diff options
29 files changed, 89 insertions, 104 deletions
diff --git a/docs/Makefile b/docs/Makefile index 29ef3906..ae12b802 100644 --- a/docs/Makefile +++ b/docs/Makefile @@ -42,6 +42,8 @@ livehtml: swap @trap '$(SWAP) --restore' EXIT; \ sphinx-autobuild --host $(AUTOHOST) --port $(AUTOPORT) \ --ignore '$(BUILDDIR)/**' \ + --ignore '**/_build/**' \ + --ignore '**/md-*' \ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) defaultvalue: export VYOS_DEFAULT=True diff --git a/docs/automation/md-cloud-init.md b/docs/automation/md-cloud-init.md index 01ad360d..b6350b54 100644 --- a/docs/automation/md-cloud-init.md +++ b/docs/automation/md-cloud-init.md @@ -371,8 +371,6 @@ Power on the VM using the CLI or GUI. After it boots, verify the configuration. - Cloud-init [network-config-docs]. - Proxmox [Cloud-init-Support]. - -[cloud-init-docs]: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init [cloud-init-support]: <https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init> [cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files [network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html diff --git a/docs/automation/md-vyos-api.md b/docs/automation/md-vyos-api.md index fd753838..66e8250c 100644 --- a/docs/automation/md-vyos-api.md +++ b/docs/automation/md-vyos-api.md @@ -527,7 +527,7 @@ request body. For example: ```none curl -k --location --request POST 'https://vyos/config-file' \ ---form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress "192.168.2.137/24"\ndescription "test"\n}\n}\n"}' \ +--form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.2.137/24\"\ndescription \"test\"\n}\n}\n"}' \ --form key='MY-HTTPS-API-PLAINTEXT-KEY' response: @@ -553,7 +553,7 @@ The following example uses the JSON format for brevity, though the standard form data format is equally valid: ```none -curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress '192.168.137.1/24'\ndescription 'internal'\n}\n}\n", "confirm_time": 1}' https://vyos/config-file +curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.137.1/24\"\ndescription \"internal\"\n}\n}\n", "confirm_time": 1}' https://vyos/config-file response: { diff --git a/docs/automation/md-vyos-govyos.md b/docs/automation/md-vyos-govyos.md index e5a444f1..c1d0b24a 100644 --- a/docs/automation/md-vyos-govyos.md +++ b/docs/automation/md-vyos-govyos.md @@ -76,7 +76,7 @@ fmt.Println(out.Success) ```none out, resp, err := c.Show.Do(ctx, "interfaces dummy dum1 address") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -89,7 +89,7 @@ fmt.Printf("Data: %v\n", out.Data) ```none out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", nil) if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -106,7 +106,7 @@ options := RetrieveOptions{ out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", options) if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -118,7 +118,7 @@ fmt.Println(out.Success) ```none out, resp, err := c.Conf.Delete(ctx, "interfaces dummy dum1") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -131,7 +131,7 @@ fmt.Println(out.Success) out, resp, err := c.Conf.Save(ctx, "") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -144,7 +144,7 @@ fmt.Println(out.Success) out, resp, err := c.Conf.Save(ctx, "/config/test300.config") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -156,7 +156,7 @@ fmt.Println(out.Success) ```none out, resp, err := c.Show.Do(ctx, "system image") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -169,7 +169,7 @@ fmt.Printf("Data: %v\n", out.Data) ```none out, resp, err := c.Generate.Do(ctx, "pki wireguard key-pair") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -182,7 +182,7 @@ fmt.Printf("Data: %v\n", out.Data) ```none out, resp, err := c.Reset.Do(ctx, "ip bgp 192.0.2.11") if err != nil { - panic("Error: %v", err) + panic(fmt.Sprintf("Error: %v", err)) } fmt.Println(out.Success) @@ -195,5 +195,3 @@ fmt.Printf("Data: %v\n", out.Data) ```none out, resp, err := c.ConfigFile.Load(ctx, "/config/test300.config") ``` - -[go-vyos]: https://github.com/ganawaj/go-vyos diff --git a/docs/automation/md-vyos-napalm.md b/docs/automation/md-vyos-napalm.md index 27e3c16c..d656c7c2 100644 --- a/docs/automation/md-vyos-napalm.md +++ b/docs/automation/md-vyos-napalm.md @@ -149,6 +149,4 @@ $./vyos-napalm.py +name-server 203.0.113.8 [edit] ``` - -[napalm]: https://napalm.readthedocs.io/en/latest/base.html [NAPALM VyOS driver]: https://github.com/napalm-automation-community/napalm-vyos diff --git a/docs/automation/md-vyos-pyvyos.md b/docs/automation/md-vyos-pyvyos.md index c9dcbc81..1a6a09fd 100644 --- a/docs/automation/md-vyos-pyvyos.md +++ b/docs/automation/md-vyos-pyvyos.md @@ -147,5 +147,3 @@ if not response.error: ```none response = device.config_file_load(file="/config/test300.config") ``` - -[pyvyos]: