Revert "Add incremental RST-to-MyST swap mechanism (#1857)" (#1892)

This reverts commit 4b36114e053ee11d0cb264a1e4cfe4692d78f194.

3 files changed, 0 insertions, 1045 deletions

diff --git a/docs/vpp/configuration/nat/md-cgnat.md b/docs/vpp/configuration/nat/md-cgnat.md
deleted file mode 100644
index d3742b59..00000000
--- a/docs/vpp/configuration/nat/md-cgnat.md
+++ /dev/null
@@ -1,249 +0,0 @@
----
-lastproofread: '2026-03-03'
----
-
-(vpp_config_nat_cgnat)=
-
-```{include} /_include/need_improvement.txt
-```
-
-
-# VPP CGNAT Configuration
-
-Carrier-grade NAT (CGNAT) is a NAT type designed for Internet Service
-Providers (ISPs) to manage limited pools of public IP addresses. It
-solves two main problems:
-- Enables fair sharing of a limited number of public IP addresses among
-  multiple customers, ensuring all have internet access without interfering
-  with each other.
-- Enables tracking and logging of public IP address usage by different
-  customers, which is often a regulatory requirement.
-
-CGNAT configuration is straightforward. Define the inside and outside
-interfaces, then create rules to manage the translation of private IP
-addresses to public IP addresses.
-
-:::{warning}
-**Enabling CGNAT** on an interface (both inside and outside)
-**disables normal routing** on these interfaces and **blocks management
-access** to the VyOS router itself.
-
-Ensure you have an alternative management path to the router before applying
-your CGNAT configuration.
-:::
-
-## Interface Configuration
-
-Define the inside and outside interfaces. The inside interface connects
-to the private network, while the outside interface connects to the public
-network.
-
-```{cfgcmd} set vpp nat cgnat interface inside \<inside-interface\>
-```
-
-```{cfgcmd} set vpp nat cgnat interface outside \<outside-interface\>
-```
-
-This is a mandatory step, as the CGNAT needs to know on which interfaces it
-needs to apply rules and operate.
-
-## NAT Rules Configuration
-
-Next, you need to create the NAT rules.
-
-```{cfgcmd} set vpp nat cgnat rule \<rule-number\> description \<description\>
-```
-
-Add a description to the rule for easier identification.
-
-```{cfgcmd} set vpp nat cgnat rule \<rule-number\> inside-prefix \<inside-prefix\>
-```
-
-Specify the inside prefix (private IP range) to translate.
-
-```{cfgcmd} set vpp nat cgnat rule \<rule-number\> outside-prefix \<outside-prefix\>
-```
-
-Specify the outside prefix (public IP range) to use for translation.
-
-## Exclude Rules Configuration
-
-CGNAT exclude rules are implemented as DET44 identity mappings. Matching
-traffic is excluded from CGNAT translation and keeps its original
-address/port tuple.
-
-```{cfgcmd} set vpp nat cgnat exclude rule \<rule-number\> description \<description\>
-```
-
-Adds a description (stored as VPP identity-mapping tag) for easier
-identification.
-
-```{cfgcmd} set vpp nat cgnat exclude rule \<rule-number\> local-address \<local-address\>
-```
-
-Sets the local IPv4 address that should be excluded from translation. This
-option is mandatory for each exclude rule.
-
-```{cfgcmd} set vpp nat cgnat exclude rule \<rule-number\> protocol \<tcp|udp|icmp|all\>
-```
-
-Matches a specific protocol. Default is `all`.
-
-```{cfgcmd} set vpp nat cgnat exclude rule \<rule-number\> local-port \<1-65535\>
-```
-
-Matches a specific local port (or ICMP identifier in case of ICMP protocol).
-
-:::{important}
-Exclude-rule validation rules:
-- `local-address` must be specified.
-- `protocol` and `local-port` must either both be specified or both be
-  : omitted.
-- Duplicate identity mappings are not allowed (same local-address,
-  : protocol, local-port tuple).
-:::
-
-:::{note}
-A common use case for exclude rules is preserving management-plane access to
-the router itself (for example SSH) and local-originated services (for
-example DNS queries) when CGNAT is enabled.
-:::
-
-:::{important}
-**Memory Requirements**
-
-CGNAT memory usage scales with the number of internal customers.
