From d0a0fd4998b35af5b4e59374a5706ffeb27c7ee5 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Tue, 21 Apr 2026 20:35:22 +0300
Subject: fix: resolve all line-length lint warnings across 14 RST files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wrap prose lines exceeding 80 chars and apply stop/start_vyoslinter
markers around cfgcmd/opcmd directive lines that cannot be shortened
(e.g. long option names with placeholder arguments).

Affected files: bonding, wireguard, pim, conntrack-sync, dmvpn,
ipsec_general, site2site_ipsec, vrf/index, bare-metal,
inter-vrf-routing-vrf-lite, lac-lns, tunnelbroker, OpenVPN_with_LDAP,
dmvpn-dualhub-dualcloud.

🤖 Generated by [robots](https://vyos.io)
---
 docs/configuration/interfaces/bonding.rst        | 334 +++++++++++++----------
 docs/configuration/interfaces/wireguard.rst      |  39 +--
 docs/configuration/protocols/pim.rst             |  39 ++-
 docs/configuration/service/conntrack-sync.rst    |  12 +-
 docs/configuration/vpn/dmvpn.rst                 |  60 ++--
 docs/configuration/vpn/ipsec/ipsec_general.rst   |  20 +-
 docs/configuration/vpn/ipsec/site2site_ipsec.rst |  24 +-
 docs/configuration/vrf/index.rst                 |  21 +-
 8 files changed, 331 insertions(+), 218 deletions(-)

(limited to 'docs/configuration')

diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index 187720a9..7637790c 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -62,20 +62,23 @@ Bond modes
       :widths: 20 80
 
       * - **Description:**
-        - IEEE 802.3ad Dynamic Link Aggregation. Groups only member interfaces with 
-          the same speed (e.g., 1 Gbps) and duplex settings. Member interfaces with 
-          different speed and duplex settings are not included in the active bond.
-
-          Provides load balancing and fault tolerance. Uses the :abbr:`LACP (Link 
-          Aggregation Control Protocol)` to negotiate the bond with the switch.  
+        - IEEE 802.3ad Dynamic Link Aggregation. Groups only member
+          interfaces with the same speed (e.g., 1 Gbps) and duplex
+          settings. Member interfaces with different speed and duplex
+          settings are not included in the active bond.
+
+          Provides load balancing and fault tolerance. Uses the
+          :abbr:`LACP (Link Aggregation Control Protocol)` to
+          negotiate the bond with the switch.
       * - **Traffic distribution:**
-        - Traffic is distributed according to the **transmit hash policy** 
-          (default: XOR). 
-
-          The bonding driver applies an XOR operation to specific packet header fields, 
-          generating a hash value that maps to a particular member interface. This 
-          ensures the same network flow is consistently transmitted over the same member 
-          interface. 
+        - Traffic is distributed according to the **transmit hash
+          policy** (default: XOR).
+
+          The bonding driver applies an XOR operation to specific
+          packet header fields, generating a hash value that maps to
+          a particular member interface. This ensures the same network
+          flow is consistently transmitted over the same member
+          interface.
         
           The transmit hash policy is configured via the ``hash-policy`` option.
       * - **Failover:**
@@ -92,15 +95,16 @@ Bond modes
       :widths: 20 80
  
       * - **Description:**
-        - Provides fault tolerance. Only one member interface is active at a time. 
-          Other member interfaces remain in a standby mode.  
-      * - **Traffic distribution:**         
-        - All traffic (incoming and outgoing) is routed via one active member interface.
-      * - **Failover:**         
-        - If the designated member interface fails, all traffic is routed to
-          another member interface. The bonding driver sends a Gratuitous ARP 
-          to update the peer's MAC address table, linking the bond's MAC address 
-          to another physical port.
+        - Provides fault tolerance. Only one member interface is active
+          at a time. Other member interfaces remain in a standby mode.
+      * - **Traffic distribution:**
+        - All traffic (incoming and outgoing) is routed via one active
+          member interface.
+      * - **Failover:**
+        - If the designated member interface fails, all traffic is
+          routed to another member interface. The bonding driver sends
+          a Gratuitous ARP to update the peer's MAC address table,
+          linking the bond's MAC address to another physical port.
 
    * ``broadcast``
 
@@ -109,11 +113,12 @@ Bond modes
  
       * - **Description:**
         - Provides maximum fault tolerance by duplicating traffic.
-      * - **Traffic distribution:**         
-        - Every packet is duplicated and transmitted on **all** member interfaces.
-      * - **Failover:**         
-        - Traffic flow is not interrupted as long as at least one member interface 
-          remains active.
+      * - **Traffic distribution:**
+        - Every packet is duplicated and transmitted on **all** member
+          interfaces.
+      * - **Failover:**
+        - Traffic flow is not interrupted as long as at least one
+          member interface remains active.
 
