summaryrefslogtreecommitdiff
path: root/docs/configuration/firewall
AgeCommit message (Collapse)Author
2026-05-10chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/Yuriy Andamasov
The swap mechanism (RST-as-fallback for migrated MD pages) is dormant β€” docs/_rst_overrides.txt has been empty since the MyST flip trio (#1899/#1900/#1901) landed. The mechanism's surface area is dead weight and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Sibling PR on rolling: yuriy/remove-rst-swap-mechanism Changes: - Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns. - Strip swap_sources.py invocation from docs/Makefile. - Strip jobs: pre_build/post_build block from .readthedocs.yml. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test. Verified: sphinx-build -b html with --keep-going produces identical warning set (68 unique), identical sitemap entry count (267), identical llms.txt entry count (22), zero rst-* URLs in any artifact. πŸ€– Generated by [robots](https://vyos.io)
2026-05-06feat: flip swap mechanism on circinus β€” MD as primary, RST as overrideYuriy Andamasov
Mirror of #1899 for circinus. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-<stem>.md to docs/**/<stem>.md (drop md- prefix) for all 253 stems previously listed in docs/_swap.txt - Rename docs/**/<stem>.rst to docs/**/rst-<stem>.rst (add rst- prefix) for the same 253 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py rewritten with inverted rename direction (rst-<stem>.rst β†’ <stem>.rst when applying overrides; <stem>.md excluded via _md_exclude.txt) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py rewritten for new semantics Identical change set to #1899 (current). Per-branch differences: - circinus has 253 stems vs current's 254 (suricata is current-only) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io
2026-05-06feat: import MyST swap mechanism, llms.txt feature, and content from currentYuriy Andamasov
Replaces the broken #1885/#1869/#1875 trio with a single PR for circinus. This PR: - Imports 254 md-*.md files from currents working MyST conversion (the broken converter that produced #1885s md-*.md files is not used here; currents files are correct as verified on /en/rolling/). - Adds the per-page RST-to-MyST swap mechanism: scripts/swap_sources.py, scripts/import_myst.py, tests, _swap.txt, _ext/vyos.py and Makefile swap-wrapped targets, .readthedocs.yml pre/post hooks. - Replaces 175 .jpg/.png with 187 .webp images for swapped pages. - Adds the llms.txt + sitemap feature (sphinx_llms_txt, sphinx_sitemap) with circinus-tailored html_baseurl https://docs.vyos.io/en/1.5/ and curated docs/_html_extra/llms.txt for 1.5.x. - Updates docs/_html_extra/robots.txt with AI crawler Allow rules and the /en/1.5/sitemap.xml reference. - Drops configuration/service/suricata from the swap set (no matching RST sibling on circinus; suricata is a current-only feature). Supersedes: - #1885 (broken md-*.md converter output) - #1869 (LLM doc adaptation backport, bundled here) - #1875 (llms.txt circinus, bundled here) Generated by robots https://vyos.io
2026-05-06Revert "docs: fix typos and grammar (ported from #1852 RST β†’ MyST)"Yuriy Andamasov
2026-05-06docs: fix typos and a few grammar issues (ported from #1852 RST β†’ MyST)Yuriy Andamasov
Ports the typo/grammar sweep originally captured in PR #1852 from .rst files to their .md equivalents, plus the eventhandler grammar fix that Copilot flagged in #1852's review (which the RST PR explicitly skipped as scope-stretch). Sources: - 73 typo/grammar substitutions from PR #1852 (rebased from #1801) - "Using environments is more preferable" β†’ "Using environment variables is preferable" (Copilot review comment on #1852) #1852 itself is being discarded since it targets RST and we are phasing out the RST tree in favor of MyST. The 4 RST-linter line-wrap comments and 1 RST section-underline comment from Copilot's #1852 review are RST-specific and do not apply to .md. πŸ€– Generated by [robots](https://vyos.io)
2026-05-06docs: address review feedback (backport from PR #1857)Yuriy Andamasov
πŸ€– Generated by [robots](https://vyos.io)
2026-05-06feat(swap-circinus): add incremental RST-to-MyST swap mechanismYuriy Andamasov
Backport of the swap mechanism from feat/incremental-myst-swap onto the circinus release branch. Built directly on top of origin/circinus, so the underlying RST tree is circinus's (not current's). Mechanism: - scripts/import_myst.py β€” import md from myst/* with md- prefix - scripts/swap_sources.py β€” rename md-{name}.md β†’ {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile β€” html/dirhtml/pdf/livehtml all run swap β†’ build β†’ trap restore; explicit `swap` and `restore` targets too - docs/conf.py β€” MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content (all from origin/myst/circinus): - 253 md-prefixed pages alongside each {name}.rst counterpart - 1 plain MyST-only page kept at canonical name (docs/copyright.md, no .rst counterpart) - 182 .webp images added (circinus release previously had only PNG/JPG; this PR brings webp into circinus alongside the originals) - docs/_swap.txt populated with all 253 stems β†’ MyST is served by default; revert a page by removing its stem from _swap.txt πŸ€– Generated by [robots](https://vyos.io)
2026-05-06Revert "Add incremental RST-to-MyST swap mechanism (circinus) (#1867)" (#1893)Daniil Baturin
This reverts commit 5eb383a10ec92c65eed525bc174785a6852e997f.