-
-**Each 256 customers** (equivalent to a /24 subnet) requires
-approximately **4 MB of main heap memory**. This memory maintains
-customer-to-port mappings and session state information.
-
-Configure your VPP main heap size appropriately based on your expected
-customer count. See {ref}`VPP Memory Configuration <vpp_config_dataplane_memory>` for details on adjusting main heap size.
-:::
-
-## Session Limitations
-
-CGNAT has built-in session limitations to ensure fair resource allocation:
-
-Each customer (internal IP address) is limited to a maximum of 1000
-simultaneous sessions, even if more than 1000 ports are allocated to that
-customer. This limitation applies to all session types (TCP, UDP, ICMP).
-
-## Timeouts Configuration
-
-You can adjust NAT session timers to optimize address space usage by
-controlling how long sessions remain active and how long they occupy IP
-address and port combinations.
-
-Adjust these settings for different protocols individually:
-
-```
-set vpp nat cgnat timeout icmp <timeout-value>
-set vpp nat cgnat timeout tcp-established <timeout-value>
-set vpp nat cgnat timeout tcp-transitory <timeout-value>
-set vpp nat cgnat timeout udp <timeout-value>
-```
-
-## Example Configuration
-
-Here is an example CGNAT configuration with these assumptions:
-- Inside interface: `eth2`
-- Outside interface: `eth1`
-- Inside prefix: `100.64.0.0/16`
-- Outside prefix: `203.0.113.0/24`
-
-```
-set vpp nat cgnat interface inside eth2
-set vpp nat cgnat interface outside eth1
-set vpp nat cgnat rule 1 description "CGNAT Rule 1"
-set vpp nat cgnat rule 1 inside-prefix 100.64.0.0/16
-set vpp nat cgnat rule 1 outside-prefix 203.0.113.0/24
-set vpp nat cgnat exclude rule 10 description "Bypass management host"
-set vpp nat cgnat exclude rule 10 local-address 100.64.0.10
-set vpp nat cgnat exclude rule 20 description "Bypass subscriber DNS"
-set vpp nat cgnat exclude rule 20 local-address 100.64.0.20
-set vpp nat cgnat exclude rule 20 protocol udp
-set vpp nat cgnat exclude rule 20 local-port 53
-```
-
-### Operational Commands
-
-Once the CGNAT is configured, you can use the following commands to monitor
-its status and operation:
-
-```{opcmd} show vpp nat cgnat interfaces
-```
-
-Displays the configured inside and outside interfaces.
-
-```
-vyos@vyos:~$ show vpp nat cgnat interfaces
-CGNAT interfaces:
-  eth2 in
-  eth1 out
-```
-
-```{opcmd} show vpp nat cgnat sessions
-```
-
-Display active NAT sessions. This command may produce extensive output if
-many sessions are active.
-
-```{opcmd} show vpp nat cgnat mappings
-```
-
-Display current NAT mappings, including inside and outside address
-prefixes.
-
-```
-vyos@vyos:~$ show vpp nat cgnat mappings
-Inside         Outside           Sharing ratio    Ports per host    Sessions
--------------  --------------  ---------------  ----------------  ----------
-100.64.0.0/16  203.0.113.0/24              256               252           0
-```
-
-```{opcmd} show vpp nat cgnat exclude-rules
-```
-
-Displays configured CGNAT exclude rules (identity mappings).
-
-```
-vyos@vyos:~$ show vpp nat cgnat exclude-rules
-Address      Protocol    Port    VRF  Description
------------  ----------  ------  -----  ---------------------
-100.64.0.10  all         any       0    Bypass management host
-100.64.0.20  udp         53        0    Bypass subscriber DNS
-```
-
-### Potential Issues and Troubleshooting
-
-Configuration fails to apply with an error similar to:
-
-```
-vpp_papi.vpp_papi.VPPIOError: [Errno 2] VPP API client: read failed
-```
-
-CGNAT utilizes main heap memory and if you are trying to configure big
-prefixes or a large number of NAT sessions, you may run into memory allocation
-issues. Try to {ref}`increase the main heap size in VPP configuration
-<vpp-config-dataplane-memory>`.
-
-## SSH/DNS Reachability After Enabling CGNAT
-
-If SSH access to the router (or local-originated DNS queries) stops working
-after enabling CGNAT, traffic may be dropped by DET44 when it does not match a
-translation mapping.