    * ``round-robin``   
 
@@ -122,12 +127,13 @@ Bond modes
  
       * - **Description:**
         - Provides load balancing and fault tolerance.
-      * - **Traffic distribution:**         
-        - Packets are transmitted in sequential order across the member interfaces 
-          (e.g., packet 1 > interface A, packet 2 > interface B, etc.).
-      * - **Failover:**         
-        - If a member interface fails, the sequence skips the failed interface and 
-          continues with the remaining active members.
+      * - **Traffic distribution:**
+        - Packets are transmitted in sequential order across the member
+          interfaces (e.g., packet 1 > interface A, packet 2 >
+          interface B, etc.).
+      * - **Failover:**
+        - If a member interface fails, the sequence skips the failed
+          interface and continues with the remaining active members.
 
    * ``transmit-load-balance``   
 
@@ -136,14 +142,15 @@ Bond modes
  
       * - **Description:**
         - Provides adaptive transmit load balancing and fault tolerance.
-      * - **Traffic distribution:**         
-        - **Outgoing:** Distributed across all active member interfaces based on 
-          the current load.
+      * - **Traffic distribution:**
+        - **Outgoing:** Distributed across all active member interfaces
+          based on the current load.
 
-          **Incoming:** Received by a designated member interface (active receiver).
-      * - **Failover:**         
-        - If the active receiver fails, another member interface takes over as the new 
-          active receiver.
+          **Incoming:** Received by a designated member interface
+          (active receiver).
+      * - **Failover:**
+        - If the active receiver fails, another member interface takes
+          over as the new active receiver.
 
    * ``adaptive-load-balance``
 
@@ -151,75 +158,88 @@ Bond modes
       :widths: 20 80
 
       * - **Description:**
-        - Provides adaptive transmit load balancing identical to 
-          ``transmit-load-balance``, receive load balancing for IPv4 traffic, and fault 
-          tolerance for both incoming and outgoing traffic.
+        - Provides adaptive transmit load balancing identical to
+          ``transmit-load-balance``, receive load balancing for IPv4
+          traffic, and fault tolerance for both incoming and outgoing
+          traffic.
       * - **Traffic distribution:**
         - **Outgoing:** Identical to ``transmit-load-balance``.
 
-          **Incoming:** Distributed based on ARP manipulation. For both local and remote
-          connections, the bonding driver intercepts ARP traffic and changes the source
-          MAC address to the MAC address of the least loaded member interface. 
+          **Incoming:** Distributed based on ARP manipulation. For
+          both local and remote connections, the bonding driver
+          intercepts ARP traffic and changes the source MAC address
+          to the MAC address of the least loaded member interface.
 
-          All traffic from that peer is then routed to the chosen member interface.
+          All traffic from that peer is then routed to the chosen
+          member interface.
       * - **Failover:**
-        - If a member interface's state changes (fails, recovers, is added, or excluded),
-          the traffic is redistributed among all active member interfaces.
+        - If a member interface's state changes (fails, recovers, is
+          added, or excluded), the traffic is redistributed among all
+          active member interfaces.
 
-   * ``xor-hash``: Provides load balancing and fault tolerance based on a hash formula. 
-     Distributes traffic and handles failover identically to ``802.3ad``, but operates 
-     without the :abbr:`LACP (Link Aggregation Control Protocol)`.
+   * ``xor-hash``: Provides load balancing and fault tolerance
+     based on a hash formula. Distributes traffic and handles
+     failover identically to ``802.3ad``, but operates without
+     the :abbr:`LACP (Link Aggregation Control Protocol)`.
 
 .. cfgcmd:: set interfaces bonding <interface> min-links <0-16>
 
-   **Configure how many member interfaces must be active (in the link-up state) to 
-   mark the bonding interface UP (carrier asserted).**
+   **Configure how many member interfaces must be active (in the
+   link-up state) to mark the bonding interface UP (carrier
+   asserted).**
 
-   This command applies only when the bonding interface is configured in 802.3ad 
-   mode and functions like the Cisco EtherChannel min-links feature. It ensures 
-   that a bonding interface is marked UP (carrier asserted) only when a specified 
-   number of member interfaces are active (in the link-up state). This helps 
-   guarantee a minimum level of bandwidth for higher-level services (such as 
-   clustering) relying on the bonding interface. 
+   This command applies only when the bonding interface is configured
+   in 802.3ad mode and functions like the Cisco EtherChannel min-links
+   feature. It ensures that a bonding interface is marked UP (carrier
+   asserted) only when a specified number of member interfaces are
+   active (in the link-up state). This helps guarantee a minimum level
+   of bandwidth for higher-level services (such as clustering) relying
+   on the bonding interface.
 
