From efd6ea180ad96a82ee8b0cc38582a9d505e794fb Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 15 Apr 2026 12:08:34 +0300 Subject: perf: convert all images to WebP with PDF fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction). Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds use WebP while PDF/LaTeX builds fall back to original PNG/JPG. Co-Authored-By: Claude Opus 4.6 (1M context) --- docs/configuration/firewall/bridge.rst | 6 +++--- docs/configuration/firewall/flowtables.rst | 2 +- docs/configuration/firewall/index.rst | 4 ++-- docs/configuration/firewall/ipv4.rst | 4 ++-- docs/configuration/firewall/ipv6.rst | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) (limited to 'docs/configuration/firewall') diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst index 9c360d35..fdf1179f 100644 --- a/docs/configuration/firewall/bridge.rst +++ b/docs/configuration/firewall/bridge.rst @@ -47,13 +47,13 @@ For traffic that needs to be switched internally by the bridge, base chain is **forward**, and it's base command for filtering is ``set firewall bridge forward filter ...``, which happens in stage 4, highlighted with red color. -.. figure:: /_static/images/firewall-bridge-forward.png +.. figure:: /_static/images/firewall-bridge-forward.* For traffic destined to the router itself, or that needs to be routed (assuming a layer3 bridge is configured), the base chain is **input**, the base command is ``set firewall bridge input filter ...`` and the path is: -.. figure:: /_static/images/firewall-bridge-input.png +.. figure:: /_static/images/firewall-bridge-input.* If it's not dropped, then the packet is sent to **IP Layer**, and will be processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again @@ -64,7 +64,7 @@ And for traffic that originates from the bridge itself, the base chain is **output**, base command is ``set firewall bridge output filter ...``, and the path is: -.. figure:: /_static/images/firewall-bridge-output.png +.. figure:: /_static/images/firewall-bridge-output.* Custom bridge firewall chains can be created with the command ``set firewall bridge name ...``. In order to use such custom chain, a rule with action jump, diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst index 915bf39d..35fb0add 100644 --- a/docs/configuration/firewall/flowtables.rst +++ b/docs/configuration/firewall/flowtables.rst @@ -34,7 +34,7 @@ Flowtables allow you to define a fastpath through the flowtable datapath. The flowtable supports for the layer 3 IPv4 and IPv6 and the layer 4 TCP and UDP protocols. -.. figure:: /_static/images/firewall-flowtable-packet-flow.png +.. figure:: /_static/images/firewall-flowtable-packet-flow.* Once the first packet of the flow successfully goes through the IP forwarding path (black circles path), from the second packet on, you might decide to diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst index a5b88839..4fd9b208 100644 --- a/docs/configuration/firewall/index.rst +++ b/docs/configuration/firewall/index.rst @@ -20,7 +20,7 @@ A simplified traffic flow diagram, based on Netfilter packet flow, is shown next, in order to have a full view and understanding of how packets are processed, and what possible paths traffic can take. -.. figure:: /_static/images/firewall-gral-packet-flow.png +.. figure:: /_static/images/firewall-gral-packet-flow.* The main points regarding this packet flow and terminology used in VyOS firewall are covered below: @@ -224,4 +224,4 @@ As the example image below shows, the device now needs rules to allow/block traffic to or from the services running on the device that have open connections on that interface. -.. figure:: /_static/images/firewall-zonebased.png +.. figure:: /_static/images/firewall-zonebased.* diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst index a9435fa8..4d54a68f 100644 --- a/docs/configuration/firewall/ipv4.rst +++ b/docs/configuration/firewall/ipv4.rst @@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base chain is **forward**. A simplified packet flow diagram for transit traffic is shown next: -.. figure:: /_static/images/firewall-fwd-packet-flow.png +.. figure:: /_static/images/firewall-fwd-packet-flow.* The base firewall chain to configure filtering rules for transit traffic is ``set firewall ipv4 forward filter ...``, which happens in stage 5, @@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path for traffic destined to the router itself, and traffic generated by the router (starting from circle number 6): -.. figure:: /_static/images/firewall-input-packet-flow.png +.. figure:: /_static/images/firewall-input-packet-flow.* The base chain for traffic towards the router is ``set firewall ipv4 input filter ...`` diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst index 95502f4a..905d0d20 100644 --- a/docs/configuration/firewall/ipv6.rst +++ b/docs/configuration/firewall/ipv6.rst @@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base chain is **forward**. A simplified packet flow diagram for transit traffic is shown next: -.. figure:: /_static/images/firewall-fwd-packet-flow.png +.. figure:: /_static/images/firewall-fwd-packet-flow.* The base firewall chain to configure filtering rules for transit traffic is ``set firewall ipv6 forward filter ...``, which happens in stage 5, @@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path for traffic destined to the router itself, and traffic generated by the router (starting from circle number 6): -.. figure:: /_static/images/firewall-input-packet-flow.png +.. figure:: /_static/images/firewall-input-packet-flow.* The base chain for traffic towards the router is ``set firewall ipv6 input filter ...