-
-In this case, add an exclude rule for the router local address that must
-bypass CGNAT translation.
-
-```
-set vpp nat cgnat exclude rule 100 local-address <router-ip>
-```
-
-Then verify:
-
-```
-show vpp nat cgnat exclude-rules
-```
diff --git a/docs/vpp/configuration/nat/md-index.md b/docs/vpp/configuration/nat/md-index.md
deleted file mode 100644
index 2591a791..00000000
--- a/docs/vpp/configuration/nat/md-index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-lastproofread: '2026-03-05'
----
-
-(vpp-config-nat-index)=
-
-```{include} /_include/need_improvement.txt
-```
-
-# VPP NAT Configuration
-
-```{toctree}
-:includehidden: true
-:maxdepth: 1
-
-cgnat
-nat44
-```
-
-VPP Dataplane in VyOS supports two types of NAT:
-
-## NAT44
-
-This type is a classic NAT implementation where you can configure static
-and dynamic NAT rules. It supports both source and destination NAT. While the
-configuration may look a bit unusual compared to traditional NAT
-implementations, it provides flexibility in network configurations.
-
-## CGNAT
-
-CGNAT is a special type of NAT44, which is highly useful when you have
-multiple local customers and a limited number of public IP addresses. It
-shares the public IP address space fairly between customers by using a
-combination of IP address and port number to distinguish between them.
-
-ISPs often use this NAT type to provide internet access to customers.
-
-It supports only source NAT.
-
-CGNAT also supports exclude rules (identity mappings) to bypass translation
-for selected local addresses or protocol/port tuples.
diff --git a/docs/vpp/configuration/nat/md-nat44.md b/docs/vpp/configuration/nat/md-nat44.md
deleted file mode 100644
index 01b1cd3a..00000000
--- a/docs/vpp/configuration/nat/md-nat44.md
+++ /dev/null
@@ -1,755 +0,0 @@
----
-lastproofread: '2026-03-05'
----
-
-(vpp-config-nat-nat44)=
-
-```{include} /_include/need_improvement.txt
-```
-
-
-# VPP NAT44 Configuration
-
-NAT44 has two main use cases:
-- **Source NAT (SNAT)**: Enabling internet access for hosts in private
-  networks using dynamic or static address translation.
-- **Destination NAT (DNAT)**: Providing external access to internal services
-  through static port forwarding rules.
-
-VyOS supports both dynamic translation using address pools and static
-mappings for predictable address translation requirements.
-
-Configuring NAT44 involves a few steps:
-1. Define the inside and outside interfaces.
-2. Create NAT rules for SNAT or DNAT.
-
-## Dynamic and Static Operations
-
-NAT44 configuration can be done in one of two ways or in both ways
-simultaneously:
-1. Dynamically performing NAT using a pool of public IP addresses.
-2. Statically mapping private IP addresses to public IP addresses.
-
-To configure dynamic NAT, you need to define a pool of public IP
-addresses that will be used for translation. This offers an easy way to
-provide internet access to internal users.
-
-Static rules are suitable for scenarios where you need consistent and
-predictable mappings between private and public IP addresses. They are also
-the only way to configure DNAT.
-
-### NAT Rule Processing and Traffic Flow
-
-This section explains how different combinations of NAT rules affect
-traffic handling on a router. There are three possible combinations of NAT
-rule configurations:
-1. **Dynamic NAT Only**
-   - **All** traffic received on the "in" interface is processed by
-     dynamic NAT rules without exceptions.
-2. **Dynamic + Static NAT**
-   - **All** traffic received on the "in" interface is first matched
-     against static NAT rules.
-   - If no match is found, it is then processed against dynamic NAT rules.
-3. **Static NAT Only**
-   - **All** traffic on the "in" interface is checked against static NAT
-     rules.
-   - If no match is found, the traffic is routed **without NAT**.
-
-:::{important}
-- If **dynamic NAT rules** are present, **all** traffic received on
-  "in" interfaces is subject to NAT processing.
-- If **only static NAT rules** are configured, traffic that does not
-  match any static rule is routed unchanged.
-:::
-
-## Interfaces Configuration
-
-The first step in configuring NAT44 is defining which interfaces handle
-inside (private) and outside (public) traffic. VyOS uses these interface
-designations to determine the direction of translation.
-
-### Inside Interfaces
-
-Inside interfaces connect to private networks where hosts need source NAT
-to access external networks.