-   The default value is 0. This marks the bonding interface UP (carrier asserted) 
-   whenever an active LACP aggregator exists, regardless of the number of member 
-   interfaces in that aggregator. 
+   The default value is 0. This marks the bonding interface UP
+   (carrier asserted) whenever an active LACP aggregator exists,
+   regardless of the number of member interfaces in that aggregator.
 
-   .. note:: In 802.3ad mode, a bond cannot be active without at least one active 
-      member interface. Therefore, setting min-links to 0 or 1 has the same result: 
-      the bonding interface is marked UP (carrier asserted).
+   .. note:: In 802.3ad mode, a bond cannot be active without at
+      least one active member interface. Therefore, setting min-links
+      to 0 or 1 has the same result: the bonding interface is marked
+      UP (carrier asserted).
 
 .. cfgcmd:: set interfaces bonding <interface> lacp-rate <slow|fast>
 
-   **Configure the rate at which the bonding interface requests its link 
-   partner to send** :abbr:`LACPDUs (Link Aggregation Control Protocol Data 
-   Units)` **in 802.3ad mode.**
+   **Configure the rate at which the bonding interface requests its
+   link partner to send**
+   :abbr:`LACPDUs (Link Aggregation Control Protocol Data Units)`
+   **in 802.3ad mode.**
 
-   This command applies only when the bonding interface is configured in 
-   802.3ad mode.
+   This command applies only when the bonding interface is configured
+   in 802.3ad mode.
 
    The following options are available:
 
-   * **slow (default):** Requests the link partner to transmit LACPDUs every 30 seconds.
+   * **slow (default):** Requests the link partner to transmit
+     LACPDUs every 30 seconds.
 
-   * **fast:** Requests the link partner to transmit LACPDUs every 1 second. 
+   * **fast:** Requests the link partner to transmit LACPDUs every
+     1 second.
 
 
 .. cfgcmd:: set interfaces bonding <interface> system-mac <mac address>
 
    **Configure a specific MAC address for the bonding interface.**
 
-   This sets the 802.3ad system MAC address, which is used for :abbr:`LACPDU (Link 
-   Aggregation Control Protocol Data Unit)` exchanges with the link partner. 
-   You can assign a fixed MAC address or generate a random one for these 
-   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` exchanges. 
+   This sets the 802.3ad system MAC address, which is used for
+   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)`
+   exchanges with the link partner. You can assign a fixed MAC address
+   or generate a random one for these
+   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)`
+   exchanges.
 
 
 .. cfgcmd:: set interfaces bonding <interface> hash-policy <policy>
 
-   **Configure which transmit hash policy to use for distributing traffic across 
-   member interfaces.**
+   **Configure which transmit hash policy to use for distributing
+   traffic across member interfaces.**
 
    The following policies are available:
 
@@ -229,10 +249,12 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Routes all traffic destined for a specific network peer through the same 
-            member interface. The policy is 802.3ad-compliant.
+          - Routes all traffic destined for a specific network peer
+            through the same member interface. The policy is
+            802.3ad-compliant.
         * - **Hash inputs:**
-          - Source MAC address, destination MAC address, and Ethernet packet type ID. 
+          - Source MAC address, destination MAC address, and Ethernet
+            packet type ID.
         * - **Formula:**
           - .. code-block:: none
 
@@ -245,13 +267,16 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Similar to ``layer2``, routes all traffic destined for a specific network 
-            peer through the same member interface and is IEEE 802.3ad-compliant. Uses 
-            both Layer 2 and Layer 3 information to provide a more balanced traffic distribution.
+          - Similar to ``layer2``, routes all traffic destined for a
+            specific network peer through the same member interface
+            and is IEEE 802.3ad-compliant. Uses both Layer 2 and
+            Layer 3 information to provide a more balanced traffic
+            distribution.
         * - **Hash inputs:**
-          - * Source MAC address, destination MAC address, and Ethernet packet type ID.
-            * Source IP address, destination IP address. IPv6 addresses are first hashed 
-              using ``IPv6_addr_hash``. 
+          - * Source MAC address, destination MAC address, and
+              Ethernet packet type ID.
+            * Source IP address, destination IP address. IPv6
+              addresses are first hashed using ``IPv6_addr_hash``.
         * - **Formula:**
           - .. code-block:: none
 