https://github.com/robertoberto/pyvyos diff --git a/docs/automation/terraform/md-terraformAWS.md b/docs/automation/terraform/md-terraformAWS.md index b0c06bb1..488e7926 100644 --- a/docs/automation/terraform/md-terraformAWS.md +++ b/docs/automation/terraform/md-terraformAWS.md @@ -544,8 +544,5 @@ All files related to deploying VyOS on AWS with Terraform and Ansible can be found in the [vyos-automation] repository. [group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html -[image]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html -[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -[link]: https://developer.hashicorp.com/terraform/intro [pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html [vyos-automation]: <https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main> diff --git a/docs/automation/terraform/md-terraformAZ.md b/docs/automation/terraform/md-terraformAZ.md index 05856824..b1b8fac0 100644 --- a/docs/automation/terraform/md-terraformAZ.md +++ b/docs/automation/terraform/md-terraformAZ.md @@ -400,7 +400,8 @@ variable "admin_username" { variable "admin_password" { description = "Administrator password" - default = "Vyos0!" + type = string + sensitive = true } variable "source_network" { @@ -488,7 +489,7 @@ ansible_network_os: vyos.vyos.vyos # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf ansible_user: vyos -ansible_ssh_pass: Vyos0! +ansible_ssh_pass: "{{ vault_vyos_ssh_pass }}" ``` diff --git a/docs/automation/terraform/md-terraformGoogle.md b/docs/automation/terraform/md-terraformGoogle.md index 7236b045..f9c002a7 100644 --- a/docs/automation/terraform/md-terraformGoogle.md +++ b/docs/automation/terraform/md-terraformGoogle.md @@ -466,12 +466,12 @@ resource "google_compute_firewall" "udp_500_4500" { name = "${var.goog_cm_deployment_name}-udp-500-4500" network = element(var.networks, 0) -allow { - ports = ["500", "4500"] - protocol = "udp" -} + allow { + ports = ["500", "4500"] + protocol = "udp" + } -source_ranges = ["0.0.0.0/0"] + source_ranges = ["0.0.0.0/0"] target_tags = ["${var.goog_cm_deployment_name}-deployment"] } diff --git a/docs/automation/terraform/md-terraformvSphere.md b/docs/automation/terraform/md-terraformvSphere.md index 8bbb91e9..abcef5fa 100644 --- a/docs/automation/terraform/md-terraformvSphere.md +++ b/docs/automation/terraform/md-terraformvSphere.md @@ -345,7 +345,7 @@ remote_user=vyos # About tasks: # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node -# You have to add all necessary cammans of VyOS under the block "lines:" +# You have to add all necessary commands of VyOS under the block "lines:" ############################################################################## @@ -363,7 +363,6 @@ remote_user=vyos vyos_config: lines: - set system name-server 192.0.2.1 - - set system name-server 192.0.2.1 save: true ``` diff --git a/docs/conf.py b/docs/conf.py index ed3cc734..b5019407 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -89,7 +89,10 @@ gettext_uuid = False # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. # This pattern also affects html_static_path and html_extra_path . -exclude_patterns = [u'_build', 'Thumbs.db', '.DS_Store', '_include/vyos-1x'] +exclude_patterns = [ + u'_build', 'Thumbs.db', '.DS_Store', '_include/vyos-1x', + 'md-*.md', '**/md-*.md', +] import pathlib _build = pathlib.Path(__file__).parent / '_build' diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md index 114e1d2e..1633b349 100644 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md @@ -1,4 +1,4 @@ -# DHCP Relay trough GRE-Bridge +# DHCP Relay through GRE-Bridge ```{eval-rst} | Testdate: 2023-05-11 diff --git a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md index 8600f8d7..6c59a491 100644 --- a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md +++ b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md @@ -169,7 +169,7 @@ The format of these addresses: - `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. - `2001:470:xxxx:1::/64`: A subnet suitable for a LAN - `2001:470:xxxx:2::/64`: Another subnet -- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. +- `2001:470:xxxx:ffff::/64`: The last usable /64 subnet. In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff (1-65535). diff --git a/docs/configexamples/md-azure-vpn-bgp.md b/docs/configexamples/md-azure-vpn-bgp.md index 180992a7..83d77e53 100644 --- a/docs/configexamples/md-azure-vpn-bgp.md +++ b/docs/configexamples/md-azure-vpn-bgp.md @@ -98,7 +98,7 @@ set interfaces vti vti1 ip adjust-mss 1350 set vpn ipsec authentication psk azure id '198.51.100.3' set vpn ipsec authentication psk azure id '203.0.113.2' set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' -set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3' set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' @@ -106,7 +106,7 @@ set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2' set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' ``` diff --git a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md index 7bccf127..20c1a064 100644 --- a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md +++ b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md @@ -6,7 +6,7 @@ lastproofread: '2024-02-21' # DMVPN Dual HUB Dual Cloud -This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3. +This document is to describe a basic setup to build DMVPN network with two Hubs and two clouds using DMVPN Phase3. OSPF is used as routing protocol inside DMVPN. In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) diff --git a/docs/configexamples/md-fwall-and-bridge.md b/docs/configexamples/md-fwall-and-bridge.md index f8b1ca42..d6602592 100644 --- a/docs/configexamples/md-fwall-and-bridge.md +++ b/docs/configexamples/md-fwall-and-bridge.md @@ -14,7 +14,7 @@ own requirements. - Bridge br0: : - Isolated layer 2 bridge. - - Accept only IPv6 communication whithin the bridge. + - Accept only IPv6 communication within the bridge. - Bridge br1: : - Drop all DHCP discover packets. - Accept all ARP packets. @@ -212,7 +212,7 @@ set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host' set firewall bridge name br1-fwd rule 20 action 'accept' set firewall bridge name br1-fwd rule 20 source address '10.1.1.102' set firewall bridge name br1-fwd rule 20 state 'new' - # Drop everythin else within the bridge: + # Drop everything else within the bridge: set firewall bridge name br1-fwd default-action 'drop' ### br2 - br2-fwd @@ -357,7 +357,7 @@ Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff And with operational mode commands, we can check rules matchers, actions, and counters. -Bridge firewall rulset: +Bridge firewall ruleset: ```none vyos@bri:~$ show firewall bridge @@ -441,7 +441,7 @@ default drop all 0 0 vyos@bridge:~$ ``` -IPv4 firewall rulset: +IPv4 firewall ruleset: ```none vyos@bridge:~$ show firewall ipv4 diff --git a/docs/configexamples/md-ha.md b/docs/configexamples/md-ha.md index b272f38e..c3fd4f84 100644 --- a/docs/configexamples/md-ha.md +++ b/docs/configexamples/md-ha.md @@ -489,7 +489,7 @@ You should now be able to see the advertised network on the other host. ### Duplicate configuration At this point, you now need to create the X link between all four routers. -Use amdifferent /30 for each link. +Use a different /30 for each link. ### Priorities diff --git a/docs/configexamples/md-ipsec-pa-route-based.md b/docs/configexamples/md-ipsec-pa-route-based.md index 36dee669..c4a9e06c 100644 --- a/docs/configexamples/md-ipsec-pa-route-based.md +++ b/docs/configexamples/md-ipsec-pa-route-based.md @@ -128,15 +128,15 @@ set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' set vpn ipsec options disable-route-autoinstall -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer PA connection-type 'initiate' +set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer PA local-address '10.0.1.2' +set vpn ipsec site-to-site peer PA remote-address '10.0.2.2' +set vpn ipsec site-to-site peer PA vti bind 'vti1' ``` diff --git a/docs/configexamples/md-l3vpn-hub-and-spoke.md b/docs/configexamples/md-l3vpn-hub-and-spoke.md index 858edeea..3c719926 100644 --- a/docs/configexamples/md-l3vpn-hub-and-spoke.md +++ b/docs/configexamples/md-l3vpn-hub-and-spoke.md @@ -122,7 +122,7 @@ set protocols mpls ldp interface 'eth5' set protocols mpls ldp router-id '10.0.0.3' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.3 +set protocols ospf parameters router-id '10.0.0.3' ``` - VyOS-P2: diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md index 02d99f86..63231a09 100644 --- a/docs/configexamples/md-nmp.md +++ b/docs/configexamples/md-nmp.md @@ -29,7 +29,7 @@ set service snmp community router network '0.0.0.0/0' ## Configuration 'NMP' -Next, you just should follow the pictures: +Next, you should just follow the pictures: ```{image} /_static/images/nmp1.webp :align: center diff --git a/docs/configexamples/md-policy-based-ipsec-and-firewall.md b/docs/configexamples/md-policy-based-ipsec-and-firewall.md index be3534dc..86bc9318 100644 --- a/docs/configexamples/md-policy-based-ipsec-and-firewall.md +++ b/docs/configexamples/md-policy-based-ipsec-and-firewall.md @@ -167,7 +167,7 @@ set firewall ipv4 input filter rule 20 destination port '22' set firewall ipv4 input filter rule 20 protocol 'tcp' set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED' -# Input traffic: accepd dns requests only from local networks. +# Input traffic: accept dns requests only from local networks. set firewall ipv4 input filter rule 25 action 'accept' set firewall ipv4 input filter