-
-```{cfgcmd} set vpp nat nat44 interface inside \<inside-interface\>
-```
-
-Traffic flowing **from** inside interfaces gets source NAT applied,
-translating private source addresses to public addresses from the
-translation pool.
-
-### Outside Interfaces
-
-Outside interfaces connect to public networks where external hosts may
-need to access internal services.
-
-```{cfgcmd} set vpp nat nat44 interface outside \<outside-interface\>
-```
-
-Traffic flowing **to** outside interfaces can trigger destination NAT
-based on static rules, allowing external access to internal services.
-
-### Interface Roles and Traffic Flow
-
-:::{note}
-While VyOS uses "inside" and "outside" as established conventions,
-the technical definitions are:
-- **Inside interface**: Interface where traffic originates that needs
-  source NAT (SNAT)
-- **Outside interface**: Interface where traffic originates that needs
-  destination NAT (DNAT)
-
-In complex network topologies, the same physical interface can be
-configured as both inside and outside to handle bidirectional NAT
-scenarios.
-:::
-
-**Traffic Processing:**
-1. **Inside → Outside** (SNAT): Private hosts accessing external networks
-2. **Outside → Inside** (DNAT): External hosts accessing internal services
-   via static rules
-3. **Dynamic NAT**: Created automatically for inside→outside traffic
-4. **Static NAT**: Requires explicit configuration for outside→inside
-   traffic
-
-### Multiple Interface Support
-
-You can configure multiple interfaces as inside or outside to support
-complex network topologies:
-
-```none
-# Multiple inside interfaces (different private networks)
-set vpp nat nat44 interface inside eth0
-set vpp nat nat44 interface inside eth2
-
-# Multiple outside interfaces (redundancy or load balancing)  
-set vpp nat nat44 interface outside eth1
-set vpp nat nat44 interface outside eth3
-```
-
-## Address Pool Configuration
-
-Address pools define ranges of IP addresses that can be used for NAT
-translations. VyOS NAT44 supports two types of address pools, each serving
-different purposes.
-
-### Translation Pools
-
-Translation pools are used for dynamic source NAT (SNAT). They provide a
-range of public IP addresses that can be dynamically assigned to private
-hosts when they access external networks.
-
-```{cfgcmd} set vpp nat nat44 address-pool translation address \<ip-address | ip-address-range\>
-```
-
-```{cfgcmd} set vpp nat nat44 address-pool translation interface \<interface-name\>
-```
-
-**Examples:**
-
-```none
-# Single address pool
-set vpp nat nat44 address-pool translation address 203.0.113.10
-
-# Address range pool  
-set vpp nat nat44 address-pool translation address 203.0.113.10-203.0.113.20
-
-# Interface-based pool (use a first IP assigned to the interface)
-set vpp nat nat44 address-pool translation interface eth1
-```
-
-### Twice-NAT Pools
-
-Twice-NAT pools are used when performing both source and destination NAT on
-the same traffic flow. This is particularly useful in scenarios where you
-need to:
-- Translate both source and destination addresses
-- Provide access between networks with overlapping IP ranges
-- Implement advanced NAT scenarios like self-twice-nat
-
-```{cfgcmd} set vpp nat nat44 address-pool twice-nat address \<ip-address | ip-address-range\>
-```
-
-```{cfgcmd} set vpp nat nat44 address-pool twice-nat interface \<interface-name\>
-```
-
-**Examples:**
-
-```none
-# Twice-NAT pool for advanced scenarios
-set vpp nat nat44 address-pool twice-nat address 192.168.100.1-192.168.100.10
-
-# Interface-based twice-nat pool
-set vpp nat nat44 address-pool twice-nat interface eth2
-```
-
-### Pool Requirements
-
-:::{important}
-- For dynamic NAT to work, you must configure at least one
-  **translation** pool.
-- For static rules with twice-nat options, you must configure a
-  **twice-nat** pool.
-- Interface-based pools automatically include main (first) IP address
-  assigned to the specified interface.
-:::
-
-### Pool Selection Priority
-
-When multiple pools are configured, VyOS uses the following selection
-priority:
-1. **Static mappings**: Always use the specific external address defined in
-   the rule.
-2. **Dynamic NAT**: Use available addresses from translation pools in the
-   order they were configured.
-3. **Twice-NAT**: Use addresses from twice-nat pools for secondary
-   translation.