@@ -269,18 +294,21 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Routes different connections (flows) destined for a specific network peer 
-            through multiple member interfaces, but ensures each individual flow is 
-            routed through only one member interface.
-
-            .. note:: This policy is not fully 802.3ad-compliant. When a single TCP 
-               or UDP flow contains both fragmented and unfragmented packets, the 
-               algorithm may distribute them across different member interfaces. This 
-               may result in out-of-order packet delivery, violating the 802.3ad standard.
+          - Routes different connections (flows) destined for a
+            specific network peer through multiple member interfaces,
+            but ensures each individual flow is routed through only
+            one member interface.
+
+            .. note:: This policy is not fully 802.3ad-compliant.
+               When a single TCP or UDP flow contains both fragmented
+               and unfragmented packets, the algorithm may distribute
+               them across different member interfaces. This may
+               result in out-of-order packet delivery, violating the
+               802.3ad standard.
         * - **Hash inputs:**
           - * Source port, destination port (if available).
-            * Source IP address, destination IP address. IPv6 addresses are first hashed 
-              using ``IPv6_addr_hash``. 
+            * Source IP address, destination IP address. IPv6
+              addresses are first hashed using ``IPv6_addr_hash``.
         * - **Formula:**
           - .. code-block:: none
 
@@ -290,8 +318,9 @@ Bond modes
                hash = hash XOR (hash RSHIFT 8)
                member interface number = hash modulo member interface count
 
-            For fragmented TCP or UDP packets and all other IPv4 and IPv6 traffic, the 
-            source and destination port information is omitted.
+            For fragmented TCP or UDP packets and all other IPv4 and
+            IPv6 traffic, the source and destination port information
+            is omitted.
 
             For non-IP traffic, the formula is the same as for ``layer2``.
  
@@ -299,29 +328,33 @@ Bond modes
 
    **Configure the primary member interface in the bond.**
 
-   The primary member interface remains active as long as it is operational; 
-   alternative member interfaces are used only if it fails. 
+   The primary member interface remains active as long as it is
+   operational; alternative member interfaces are used only if it
+   fails.
 
-   Use this configuration when a specific member interface is preferred, 
-   such as one with higher throughput.
+   Use this configuration when a specific member interface is
+   preferred, such as one with higher throughput.
 
-   This command applies only to ``active-backup``, ``transmit-load-balance``, and 
-   ``adaptive-load-balance`` modes.
+   This command applies only to ``active-backup``,
+   ``transmit-load-balance``, and ``adaptive-load-balance`` modes.
 
 .. cfgcmd:: set interfaces bonding <interface> arp-monitor interval <time>
 
-   **Configure the ARP monitoring interval, in seconds, for the bonding interface.**
+   **Configure the ARP monitoring interval, in seconds, for the
+   bonding interface.**
 
-   ARP monitoring periodically assesses the health of each member interface by 
-   checking whether it has recently sent or received traffic (this criterion 
-   varies depending on the bonding mode and the member interface’s state). ARP 
-   probes are sent to the IP addresses specified with the arp-monitor target option.
+   ARP monitoring periodically assesses the health of each member
+   interface by checking whether it has recently sent or received
+   traffic (this criterion varies depending on the bonding mode and
+   the member interface’s state). ARP probes are sent to the IP
+   addresses specified with the arp-monitor target option.
 
-   When ARP monitoring is used with EtherChannel-compatible modes (such as 
-   ``round-robin`` or ``xor-hash``), the switch should be configured to distribute 
-   traffic across all member interfaces. If the switch distributes traffic using 
-   an XOR-based policy, all ARP replies will be received on one member interface, 
-   causing other member interfaces to be incorrectly marked as failed. 
+   When ARP monitoring is used with EtherChannel-compatible modes
+   (such as ``round-robin`` or ``xor-hash``), the switch should be
+   configured to distribute traffic across all member interfaces. If
+   the switch distributes traffic using an XOR-based policy, all ARP
+   replies will be received on one member interface, causing other
+   member interfaces to be incorrectly marked as failed.
 
    Setting this value to 0 disables ARP monitoring.
 
@@ -331,13 +364,13 @@ Bond modes
 
    **Configure the IP addresses for ARP monitoring requests.**
 
-   The bonding driver sends ARP requests to these IP addresses to check the 
-   state of member interfaces.
+   The bonding driver sends ARP requests to these IP addresses to
+   check the state of member interfaces.
 
-   To enable ARP monitoring, configure at least one IP address (up to 16 per 
-   bonding interface). 
+   To enable ARP monitoring, configure at least one IP address (up to
+   16 per bonding interface).
 
-   By default, no IP addresses are configured. 
+   By default, no IP addresses are configured.
 
 :abbr:`VLAN (Virtual Local Area Network)`
 =========================================
@@ -381,40 +414,46 @@ discriminator, or an Ethernet Segment Identifier Name (ESINAME).
 The following two commands generate a 10-byte Type-3 ESI by combining the 
 system MAC and local discriminator: 
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set interfaces bonding <interface> evpn es-id <1-16777215|10-byte ID>
 .. cfgcmd:: set interfaces bonding <interface> evpn es-sys-mac <xx:xx:xx:xx:xx:xx>
 
-  Alternatively, assign an ESINAME directly as a 10-byte Type-0 ESI using the 
-  following format: 00:AA:BB:CC:DD:EE:FF:GG:HH:II.
+  Alternatively, assign an ESINAME directly as a 10-byte Type-0 ESI
+  using the following format: 00:AA:BB:CC:DD:EE:FF:GG:HH:II.
 