2026-05-06Add incremental RST-to-MyST swap mechanism (circinus) (#1867)Yuriy Andamasov
* feat(swap-circinus): add incremental RST-to-MyST swap mechanism Backport of the swap mechanism from feat/incremental-myst-swap onto the circinus release branch. Built directly on top of origin/circinus, so the underlying RST tree is circinus's (not current's). Mechanism: - scripts/import_myst.py β€” import md from myst/* with md- prefix - scripts/swap_sources.py β€” rename md-{name}.md β†’ {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile β€” html/dirhtml/pdf/livehtml all run swap β†’ build β†’ trap restore; explicit `swap` and `restore` targets too - docs/conf.py β€” MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content (all from origin/myst/circinus): - 253 md-prefixed pages alongside each {name}.rst counterpart - 1 plain MyST-only page kept at canonical name (docs/copyright.md, no .rst counterpart) - 182 .webp images added (circinus release previously had only PNG/JPG; this PR brings webp into circinus alongside the originals) - docs/_swap.txt populated with all 253 stems β†’ MyST is served by default; revert a page by removing its stem from _swap.txt πŸ€– Generated by [robots](https://vyos.io) * fix(ext): handle RST fallback in CmdInclude when _renderer absent `cmdincludemd` is in `myst_fence_as_directive`, so MyST routes fence blocks through `render_fence β†’ render_restructuredtext β†’ MockRSTParser`. In that path `self.state` is a plain docutils Body with no `_renderer`, crashing the RTD build. Fall back to `nested_parse` when `_renderer` is unavailable so the directive works in both MyST and RST/MockRSTParser contexts. πŸ€– Generated by [robots](https://vyos.io) * feat(conf): copy .md sources into HTML output for plain-text serving Adds a build-finished hook that mirrors every .md file from the Sphinx source tree into the HTML output directory verbatim, making unrendered MyST sources accessible alongside HTML renders at the same URL path. πŸ€– Generated by [robots](https://vyos.io) * docs: address review feedback (backport from PR #1857) πŸ€– Generated by [robots](https://vyos.io) * docs: port .readthedocs.yml jobs and swap-script tests from PR #1857 Parity backport from PR #1857 (current) β€” was missing on circinus. - .readthedocs.yml: add build.jobs.pre_build / post_build hooks that run scripts/swap_sources.py --swap before the Sphinx build and --restore after. Without this, the swap mechanism ships but never runs on RTD builds for this branch β€” the swap is a silent no-op. - tests/test_import_myst.py, tests/test_swap_sources.py: tests for the swap scripts. The scripts are identical to current's, so the same tests apply. Travels with the branch so CI catches per-branch regressions if the scripts ever drift. πŸ€– Generated by [robots](https://vyos.io) * fix(review): add conftest, filter md- from copy, fix _prefer_webp builder list, trailing newline Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/64b17346-8739-4346-b619-84438cddef21 Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
2026-04-03Add TODO markers, fill placeholders, mark stub pages (#1802) (#1814)mergify[bot]
* chore: add TODO markers for 12 files needing cfgcmd/opcmd conversion * fix: fill TBD placeholder in flow-accounting, remove TBD in static routes * docs: add stub admonitions to 3 minimal pages * fix: replace non-RFC IP addresses and suppress false positives in linter Replace public IPs with RFC 5737 documentation addresses and add stop/start_vyoslinter markers for false positives (MAC addresses, OIDs, NAT64 well-known prefix). * fix: replace remaining non-RFC IPs and suppress MAC address false positive - Replace 8.8.8.8 (Google DNS) with 192.0.2.1 (RFC 5737) in: - docs/configexamples/ansible.rst (3 occurrences) - docs/configexamples/nmp.rst (1 occurrence) - docs/automation/terraform/terraformvSphere.rst (1 occurrence) - Wrap SHA-256 certificate fingerprint in openvpn-examples.rst with stop_vyoslinter/start_vyoslinter to suppress false-positive IPv6 flag * fix: wrap long lines to comply with 80-char line length limit Wrapped prose content exceeding 80 characters in 9 documentation files. Only RST prose and directive content was modified; code block contents were left untouched as they are exempt from the linter. * fix: wrap 2 remaining long lines for linter compliance * fix: suppress linter for long URL reference in terraformvSphere.rst * fix: address Copilot review suggestions β€” broken links, typos, YAML indentation - Fix broken inline RST links split across lines in sysctl.rst, eve-ng.rst, oracle.rst (stub notes with VyOS documentation repository link) - Fix YAML indentation in both playbook code blocks in ansible.rst - Fix typo "VyoS" -> "VyOS" in ansible.rst - Fix typo "desition" -> "decision" in terraformvSphere.rst - Fix 4 occurrences of "Terrafom" -> "Terraform" in terraformvSphere.rst - Fix :doc: role split across two lines in openvpn-examples.rst - Wrap long paragraph in openconnect.rst to <=80 chars and remove unnecessary stop/start_vyoslinter markers * fix: resolve remaining linter failures β€” long lines and OID false positive * fix: revert 8.8.8.8 replacements, use stop_vyoslinter instead --------- (cherry picked from commit a01c2c4ed50470141e7d7bbd31a3ab17418e9936) Co-authored-by: Yuriy Andamasov <yuriy@vyos.io> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2025-11-25firewall: T7739: Default ruleset for firewall zones (#1714)Adam Schultz
Adds new syntax documentation for https://github.com/vyos/vyos-1x/pull/4672
2025-04-29T7386: firewall: update remote-group docs to allow IPv6Mark
2025-04-29firewall: improve zone-based firewall docs (#1622)Ben Woods
2025-03-30firewall: T5493: Document remote-groupAlex W
2025-02-14Firewall: Proofread ipv4.rst and ipv6.rstArrhae Khellian
2024-11-03Firewall: correct ipv4/6 ipsec match parameterrebortg
2024-10-08T6760: add docs for new commands available in firewall: packet modifications ↡Nicolas Fort
commands.