-
-:::{note}
-As soon as you have configured interfaces and pool, the NAT44 is
-operational.
-:::
-
-## Static Rules Configuration
-
-Static NAT rules provide predictable and consistent mappings between private
-and public IP addresses. They are essential for:
-- **Destination NAT (DNAT)**: Allowing external hosts to access services in
-  the private network.
-- **Server publishing**: Making internal services available from the
-  Internet.
-- **Consistent mappings**: Ensuring the same private IP always maps to the
-  same public IP.
-
-Unlike dynamic NAT that uses a pool of addresses, static rules create
-one-to-one mappings that persist until explicitly removed.
-
-### Basic Static Rule Configuration
-
-To create a static NAT rule, you need to define the local (internal) and
-external (public) address mappings:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> local address \<internal-ip\>
-```
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> external address \<external-ip\>
-```
-
-Where:
-- `<rule-number>` is a unique identifier for the rule
-- `<internal-ip>` is the private IP address in your local network
-- `<external-ip>` is the public IP address that external hosts will use
-
-This basic configuration creates a static one-to-one mapping. Traffic from
-outside to the external IP will be translated to the internal IP, and vice
-versa.
-
-### Port-based Static Rules
-
-For more granular control, you can create port-specific static rules. This
-is useful when you want to publish specific services:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> local address \<internal-ip\>
-```
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> local port \<internal-port\>
-```
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> external address \<external-ip\>
-```
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> external port \<external-port\>
-```
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> protocol \<protocol\>
-```
-
-Where:
-- `<internal-port>` and `<external-port>` are the port numbers used by
-  the connection.
-- `<protocol>` specifies the protocol (tcp, udp, icmp).
-
-:::{important}
-If you do not specify ports and protocol, the rule will apply to *all*
-traffic between the specified internal and external addresses.
-
-Rules must contain either both ports and protocol, or neither.
-:::
-
-### Advanced Static Rule Options
-
-VyOS NAT44 supports several advanced options for static rules:
-
-#### Twice-NAT
-
-Twice-NAT performs both source and destination NAT. When an external host
-accesses an internal service, the source IP of such a connection is
-translated to an address from the twice-NAT address pool.
-
-This is practical in scenarios where internal services cannot connect to
-public networks, so they see such traffic as internal.
-
-The twice-NAT option can be enabled with the following command:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> options twice-nat
-```
-
-#### Self Twice-NAT
-
-Self Twice-NAT is used when a local host needs to access itself via the
-external address:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> options self-twice-nat
-```
-
-This option rewrites source IP addresses on packets sent only from a local
-address to an external address configured in a rule.
-
-:::{important}
-- Using `self-twice-nat` option requires you to set the interface
-  connected to the local network as both inside and outside, because
-  both source and destination NAT need to be applied.
-- External IP address used in static rules must belong to one of the
-  configured translation pools.
-:::
-
-#### Out-to-In Only
-
-Restricts the rule to only apply to traffic from outside to inside
-interfaces:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> options out-to-in-only
-```
-
-This prevents the creation of sessions from the inside interface, making it
-a purely DNAT rule.
-
-#### Force Twice-NAT Address
-
-When using twice-nat, you can force the use of a specific IP address from
-the twice-nat address pool:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> options twice-nat-address \<ip-address\>
-```
-
-#### Rule Description
-
-To document your rules, you can add a description:
-
-```{cfgcmd} set vpp nat nat44 static rule \<rule-number\> description \<description\>
-```
-
-### Static Rules Configuration Examples
-
-**Full one-to-one NAT mapping:**
-
-```none
-set vpp nat nat44 static rule 100 local address 192.168.1.10
-set vpp nat nat44 static rule 100 external address 203.0.113.10
-set vpp nat nat44 static rule 100 description "One-to-one mapping"
-```
-
-**Port-specific SSH access:**
-
-```none
-set vpp nat nat44 static rule 200 local address 192.168.1.20
-set vpp nat nat44 static rule 200 local port 22
-set vpp nat nat44 static rule 200 external address 203.0.113.10
-set vpp nat nat44 static rule 200 external port 2222
-set vpp nat nat44 static rule 200 protocol tcp
-set vpp nat nat44 static rule 200 description "SSH access to server"
-```
-
-**Twice-NAT for local service access:**
-
-```none
-set vpp nat nat44 static rule 300 local address 192.168.1.30
-set vpp nat nat44 static rule 300 local port 80
-set vpp nat nat44 static rule 300 external address 203.0.113.10
-set vpp nat nat44 static rule 300 external port 80
-set vpp nat nat44 static rule 300 protocol tcp
-set vpp nat nat44 static rule 300 options twice-nat
-set vpp nat nat44 static rule 300 description "Web service with twice-nat"
-```
-:::{note}
-When using twice-nat or self-twice-nat options, ensure you have
-configured a twice-nat address pool using:
-```none
-set vpp nat nat44 address-pool twice-nat address <twice-nat-ip-range>
-```
-:::
-
-## Exclude Rules Configuration
-
-Exclude rules allow you to prevent specific traffic from undergoing NAT
-translation. This is particularly useful for:
-- **Router management**: Allowing SSH access to the router itself from
-  external networks.