   **BGP-EVPN route usage**
 
-  EVPN-MH uses BGP-EVPN route types 1 and 2 for ES discovery and MAC-IP 
-  synchronization:
+  EVPN-MH uses BGP-EVPN route types 1 and 2 for ES discovery and
+  MAC-IP synchronization:
 
-  * **Type 1 (EAD-per-ES and EAD-per-EVI)** routes advertise the locally 
-    attached ESs and discover remote ESs in the network. 
-  * **Type 2 (MAC-IP advertisement)** routes are advertised with a 
+  * **Type 1 (EAD-per-ES and EAD-per-EVI)** routes advertise the
+    locally attached ESs and discover remote ESs in the network.
+  * **Type 2 (MAC-IP advertisement)** routes are advertised with a
     destination ESI, enabling MAC-IP synchronization between ES peers.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set interfaces bonding <interface> evpn es-df-pref <1-65535>
 
-  **Configure the** :abbr:`DF (Designated Forwarder)` **preference (1-65535) for 
-  the interface. A higher value indicates a higher preference to become the** 
-  :abbr:`DF (Designated Forwarder)`. **The** :abbr:`DF (Designated Forwarder)` 
+  **Configure the** :abbr:`DF (Designated Forwarder)` **preference (1-65535) for
+  the interface. A higher value indicates a higher preference to become the**
+  :abbr:`DF (Designated Forwarder)`. **The** :abbr:`DF (Designated Forwarder)`
   **preference is configured per-ES.**
 
-  The DF election process determines which interface in a specific ES forwards 
-  :abbr:`BUM (Broadcast, Unknown Unicast, and Multicast)` traffic from the EVPN 
-  overlay to the connected CE device. EVPN Type-4 (Ethernet Segment) routes are 
-  used to elect the DF, implementing the preference-based election method defined 
+  The DF election process determines which interface in a specific ES forwards
+  :abbr:`BUM (Broadcast, Unknown Unicast, and Multicast)` traffic from the EVPN
+  overlay to the connected CE device. EVPN Type-4 (Ethernet Segment) routes are
+  used to elect the DF, implementing the preference-based election method defined
   in RFC 9785.
 
-  Interfaces not elected as the DF drop any BUM traffic from the EVPN overlay 
-  using non-DF filters. Similarly, traffic received from ES peers via the EVPN 
-  overlay is blocked from forwarding to the CE device to maintain split-horizon 
+  Interfaces not elected as the DF drop any BUM traffic from the EVPN overlay
+  using non-DF filters. Similarly, traffic received from ES peers via the EVPN
+  overlay is blocked from forwarding to the CE device to maintain split-horizon
   filtering with local bias.
-  
+
+.. start_vyoslinter
+
 .. cmdinclude:: /_include/interface-evpn-uplink.txt
    :var0: bonding
    :var1: bond0
@@ -442,13 +481,14 @@ subinterface.
   set interfaces bonding bond0 member interface eth1
   set interfaces bonding bond0 member interface eth2
 
-.. note:: If you are running this configuration in a virtual environment like 
-   EVE-NG, ensure the e1000 driver is chosen for your VyOS NIC. The default 
-   drivers, such as ``virtio-net-pci`` or ``vmxnet3``, are incompatible with 
-   this configuration. Specifically, ICMP messages will not be processed correctly.
+.. note:: If you are running this configuration in a virtual environment like
+   EVE-NG, ensure the e1000 driver is chosen for your VyOS NIC. The default
+   drivers, such as ``virtio-net-pci`` or ``vmxnet3``, are incompatible with
+   this configuration. Specifically, ICMP messages will not be processed
+   correctly.
 
-   To check your NIC driver, use the following command: :opcmd:`show interfaces ethernet
-   eth0 physical | grep -i driver`
+   To check your NIC driver, use the following command:
+   :opcmd:`show interfaces ethernet eth0 physical | grep -i driver`
 
 Cisco Catalyst configuration
 ============================
@@ -486,8 +526,8 @@ such as allowed VLAN interfaces and STP, is applied here.
 Juniper EX Switch configuration
 ===============================
 
-Configure a Juniper EX Series switch to integrate with a two-member VyOS bonding 
-interface.
+Configure a Juniper EX Series switch to integrate with a two-member VyOS
+bonding interface.
 
 .. code-block:: none
 
diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst
index e66b0fb8..f6da17e3 100644
--- a/docs/configuration/interfaces/wireguard.rst
+++ b/docs/configuration/interfaces/wireguard.rst
@@ -33,8 +33,9 @@ Generate keypair
 
    Generate a keypair: a public and a private key.
    