rule 25 destination port '53' set firewall ipv4 input filter rule 25 protocol 'udp' diff --git a/docs/configexamples/md-pppoe-ipv6-basic.md b/docs/configexamples/md-pppoe-ipv6-basic.md index 516a4b28..76984f4b 100644 --- a/docs/configexamples/md-pppoe-ipv6-basic.md +++ b/docs/configexamples/md-pppoe-ipv6-basic.md @@ -29,7 +29,7 @@ please contact your ISP for more information. ```none set interfaces pppoe pppoe0 authentication password <YOUR PASSWORD> -set interfaces pppoe pppoe0 authentication user <YOUR USERNAME> +set interfaces pppoe pppoe0 authentication username <YOUR USERNAME> set interfaces pppoe pppoe0 service-name <YOUR SERVICENAME> set interfaces pppoe pppoe0 source-interface 'eth0' ``` diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md index 74654a71..2cd773a9 100644 --- a/docs/configexamples/md-zone-policy.md +++ b/docs/configexamples/md-zone-policy.md @@ -285,6 +285,7 @@ ipv6-name dmz-wan-6 { log enable state { invalid enable + } } rule 100 { action accept diff --git a/docs/configuration/container/md-index.md b/docs/configuration/container/md-index.md index 6cb64225..db46db38 100644 --- a/docs/configuration/container/md-index.md +++ b/docs/configuration/container/md-index.md @@ -5,7 +5,7 @@ lastproofread: '2024-07-03' # Container The VyOS container implementation is based on [Podman](https://podman.io/) as -a deamonless container engine. +a daemonless container engine. ## Configuration @@ -270,17 +270,17 @@ Default health check is run for the container if defined by the image. Override the default health check command from the image for a container. ``` -```{cfgcmd} set container name \<name\> health check interval \<interval\> +```{cfgcmd} set container name \<name\> health-check interval \<interval\> Override the default health-check interval. For example: `60` ``` -```{cfgcmd} set container name \<name\> health check timeout \<timeout\> +```{cfgcmd} set container name \<name\> health-check timeout \<timeout\> Override the default health-check timeout. For example: `10` ``` -```{cfgcmd} set container name \<name\> health check retries \<retries\> +```{cfgcmd} set container name \<name\> health-check retries \<retries\> Number of health check retries before container is considered unhealthy. For example: `1` ``` @@ -314,7 +314,7 @@ is the size (in bytes) of the largest ethernet frame sent on this link. Disable Domain Name System (DNS) plugin for this network. ``` -```{cfgcmd} set container network \<name\> vrf \<nme\> +```{cfgcmd} set container network \<name\> vrf \<name\> Bind container network to a given VRF instance. ``` diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md index 58acd531..f0e94f9e 100644 --- a/docs/configuration/firewall/md-bridge.md +++ b/docs/configuration/firewall/md-bridge.md @@ -146,10 +146,10 @@ set to jump, then jump-target is also needed. ``` ```{cfgcmd} set firewall bridge name \<name\> rule \<1-999999\> jump-target \<text\> +``` If action is set to ``queue``, use next command to specify the queue target. Range is also supported: -``` ```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue \<0-65535\> ``` @@ -489,7 +489,7 @@ supported. Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before they are sent out. This feaure provides more flexibility in +packets before they are sent out. This feature provides more flexibility in packet handling. ```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set dscp \<0-63\> diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md index 81699154..9108a800 100644 --- a/docs/configuration/firewall/md-index.md +++ b/docs/configuration/firewall/md-index.md @@ -83,7 +83,7 @@ packet is processed at the **IP Layer**: IPv4 and IPv6 rules, and two different sections apply: * **Output Prerouting**: ``set firewall [ipv4 | ipv6] output - filter ...``. As described in **Prerouting**, the system processes + raw ...``. As described in **Prerouting**, the system processes rules in this section before the connection tracking subsystem. * **Output Filter**: ``set firewall [ipv4 | ipv6] output filter ...``. @@ -93,7 +93,7 @@ packet is processed at the **IP Layer**: includes: * **Source NAT**: Rules you define under ``set [nat | nat66] - destination...``. + source...