-- **Service bypass**: Excluding specific services from NAT processing
-- **Traffic forwarding**: Allowing forwarded traffic to bypass NAT with 1-to-1
-  mapping.
-
-Exclude rules take precedence over both dynamic and static NAT rules,
-ensuring that matching traffic bypasses NAT processing. For forwarded
-traffic, exclude rules create invisible 1-to-1 mappings that allow packets
-to pass through without NAT modifications.
-
-### Basic Exclude Rule Configuration
-
-To create an exclude rule, you need to specify the traffic characteristics
-that should bypass NAT. You can configure exclude rules in two ways:
-
-**Option 1: Using local address**
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> local-address \<internal-ip\>
-```
-
-**Option 2: Using external interface**
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> external-interface \<interface-name\>
-```
-
-Where:
-- `<rule-number>` is a unique identifier for the exclude rule.
-- `<internal-ip>` is the local IP address that should be excluded from
-  : NAT.
-- `<interface-name>` is the external interface where the traffic
-  : originates.
-
-:::{important}
-You must use either `local-address` OR `external-interface` in an
-exclude rule, but not both simultaneously. These options are mutually
-exclusive.
-:::
-
-### Port-specific Exclude Rules
-
-For more granular control, you can exclude only specific ports and protocols.
-You can combine port and protocol specifications with either `local-address` or
-`external-interface`:
-
-**With local address:**
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> local-address \<internal-ip\>
-```
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> local-port \<port-number\>
-```
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> protocol \<protocol\>
-```
-
-**With external interface:**
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> external-interface \<interface-name\>
-```
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> local-port \<port-number\>
-```
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> protocol \<protocol\>
-```
-
-Where:
-- `<port-number>` is the specific port to exclude (1-65535)
-- `<protocol>` can be `tcp`, `udp`, `icmp`, or `all` (default)
-
-### Rule Documentation
-
-Add descriptions to your exclude rules for better management:
-
-```{cfgcmd} set vpp nat nat44 exclude rule \<rule-number\> description \<description\>
-```
-
-### Exclude Rules Configuration Examples
-
-**Exclude SSH access to router:**
-
-```none
-# Allow external SSH access to router without NAT
-set vpp nat nat44 exclude rule 10 local-address 192.168.1.1
-set vpp nat nat44 exclude rule 10 local-port 22
-set vpp nat nat44 exclude rule 10 protocol tcp
-set vpp nat nat44 exclude rule 10 description "SSH access to router"
-```
-
-**Exclude SNMP monitoring:**
-
-```none
-# Allow SNMP monitoring without NAT translation
-set vpp nat nat44 exclude rule 20 local-port 161
-set vpp nat nat44 exclude rule 20 protocol udp
-set vpp nat nat44 exclude rule 20 external-interface eth1
-set vpp nat nat44 exclude rule 20 description "SNMP monitoring"
-```
-
-**Exclude all traffic to router management interface:**
-
-```none
-# Exclude all traffic to router's management IP
-set vpp nat nat44 exclude rule 30 local-address 192.168.100.1
-set vpp nat nat44 exclude rule 30 description "Management interface bypass"
-```
-
-**Exclude all traffic from external interface:**
-
-```none
-# Exclude all traffic from external interface (alternative approach)
-set vpp nat nat44 exclude rule 31 external-interface eth1
-set vpp nat nat44 exclude rule 31 description "External interface bypass"
-```
-
-**Exclude forwarded traffic for specific service:**
-
-```none
-# Allow external access to internal server without NAT translation
-set vpp nat nat44 exclude rule 40 local-address 192.168.1.50
-set vpp nat nat44 exclude rule 40 local-port 8080
-set vpp nat nat44 exclude rule 40 protocol tcp
-set vpp nat nat44 exclude rule 40 description "Direct access to internal service"
-```
-
-### Common Use Cases
-
-**Router Administration:**
-
-Exclude rules are essential when you need to manage the router from external
-networks. Without exclude rules, NAT would attempt to translate the router's
-own traffic, potentially breaking management connections.