2024-09-20Firewall: add <ethernet-type> matcher for documentation ; add configuration ↡Nicolas Fort
blueprints for bridge and firewall configuration
2024-08-17Firewall: add warning message, saying that during boot, all interfaces are ↡NicolΓ‘s Fort
loaded before firewall. (#1524)
2024-08-05Update lastproofread of modified files during previous PR for bridge ↡Nicolas Fort
firewall documenttion; update image which had an error; minor change on documenation
2024-08-02Extend firewall bridge documentationNicolas Fort
2024-07-18Firewall: remove link to missing legacy syntaxrebortg
2024-07-18Firewall groups: correct code-blockrebortg
2024-07-03proofread and update firewall docswhyrlpool
2024-07-03s/bare/bear across docs, fix typo in proxmox cloud-init docswhyrlpool
2024-07-03Update firewall index.rstwhyrlpool
change "bare in mind" to "bear in mind" re https://www.scribbr.co.uk/definition/bear-in-mind-meaning/
2024-06-20Update flowtables.rstSimon Novak
chore(docs): fixed typos & relevant distinctions for ipv4, ipv6
2024-06-14Configuration Blueprints: add new example for firewall+vrf. Also, add note ↡Nicolas Fort
about usage of inbound and outbound interface when interface is attached to a non-default vrf.
2024-06-12Firewall: Add prerouting informationNicolas Fort
2024-05-14Fix lint issuesNicolas Vollmar
2024-05-10firewall: T5729: remove obsolete enable and correct interface nameNicolas Vollmar
2024-05-09Firewall: add documentation for dynamic firewall groups.Nicolas Fort
2024-05-07State correct rule on first replyNicolas Vollmar
2024-05-07Merge pull request #1416 from Embezzle/spellingDaniil Baturin
Fix spelling mistakes across multiple files
2024-05-06Modified old option from 'enable-default-log' to new one 'default-log'srividya0208
2024-05-04firewall: Corrected spelling mistakesAlex W
2024-04-06Firewall: Fix typo "addtion" -> "addition"Davide Beatrici
2024-03-07Added conntrack-helper rules from T5614 to ipv4 rules documentationGinko (Giggum)
2024-01-21minor wording fixes / adjustmentsJames Simpson
2024-01-11Add opmode commands for firewall zones, and add global state-policies in ↡Nicolas Fort
quick-start
2024-01-08Delete docs/configuration/firewall/index.rst~Robert GΓΆhler
2024-01-05fix to add more fixes on top of previous pull requestGiggum
2024-01-05docs: fix to improve readability and correct typos.Giggum
2023-12-27dhcp-server: update docs for op-mode command <show dhcp server leases>Nicolas Fort
2023-12-26Add configuration commands and brief example of firewall Flowtables. Also ↡Nicolas Fort
re-add commands for firewall state policies, which now can eb found under <global-options> section
2023-12-06Firewall: update firewall bridge docs, and general diagram. Add minor fix to ↡Nicolas Fort
ipv4 firewall doc, and update ipv6
2023-11-27Firewall: Remove <Legacy> firewall documentation from current branch. 1.5 ↡Nicolas Fort
was born with new firewall structure, so no need to include this information.
2023-11-13Update flowtables.rstRobert GΓΆhler
2023-11-12Update flowtables.rstRobert GΓΆhler
2023-11-08Firewall Update: improve documentation and split file for better experience ↡Nicolas Fort
while reading. Add brief notes regarding Flowtables and Bridge firewall, leaving a note that those documents are still under development. New explanation for Netfilter based firewall, which includes new diagrams.