-   .. note:: This command only outputs the keys to your console. It neither stores 
-      them in the system nor applies them to the system configuration.
+   .. note:: This command only outputs the keys to your console. It
+      neither stores them in the system nor applies them to the system
+      configuration.
 
 
    .. code-block:: none
@@ -58,9 +59,9 @@ Generate keypair
 
      Corresponding public-key to use on peer system is: 'UxDsYT6EnpTIOKUzvMlw2p0sNOKQvFxEdSVrnNrX1Ro='
 
-   .. note:: If you invoke this command from configuration mode with the ``run`` 
-      prefix, the generated private key is automatically assigned to the specified 
-      interface. 
+   .. note:: If you invoke this command from configuration mode with
+      the ``run`` prefix, the generated private key is automatically
+      assigned to the specified interface.
 
    .. code-block:: none
 
@@ -103,10 +104,12 @@ Optional
      Pre-shared key: OHH2EwZfMNK+1L6BXbYw3bKCtMrfjpR4mCAEeBlFnRs=
 
 
+.. stop_vyoslinter
+
 .. opcmd:: generate pki wireguard preshared-key install interface <interface> peer <peer>
 
-   Generate a pre-shared key and output the key assignment command for the 
-   specified peer.
+   Generate a pre-shared key and output the key assignment command for
+   the specified peer.
 
    .. code-block:: none
 
@@ -119,8 +122,11 @@ Optional
      Pre-shared key: +LuaZ8W6DjsDFJFX3jJzoNqrsXHhvq08JztM9z8LHCs=
 
 
-   .. note:: If you invoke this command from configuration mode with the run 
-      prefix, the generated key is automatically assigned to the specified peer. 
+   .. note:: If you invoke this command from configuration mode with
+      the run prefix, the generated key is automatically assigned to
+      the specified peer.
+
+.. start_vyoslinter
 
 
 ***********************
@@ -133,7 +139,8 @@ networks you want to tunnel (``allowed-ips``).
 If your system only initiates connections, specifying the listen port is 
 optional. If your system accepts incoming connections, you must define a port 
 for peers to connect to. Otherwise, WireGuard selects a random port at each 
-reboot, and that may break your peers' ability to connect if that port is not enabled in your firewall rules.
+reboot, and that may break your peers' ability to connect if that port
+is not enabled in your firewall rules.
 
 To configure a WireGuard tunnel, you also need your peer's public key.
 
@@ -417,13 +424,13 @@ simplify deployment, generate a per-mobile configuration from the VyOS CLI.
   The public key from the specified interface is automatically included in the 
   configuration file.
 
-  The command also generates a configuration snippet that can be copied into the 
-  VyOS CLI. The ``<name>`` you provide will be used as the peer name in the 
-  snippet.
+  The command also generates a configuration snippet that can be copied
+  into the VyOS CLI. The ``<name>`` you provide will be used as the peer
+  name in the snippet.
 
-  You must also specify the IP address or FQDN of the server the client connects 
-  to. The address parameter can be used twice to assign both an IPv4 (/32) and 
-  an IPv6 (/128) address to the client.
+  You must also specify the IP address or FQDN of the server the client
+  connects to. The address parameter can be used twice to assign both an
+  IPv4 (/32) and an IPv6 (/128) address to the client.
 
   .. figure:: /_static/images/wireguard_qrcode.*
      :alt: WireGuard Client QR code
diff --git a/docs/configuration/protocols/pim.rst b/docs/configuration/protocols/pim.rst
index 019f1e64..f3f388ba 100644
--- a/docs/configuration/protocols/pim.rst
+++ b/docs/configuration/protocols/pim.rst
@@ -70,12 +70,17 @@ PIM-SM - PIM Sparse Mode
    This command is only useful at scale when you can possibly have a large
    number of PIM control packets flowing.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim register-accept-list <prefix-list>
 
-   When PIM receives a register packet the source of the packet will be compared
-   to the prefix-list specified, and if a permit is received normal processing
-   continues. If a deny is returned for the source address of the register packet
-   a register stop message is sent to the source.
+   When PIM receives a register packet the source of the packet will be
+   compared to the prefix-list specified, and if a permit is received
+   normal processing continues. If a deny is returned for the source
+   address of the register packet a register stop message is sent to
+   the source.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols pim register-suppress-time <n>
 
@@ -84,9 +89,10 @@ PIM-SM - PIM Sparse Mode
 
 .. cfgcmd:: set protocols pim rp <address> group <group>
 
-   In order to use PIM, it is necessary to configure a :abbr:`RP (Rendezvous Point)`
-   for join messages to be sent to. Currently the only methodology to do this is
-   via static rendezvous point commands.
+   In order to use PIM, it is necessary to configure a
+   :abbr:`RP (Rendezvous Point)` for join messages to be sent to.
+   Currently the only methodology to do this is via static rendezvous
+   point commands.
 