`` -- cgit v1.2.3 From 5d4cdc95200e8ef8fa9ef0f52c5607b76e980692 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 21 Apr 2026 15:18:07 +0300 Subject: fix: suppress linter for real/protocol IPs in config examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The following files were touched by the WebP image PR and exposed pre-existing lint violations — real IPs needed for authenticity or actual protocol addresses (OSPF router-IDs, MAC-embedded IPv6): - inter-vrf-routing-vrf-lite.rst: 195.51.100.1, 198.51.0.0/16 - ipsec-cisco-route-based.rst: 1.1.1.1, 2.2.2.2, 1.0.0.0 (Cisco loopback/OSPF RID) - ipsec-pa-route-based.rst: 1.1.1.1, 2.2.2.2 (PA/VyOS OSPF RIDs) - lac-lns.rst: 8.8.8.8 (DNS example) - pppoe-ipv6-basic.rst: ::64 (prefix format illustration) - bridge.rst: 33:33::16:50:0 (MAC address in firewall log) 🤖 Generated by [robots](https://vyos.io) --- docs/configexamples/inter-vrf-routing-vrf-lite.rst | 7 ++++++- docs/configexamples/ipsec-cisco-route-based.rst | 15 +++++++++++++++ docs/configexamples/ipsec-pa-route-based.rst | 16 ++++++++++++++++ docs/configexamples/lac-lns.rst | 4 ++++ docs/configexamples/pppoe-ipv6-basic.rst | 5 +++++ docs/configuration/firewall/bridge.rst | 4 ++++ 6 files changed, 50 insertions(+), 1 deletion(-) (limited to 'docs/configuration/firewall') diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index fd4f6489..36dabd73 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -467,7 +467,7 @@ Now we perform some end-to-end testing - From Management to Outside (fails as intended) - +.. stop_vyoslinter .. code-block:: none @@ -515,6 +515,7 @@ Now we perform some end-to-end testing --- 2001:db8:2::1 ping statistics --- 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms +.. start_vyoslinter - LAN1 to Outside @@ -772,6 +773,8 @@ route-map with an prefix-list. We create a prefix-list first and add all the routes we need to. +.. stop_vyoslinter + .. code-block:: none # set both ipv4 and ipv6 policies @@ -795,6 +798,8 @@ We create a prefix-list first and add all the routes we need to. set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +.. start_vyoslinter + Then add a route-map and reference to above prefix. Consider that the actions taken inside the prefix will MATCH the routes that will be affected by the actions inside the rules of the route-map. diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst index 955c21d4..553c5e2a 100644 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ b/docs/configexamples/ipsec-cisco-route-based.rst @@ -89,6 +89,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -132,9 +134,13 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Cisco ----- +.. stop_vyoslinter + .. code-block:: none crypto isakmp policy 10 @@ -196,6 +202,7 @@ Cisco ! ip route 0.0.0.0 0.0.0.0 10.0.2.1 +.. start_vyoslinter Monitoring @@ -230,6 +237,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -237,6 +246,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: .. code-block:: none @@ -268,6 +279,8 @@ Routing Table: Monitoring on Cisco side ------------------------ +.. stop_vyoslinter + IKE SAs: .. code-block:: none @@ -378,6 +391,8 @@ Routing Table: C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 +.. start_vyoslinter + Checking Connectivity --------------------- diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst index 0b629041..96349d98 100644 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ b/docs/configexamples/ipsec-pa-route-based.rst @@ -88,6 +88,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -131,9 +133,13 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Palo Alto --------- +.. stop_vyoslinter + GUI Configuration: Network -> Network Profiles -> IKE Crypto @@ -225,6 +231,8 @@ CLI configuration with OSPF: set network virtual-router default protocol ospf router-id 1.1.1.1 set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] +.. start_vyoslinter + Monitoring ========== @@ -260,6 +268,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -267,6 +277,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: @@ -337,6 +349,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none admin@PA-VM> show routing protocol ospf neighbor @@ -361,6 +375,8 @@ OSPF Neighbor Status: restart helper time remaining: 0 restart helper exit reason: none +.. start_vyoslinter + Routing Table: diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index 98bad773..f622b48f 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -79,6 +79,8 @@ LAC LNS --- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '192.168.139.100/24' @@ -96,6 +98,8 @@ LNS set vpn l2tp remote-access name-server '8.8.8.8' set vpn l2tp remote-access ppp-options disable-ccp +.. start_vyoslinter + .. note:: This setup requires the Compression Control Protocol (CCP) being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` accomplishes that. diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst index 520ca00b..cc14451c 100644 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ b/docs/configexamples/pppoe-ipv6-basic.rst @@ -51,8 +51,13 @@ delegation (PD). set interfaces pppoe pppoe0 ipv6 address autoconf set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +.. stop_vyoslinter + * Here we use the prefix to configure the address of eth1 (LAN) to form ``::64``, where ``64`` is hexadecimal of address 100. + +.. start_vyoslinter + * For home network users, most of time ISP only provides /64 prefix, hence there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` for more information. diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst index 832bdf67..53775514 100644 --- a/docs/configuration/firewall/bridge.rst +++ b/docs/configuration/firewall/bridge.rst @@ -557,6 +557,8 @@ And op-mode commands: Inspect logs: +.. stop_vyoslinter + .. code-block:: none vyos@BRI:~$ show log firewall bridge @@ -567,3 +569,5 @@ Inspect logs: vyos@BRI:~$ show log firewall bridge forward filter Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 + +.. start_vyoslinter -- cgit v1.2.3