+                            WAN          WAN_to_LOCAL     WAN_to_LOCAL_v6
+      vyos@vyos:~$
+```