    All routers in the PIM network must agree on these values.
 
@@ -115,14 +121,19 @@ PIM-SM - PIM Sparse Mode
    nexthops in it's decision for :abbr:`RPF (Reverse Path Forwarding)` lookup
    if this option is not set (default).
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list <list>]
 
-   On the last hop router if it is desired to not switch over to the SPT tree
-   configure this command.
+   On the last hop router if it is desired to not switch over to the
+   SPT tree configure this command.
 
-   Optional parameter prefix-list can be use to control which groups to switch or
-   not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover
-   does not happen for it and if it is DENY, then the SPT switchover happens.
+   Optional parameter prefix-list can be use to control which groups
+   to switch or not switch. If a group is PERMIT as per the
+   prefix-list, then the SPT switchover does not happen for it and if
+   it is DENY, then the SPT switchover happens.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols pim ssm prefix-list <list>
 
@@ -206,6 +217,8 @@ Interface specific commands
    not returned in the specified time, it will be assumed the (S,G) or
    (\*,G) state :rfc:`7761#section-4.1` has timed out.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim interface <interface> igmp version <version-number>
 
    Use this command to define in the selected interface whether you
@@ -213,6 +226,8 @@ Interface specific commands
 
    The default value is 3.
 
+.. start_vyoslinter
+
 Example
 -------
 
diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst
index 62e96e0e..2527407e 100644
--- a/docs/configuration/service/conntrack-sync.rst
+++ b/docs/configuration/service/conntrack-sync.rst
@@ -56,6 +56,8 @@ Configuration
 
     Protocol for which expect entries need to be synchronized.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set service conntrack-sync failover-mechanism vrrp sync-group <group>
 
     Failover mechanism to use for conntrack-sync.
@@ -64,7 +66,10 @@ Configuration
 
 .. cfgcmd:: set service conntrack-sync ignore-address <x.x.x.x>
 
-    IP addresses or networks for which local conntrack entries will not be synced
+    IP addresses or networks for which local conntrack entries will not
+    be synced
+
+.. start_vyoslinter
 
 .. cfgcmd:: set service conntrack-sync interface <name>
 
@@ -147,8 +152,9 @@ Operation
   .. note::
   
     If the table is empty and you have a warning message, it means
-    conntrack is not enabled. To enable conntrack, just create a NAT or a firewall
-    rule. :cfgcmd:`set firewall state-policy established action accept`
+    conntrack is not enabled. To enable conntrack, just create a NAT
+    or a firewall rule.
+    :cfgcmd:`set firewall state-policy established action accept`
 
 .. opcmd:: show conntrack-sync cache external
 
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
index dc796fe8..30398a25 100644
--- a/docs/configuration/vpn/dmvpn.rst
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -64,9 +64,10 @@ To create NBMA GRE tunnel you might use the following:
 * Please refer to the :ref:`tunnel-interface` documentation for the individual
   tunnel related options.
 
-  .. note:: The IP-address is assigned as host prefix to tunnel interface.
-    NHRP will automatically create additional host routes pointing to tunnel interface
-    when a connection with these hosts is established.
+  .. note:: The IP-address is assigned as host prefix to tunnel
+    interface. NHRP will automatically create additional host routes
+    pointing to tunnel interface when a connection with these hosts is
+    established.
 
 The tunnel interface subnet prefix should be announced by routing protocol
 from the hub nodes (e.g. BGP ‘network’ announce). This allows the routing
@@ -112,46 +113,57 @@ NHRP protocol configuration
 
   * **network-id** - NHRP network id <1-4294967295>
 
-  Enable NHRP on this interface and set the interface’s network ID. The network ID
-  is used to allow creating multiple nhrp domains on a router when multiple interfaces
-  are configured on the router. Interfaces configured with the same ID are part of the
-  same logical NBMA network. The ID is a local only parameter and is not sent to other
-  NHRP nodes and so IDs on different nodes do not need to match. When NHRP packets are
-  received on an interface they are assigned to the local NHRP domain for that interface.
+  Enable NHRP on this interface and set the interface’s network ID.
+  The network ID is used to allow creating multiple nhrp domains on a
+  router when multiple interfaces are configured on the router.
+  Interfaces configured with the same ID are part of the same logical
+  NBMA network. The ID is a local only parameter and is not sent to
+  other NHRP nodes and so IDs on different nodes do not need to match.
+  When NHRP packets are received on an interface they are assigned to
+  the local NHRP domain for that interface.
+
+.. stop_vyoslinter
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> nhs tunnel-ip <tunnel-ip> nbma <nbma-ip>
 
   * **tunnel-ip** - Tunnel ip address in format **x.x.x.x** or **dynamic**
   * **nbma-ip** - NBMA ip address in format **x.x.x.x**
 