``. ``` If the interface where the packet was received is part of a bridge, the diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md index 04c4fc70..2107065d 100644 --- a/docs/configuration/firewall/md-ipv4.md +++ b/docs/configuration/firewall/md-ipv4.md @@ -452,7 +452,7 @@ addresses. :::{code-block} none set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 # with a '!' the rule match everything except the specified subnet -set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24 +set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24 ::: ``` @@ -1160,33 +1160,6 @@ Match the time to live parameter, where 'eq' means 'equal', 'gt' means 'greater than', and 'lt' means 'less than'. ``` -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 name \<name\> rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent time \<second | minute | hour\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent time \<second | minute | hour\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent time \<second | minute | hour\> -``` - -```{cfgcmd} set firewall ipv4 name \<name\> rule \<1-999999\> recent time \<second | minute | hour\> - -Match when 'count' amount of connections appear within 'time'. Use these -matching criteria to block brute-force attempts. -``` - ### Packet Modifications Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md index 0ba30110..770cb146 100644 --- a/docs/configuration/firewall/md-ipv6.md +++ b/docs/configuration/firewall/md-ipv6.md @@ -1247,7 +1247,7 @@ Set hop limit value. ```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set connection-mark \<0-2147483647\> ``` -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> Set connection mark value. ``` diff --git a/docs/vpp/configuration/md-sflow.md b/docs/vpp/configuration/md-sflow.md index 53f6feed..042cf8a8 100644 --- a/docs/vpp/configuration/md-sflow.md +++ b/docs/vpp/configuration/md-sflow.md @@ -12,34 +12,51 @@ lastproofread: '2025-09-04' VPP Dataplane in VyOS supports sFlow for traffic monitoring and analysis. -The VPP Dataplane integration works hand-in-hand with normal kernel sFlow agent, which is responsible for collecting and exporting sFlow samples. VPP itself is responsible for generating the samples. +The VPP Dataplane integration works hand-in-hand with normal kernel +sFlow agent, which is responsible for collecting and exporting sFlow +samples. VPP itself is responsible for generating the samples. -To enable sFlow in VPP, you first need to configure the service using the same steps as for normal kernel sFlow agent, as described in {doc}`/configuration/system/sflow`. Then you can enable sFlow on VPP interfaces. +To enable sFlow in VPP, you first need to configure the service using +the same steps as for normal kernel sFlow agent, as described in +{doc}`/configuration/system/sflow`. Then you can enable sFlow on VPP +interfaces. -Then, you need to enable sFlow on the VPP interfaces you want to monitor. This is done using the following commands: +Then, you need to enable sFlow on the VPP interfaces you want to +monitor. This is done using the following commands: ```{cfgcmd} set vpp sflow interface \<interface-name\> ``` -This will enable sFlow on the specified interface. You can repeat this command for each interface you want to monitor. +This will enable sFlow on the specified interface. You can repeat +this command for each interface you want to monitor. :::{note} -sFlow collects statistics only for traffic *received* on the interface. If you want to monitor traffic *sent* on the interface, you need to enable sFlow on the corresponding interface in the opposite direction. +sFlow collects statistics only for traffic *received* on the +interface. If you want to monitor traffic *sent* on the interface, +you need to enable sFlow on the corresponding interface in the +opposite direction. ::: -Optionally, you can specify the number of bytes from each packet that should be included in the sFlow sample using the following command: +Optionally, you can specify the number of bytes from each packet +that should be included in the sFlow sample using the following +command: ```{cfgcmd} set vpp sflow header-bytes \<bytes\> ``` -This defines the size of the packet header (in bytes) captured for each sFlow sample. +This defines the size of the packet header (in bytes) captured for +each sFlow sample. -The sampling rate is configured globally under the `system sflow` section and automatically applied to VPP sFlow. -This ensures consistent sampling behavior between the system and VPP, and prevents configuration conflicts. +The sampling rate is configured globally under the `system sflow` +section and automatically applied to VPP sFlow. This ensures +consistent sampling behavior between the system and VPP, and +prevents configuration conflicts. -Finally, you need to enable integration between VPP and the kernel sFlow agent using the following command: +Finally, you need to enable integration between VPP and the kernel +sFlow agent using the following command: ```{cfgcmd} set system sflow vpp ``` -After this, collecting and exporting sFlow samples will be handled by the kernel sFlow agent, while VPP will generate the samples. +After this, collecting and exporting sFlow samples will be handled +by the kernel sFlow agent, while VPP will generate the samples. |