-
-**Service Monitoring:**
-
-Network monitoring systems often need direct access to router services.
-Exclude rules ensure that monitoring traffic bypasses NAT translation.
-
-**Routing Protocols:**
-
-Some routing protocols or network services may require direct communication
-without NAT interference.
-
-**Traffic Forwarding:**
-
-Exclude rules also work for forwarded traffic between networks. Without
-exclude rules, traffic from external to local networks must either match a
-static rule or be dropped. With exclude rules, traffic can bypass NAT
-processing with invisible 1-to-1 mappings.
-
-:::{important}
-Exclude rules affect both traffic destined for the router itself and
-forwarded traffic flowing through the router. For forwarded traffic, exclude
-rules create transparent 1-to-1 mappings that allow packets to pass without
-NAT modifications, while from the outside perspective, the traffic appears to
-bypass NAT entirely.
-:::
-
-## Advanced NAT44 Settings
-
-VyOS provides additional NAT44 settings for fine-tuning performance and
-behavior.
-
-### Session Timeouts
-
-NAT44 maintains translation sessions with configurable timeout values for
-different protocols:
-
-```{cfgcmd} set vpp nat nat44 timeout icmp \<seconds\>
-
-Set the timeout for ICMP sessions (Default: 60 seconds).
-```
-
-```{cfgcmd} set vpp nat nat44 timeout tcp-established \<seconds\>
-
-Set the timeout for established TCP connections (Default: 7440 seconds
-or 2 hours 4 minutes).
-```
-
-```{cfgcmd} set vpp nat nat44 timeout tcp-transitory \<seconds\>
-
-Set the timeout for transitory TCP connections (setup/teardown) (Default:
-240 seconds or 4 minutes).
-```
-
-```{cfgcmd} set vpp nat nat44 timeout udp \<seconds\>
-
-Set the timeout for UDP sessions (Default: 300 seconds or 5 minutes).
-```
-
-**Example:**
-
-```none
-# Customize timeouts for high-traffic environment
-set vpp nat nat44 timeout tcp-established 3600
-set vpp nat nat44 timeout udp 600
-set vpp nat nat44 timeout icmp 30
-```
-
-### Session Limits
-
-Control the maximum number of concurrent NAT sessions:
-
-```{cfgcmd} set vpp nat nat44 session-limit \<number\>
-
-Set the maximum number of NAT sessions per worker thread (Default:
-64512).
-```
-
-This setting helps prevent memory exhaustion and ensures predictable
-performance under high load.
