5 files changed, 14 insertions, 10 deletions
diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst
index d0847801..53775514 100644
--- a/docs/configuration/firewall/bridge.rst
+++ b/docs/configuration/firewall/bridge.rst
@@ -50,13 +50,13 @@ chain is **forward**, and its base command for filtering is ``set firewall
 bridge forward filter ...``, which happens in stage 4, highlighted with red
 color.
 
-.. figure:: /_static/images/firewall-bridge-forward.png
+.. figure:: /_static/images/firewall-bridge-forward.*
 
 For traffic destined to the router itself or that needs to be routed
 (assuming a layer3 bridge is configured), the base chain is **input**, and the
 base command is ``set firewall bridge input filter ...`` and the path is:
 
-.. figure:: /_static/images/firewall-bridge-input.png
+.. figure:: /_static/images/firewall-bridge-input.*
 
 If it's not dropped, then the packet is sent to **IP Layer**, and will be
 processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again
@@ -67,7 +67,7 @@ For traffic that originates from the bridge itself, the base chain is
 **output**, and the base command is ``set firewall bridge output filter
 ...``, and the path is:
 
-.. figure:: /_static/images/firewall-bridge-output.png
+.. figure:: /_static/images/firewall-bridge-output.*
 
 Custom bridge firewall chains can be created with the command ``set firewall
 bridge name <name> ...``. To use such a custom chain, a rule with action jump
@@ -557,6 +557,8 @@ And op-mode commands:
 
 Inspect logs:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
       vyos@BRI:~$ show log firewall bridge
@@ -567,3 +569,5 @@ Inspect logs:
       vyos@BRI:~$ show log firewall bridge forward filter
       Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
       Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+
+.. start_vyoslinter
diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst
index 152a4380..f996a59e 100644
--- a/docs/configuration/firewall/flowtables.rst
+++ b/docs/configuration/firewall/flowtables.rst
@@ -31,7 +31,7 @@ Flowtables let you define a fastpath through the flowtable datapath.
 Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP)
 protocols.
 
-.. figure:: /_static/images/firewall-flowtable-packet-flow.png
+.. figure:: /_static/images/firewall-flowtable-packet-flow.*
 
 After the first packet successfully traverses the IP forwarding path (black
 circles path), you can offload subsequent packets to the flowtable through your
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index dc5af26f..c4b3c808 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -20,7 +20,7 @@ packet flow.
 This diagram provides an overview of how packets are processed and the
 possible paths traffic can take.
 
-.. figure:: /_static/images/firewall-gral-packet-flow.png
+.. figure:: /_static/images/firewall-gral-packet-flow.*
 
 The main points regarding packet flow and terminology in VyOS firewall
 are:
@@ -264,4 +264,4 @@ As the following example image shows, you must configure rules to allow or block
 traffic to or from the services running on the device that have open
 connections on that interface.
 
-.. figure:: /_static/images/firewall-zonebased.png
+.. figure:: /_static/images/firewall-zonebased.*
diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst
index 0bac7e92..efd0fe18 100644
--- a/docs/configuration/firewall/ipv4.rst
+++ b/docs/configuration/firewall/ipv4.rst
@@ -53,7 +53,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. The following is a simplified packet flow diagram for
 transit traffic:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain for configuring filtering rules for transit traffic is
 ``set firewall ipv4 forward filter ...``, which occurs in stage 5, highlighted
@@ -64,7 +64,7 @@ the router originates, the base chain is **output**. A simplified packet flow
 diagram is shown next, which shows the path for traffic destined to the router
 itself and traffic the router generates (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is
 ``set firewall ipv4 input filter ...``
diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst
index b1249e3d..d31ceb6f 100644
--- a/docs/configuration/firewall/ipv6.rst
+++ b/docs/configuration/firewall/ipv6.rst
@@ -54,7 +54,7 @@ For transit traffic that the router receives and forwards, the base chain is
 **forward**. The following diagram shows a simplified packet flow for transit
 traffic:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 Use ``set firewall ipv6 forward filter ...`` to configure filtering rules for
 transit traffic. This command corresponds to stage 5 and is highlighted in red
@@ -65,7 +65,7 @@ router generates, use the **output** chain. The following diagram shows the
 packet flow for traffic destined to the router and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 Use ``set firewall ipv6 input filter ...`` to configure traffic destined to
 the router.