4 files changed, 89 insertions, 14 deletions
diff --git a/docs/configuration/protocols/rpki.rst b/docs/configuration/protocols/rpki.rst
index 294a91f8..827bfe1a 100644
--- a/docs/configuration/protocols/rpki.rst
+++ b/docs/configuration/protocols/rpki.rst
@@ -127,8 +127,8 @@ SSH
 ===
 
 Connections to the RPKI caching server can not only be established by HTTP/TLS
-but you can also rely on a secure SSH session to the server. To enable SSH you
-first need to create yoursels an SSH client keypair using ``generate ssh
+but you can also rely on a secure SSH session to the server. To enable SSH,
+first you need to create an SSH client keypair using ``generate ssh
 client-key /config/auth/id_rsa_rpki``. Once your key is created you can setup
 the connection.
 
diff --git a/docs/configuration/service/mdns.rst b/docs/configuration/service/mdns.rst
index 9d6a292a..dcb01207 100644
--- a/docs/configuration/service/mdns.rst
+++ b/docs/configuration/service/mdns.rst
@@ -5,33 +5,49 @@ Starting with VyOS 1.2 a :abbr:`mDNS (Multicast DNS)` repeater functionality is
 provided. Additional information can be obtained from
 https://en.wikipedia.org/wiki/Multicast_DNS.
 
-Multicast DNS uses the 224.0.0.251 address, which is "administratively scoped"
-and does not leave the subnet. It retransmits mDNS packets from one interface
-to other interfaces. This enables support for e.g. Apple Airplay devices across
-multiple VLANs.
+Multicast DNS uses the reserved address ``224.0.0.251``, which is
+`"administratively scoped"` and does not leave the subnet. mDNS repeater
+retransmits mDNS packets from one interface to other interfaces. This enables
+support for devices using mDNS discovery (like network printers, Apple Airplay,
+Chromecast, various IP based home-automation devices etc) across multiple VLANs.
 
-Since the mDNS protocol sends the AA records in the packet itself, the repeater
-does not need to forge the source address. Instead, the source address is of
-the interface that repeats the packet.
+Since the mDNS protocol sends the :abbr:`AA(Authoritative Answer)` records in
+the packet itself, the repeater does not need to forge the source address.
+Instead, the source address is of the interface that repeats the packet.
 
 Configuration
 =============
 
 .. cfgcmd:: set service mdns repeater interface <interface>
 
-   To enable mDNS repeater you need to configure at least two interfaces. To
-   re-broadcast all incoming mDNS packets from any interface configured here to
-   any other interface configured under this section.
+   To enable mDNS repeater you need to configure at least two interfaces so that
+   all incoming mDNS packets from one interface configured here can be
+   re-broadcasted to any other interface(s) configured under this section.
 
 .. cfgcmd:: set service mdns repeater disable
 
    mDNS repeater can be temporarily disabled without deleting the service using
 
+.. cfgcmd:: set service mdns repeater ip-version <ipv4 | ipv6 | both>
+
+   mDNS repeater can be enabled either on IPv4 socket or on IPv6 socket or both
+   to re-broadcast. By default, mDNS repeater will listen on both IPv4 and IPv6.
+
+.. cfgcmd:: set service mdns repeater allow-service <service>
+
+   mDNS repeater can be configured to re-broadcast only specific services. By
+   default, all services are re-broadcasted.
+
+.. cfgcmd:: set service mdns repeater browse-domain <domain>
+
+   Allow listing additional custom domains to be browsed (in addition to the
+   default ``local``) so that they can be reflected.
+
 .. note:: You can not run this in a VRRP setup, if multiple mDNS repeaters
    are launched in a subnet you will experience the mDNS packet storm death!
 
 Example
-=======
+-------
 
 To listen on both `eth0` and `eth1` mDNS packets and also repeat packets
 received on `eth0` to `eth1` (and vice-versa) use the following commands:
@@ -41,4 +57,35 @@ received on `eth0` to `eth1` (and vice-versa) use the following commands:
   set service mdns repeater interface 'eth0'
   set service mdns repeater interface 'eth1'
 
+To allow only specific services, for example ``_airplay._tcp`` or ``_ipp._tcp``,
+(instead of all services) to be re-broadcasted, use the following command:
+
+.. code-block:: none
+
+  set service mdns repeater allow-service '_airplay._tcp'
+  set service mdns repeater allow-service '_ipp._tcp'
+
+To allow listing additional custom domain, for example
+``openthread.thread.home.arpa``, so that it can reflected in addition to the
+default ``local``, use the following command:
+
+.. code-block:: none
+
+   set service mdns repeater browse-domain 'openthread.thread.home.arpa'
+
 .. _`Multicast DNS`: https://en.wikipedia.org/wiki/Multicast_DNS
+
+Operation
+=========
+
+.. opcmd:: restart mdns repeater
+
+  Restart mDNS repeater service.
+
+.. opcmd:: show log mdns repeater
+
+  Show logs for mDNS repeater service.
+
+.. opcmd:: monitor log mdns repeater
+
+  Follow the logs for mDNS repeater service.
diff --git a/docs/configuration/service/ssh.rst b/docs/configuration/service/ssh.rst
index 15c2390c..efdbc651 100644
--- a/docs/configuration/service/ssh.rst
+++ b/docs/configuration/service/ssh.rst
@@ -218,3 +218,31 @@ Operation
     commit
     save
     exit
+
+.. opcmd:: show log ssh
+
+  Show SSH server log.
+
+.. opcmd:: monitor log ssh
+
+  Follow the SSH server log.
+
+.. opcmd:: show log ssh dynamic-protection
+
+  Show SSH dynamic-protection log.
+
+.. opcmd:: monitor log ssh dynamic-protection
+
+  Follow the SSH dynamic-protection log.
+
+.. opcmd:: show ssh dynamic-protection
+
+  Show list of IPs currently blocked by SSH dynamic-protection.
+
+.. opcmd:: show ssh fingerprints
+
+  Show SSH server public key fingerprints.
+
+.. opcmd:: show ssh fingerprints ascii
+
+  Show SSH server public key fingerprints, including a visual ASCII art representation.
diff --git a/docs/configuration/vpn/rsa-keys.rst b/docs/configuration/vpn/rsa-keys.rst
index a95f5f33..1ebab731 100644
--- a/docs/configuration/vpn/rsa-keys.rst
+++ b/docs/configuration/vpn/rsa-keys.rst
@@ -17,7 +17,7 @@ install <key-pair nam>>". You may choose different length than 2048 of course.
   Note: If you plan to use the generated key on this router, do not encrypt the private key.
   Do you want to encrypt the private key with a passphrase? [y/N] N
   Configure mode commands to install key pair:
-  Do you want to install the public key? [Y/n] Yrgerg
+  Do you want to install the public key? [Y/n] Y
   set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'
   Do you want to install the private key? [Y/n] Y
   set pki key-pair ipsec-LEFT private key 'MIIEvgIBADAN...'