-
-**Example:**
-
-```none
-# Increase session limit for high-capacity deployment
-set vpp nat nat44 session-limit 100000
-```
-
-## Complete Configuration Example
-
-Here's a complete example showing how to configure VyOS NAT44 for a typical
-network setup:
-
-**Network Topology:**
-
-```none
-Internet (203.0.113.0/24)
-        |
-┌───────────────────┐
-│   eth1 (outside)  │ 203.0.113.1/24
-│     VyOS Router   │
-│   eth0 (inside)   │ 192.168.1.1/24  
-└───────────────────┘
-        |
-Internal Network (192.168.1.0/24)
-├── 192.168.1.10 (Web Server)
-├── 192.168.1.20 (SSH Server)  
-└── 192.168.1.30 (API Service)
-```
-
-**Configuration:**
-
-```none
-# Configure interfaces
-set vpp nat nat44 interface inside eth0
-set vpp nat nat44 interface outside eth1
-
-# Configure address pools
-set vpp nat nat44 address-pool translation address 203.0.113.10-203.0.113.50
-set vpp nat nat44 address-pool twice-nat address 203.0.113.100-203.0.113.110
-
-# Exclude rules for router management
-set vpp nat nat44 exclude rule 10 local-address 203.0.113.1
-set vpp nat nat44 exclude rule 10 local-port 22
-set vpp nat nat44 exclude rule 10 protocol tcp
-set vpp nat nat44 exclude rule 10 description "SSH access to router"
-
-set vpp nat nat44 exclude rule 11 local-address 203.0.113.1
-set vpp nat nat44 exclude rule 11 local-port 443
-set vpp nat nat44 exclude rule 11 protocol tcp
-set vpp nat nat44 exclude rule 11 description "HTTPS access to router web interface"
-
-# Static rule for web server (HTTP)
-set vpp nat nat44 static rule 100 local address 192.168.1.10
-set vpp nat nat44 static rule 100 local port 80
-set vpp nat nat44 static rule 100 external address 203.0.113.10
-set vpp nat nat44 static rule 100 external port 80
-set vpp nat nat44 static rule 100 protocol tcp
-set vpp nat nat44 static rule 100 description "Public web server"
-
-# Static rule for web server (HTTPS)
-set vpp nat nat44 static rule 101 local address 192.168.1.10
-set vpp nat nat44 static rule 101 local port 443
-set vpp nat nat44 static rule 101 external address 203.0.113.10
-set vpp nat nat44 static rule 101 external port 443
-set vpp nat nat44 static rule 101 protocol tcp
-set vpp nat nat44 static rule 101 description "Public web server HTTPS"
-
-# Static rule for SSH server with custom port
-set vpp nat nat44 static rule 200 local address 192.168.1.20
-set vpp nat nat44 static rule 200 local port 22
-set vpp nat nat44 static rule 200 external address 203.0.113.11
-set vpp nat nat44 static rule 200 external port 2222
-set vpp nat nat44 static rule 200 protocol tcp
-set vpp nat nat44 static rule 200 description "SSH access"
-
-# Static rule for API service (out-to-in only for security)
-set vpp nat nat44 static rule 300 local address 192.168.1.30
-set vpp nat nat44 static rule 300 local port 8080
-set vpp nat nat44 static rule 300 external address 203.0.113.12
-set vpp nat nat44 static rule 300 external port 8080
-set vpp nat nat44 static rule 300 protocol tcp
-set vpp nat nat44 static rule 300 options out-to-in-only
-set vpp nat nat44 static rule 300 description "API service (No Internet access for it)"
-```
-
-## Best Practices and Troubleshooting
-
-### Recommendations
-
-- **Use exclude rules** for router management services like SSH
-- **Use out-to-in-only** for services that do not need access to external
-  : networks.
-- **Limit port ranges** in static rules to only necessary ports.
-- **Document all rules** using descriptions for easier management.
-- **Use non-standard ports** for publishing SSH and other administrative
-  : services.
-- **Configure appropriate pool sizes** based on expected concurrent
-  : connections in your network.
-
-### Common Configuration Issues
-
-**Static rules not working:**
-
-1. Verify that the external IP address is included in an address pool
-2. Check that interfaces are correctly configured as inside or outside
-3. Ensure firewall rules allow the traffic
-
-**Twice-NAT not functioning:**
-
-1. Confirm twice-nat pool is configured
-2. Verify static rules have the correct twice-nat option
-3. Check that both translation and twice-nat pools are properly defined
-
-**Router management access issues:**
-
-1. Verify exclude rules are configured for management services
-2. Check that local-address matches the router's interface IP
-3. Ensure external-interface is correctly specified
-
-**Forwarded traffic from external networks not bypassing NAT:**
-
-1. Verify exclude rules are configured for the specific traffic flow
-2. Check that local-address matches the destination IP in the internal
-   network
-3. Ensure protocol and port specifications match the traffic requirements
-
-## Operational Commands
-
-Monitor NAT44 status and active connections using VyOS operational
-commands:
-
-```{opcmd} show vpp nat nat44 addresses
-
-Display configured NAT44 address pools.
-```
-
-```{opcmd} show vpp nat nat44 interfaces
-
-Show which interfaces are configured as inside or outside for NAT44.
-```
-
-```{opcmd} show vpp nat nat44 sessions
-
-Display active NAT44 translation sessions.
-```
-
-```{opcmd} show vpp nat nat44 static
-
-Show all configured static NAT mappings.
-```
-
-```{opcmd} show vpp nat nat44 summary
-
-Display a summary of NAT44 and statistics.
-```
\ No newline at end of file