-  Configure the Next Hop Server address and its NBMA address. If dynamic is specified
-  then Next Hop Server can have dynamic address which maps to its NBMA address.
+  Configure the Next Hop Server address and its NBMA address. If
+  dynamic is specified then Next Hop Server can have dynamic address
+  which maps to its NBMA address.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> redirect
 
-  This enable redirect replies on the NHS similar to ICMP redirects except this is
-  managed by the nhrp protocol. This setting allows spokes to communicate with each
-  others directly.
+  This enable redirect replies on the NHS similar to ICMP redirects
+  except this is managed by the nhrp protocol. This setting allows
+  spokes to communicate with each others directly.
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> registration-no-unique
 
-  Allow the client to not set the unique flag in the NHRP packets. This is useful when
-  a station has a dynamic IP address that could change over time.
+  Allow the client to not set the unique flag in the NHRP packets.
+  This is useful when a station has a dynamic IP address that could
+  change over time.
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut
 
-  Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to each others directly
-  after establishing a connection without going through the hub.
+  Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to
+  each others directly after establishing a connection without going
+  through the hub.
 
 IPSEC configuration
 ==============================
 
-* Please refer to the :ref:`ipsec_general` documentation for the individual IPSec
-  related options.
+* Please refer to the :ref:`ipsec_general` documentation for the
+  individual IPSec related options.
 
-.. note:: NHRP daemon based on FRR nhrpd. It controls IPSEC. That's why 'close-action'
-  parameter in IKE configuration always is set to 'close' and 'dead-peer-detection action'
-  always is set to 'clear'.
+.. note:: NHRP daemon based on FRR nhrpd. It controls IPSEC. That's
+  why 'close-action' parameter in IKE configuration always is set to
+  'close' and 'dead-peer-detection action' always is set to 'clear'.
+
+.. stop_vyoslinter
 
 .. cfgcmd:: set vpn ipsec profile <profile-name> authentication mode pre-shared-secret
 
@@ -161,6 +173,8 @@ IPSEC configuration
 
   Set preshared secret
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec profile <profile-name> bind tunnel <tunnel name>
 
   Bind IPSEC profile to the specific tunnel interface.
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.rst b/docs/configuration/vpn/ipsec/ipsec_general.rst
index a9a1eb0f..3d21b81d 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.rst
+++ b/docs/configuration/vpn/ipsec/ipsec_general.rst
@@ -143,8 +143,9 @@ You can view the PPK column for information on if PPK is configured, and
 if it is in use. The output is in the format of ``<configured> / <in use>``. 
 The options for configured are none if not conifugred, opt if configured 
 but optional, and req is configured and required. The in use will show yes 
-Possible values of the ``configured`` field are ``none`` if not conifgured, ``opt`` if configured 
-but optional, and ``req`` is configured and required. The in use will show yes 
+Possible values of the ``configured`` field are ``none`` if not
+conifgured, ``opt`` if configured but optional, and ``req`` is
+configured and required. The in use will show yes
 
 
 
@@ -200,6 +201,8 @@ VyOS IKE group has the next options:
  * **aggressive** - Use Aggressive mode for Key Exchanges in the IKEv1
    protocol aggressive mode is much more insecure compared to Main mode.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> proposal <number> dh-group <dh-group number>
 
   Dh-group. Default value is **2**.
@@ -208,6 +211,8 @@ VyOS IKE group has the next options:
 
   Encryption algorithm. Default value is **aes128**.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> proposal <number> hash <hash>
 
   Hash algorithm. Default value is **sha1**.
@@ -232,10 +237,14 @@ DPD (Dead Peer Detection) Configuration
   * **restart** - Immediately tries to re-negotiate the CHILD_SA
     under a fresh IKE_SA.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> dead-peer-detection interval <interval>
 
   Keep-alive interval in seconds <2-86400> (default 30).
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> dead-peer-detection timeout <timeout>
 
   Keep-alive timeout in seconds <2-86400> (default 120) **IKEv1 only**
@@ -292,10 +301,14 @@ VyOS ESP group has the next options:
  * **disable** - Disable PFS.
  * **<dh-group>** - Defines a Diffie-Hellman group for PFS.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec esp-group <name> proposal <number> encryption <encryption>
 
   Encryption algorithm. Default value is **aes128**.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec esp-group <name> proposal <number> hash <hash>
 
   Hash algorithm. Default value is **sha1**.
@@ -351,7 +364,8 @@ Options
 IKEv2 Retransmission
 ====================
 
-If the peer does not respond on DPD packet, the router starts retransmission procedure.
+If the peer does not respond on DPD packet, the router starts the
+retransmission procedure.
 
 The following formula is used to calculate the timeout:
 
diff --git a/docs/configuration/vpn/ipsec/site2site_ipsec.rst b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
index 628b8e9d..9f8231e7 100644
--- a/docs/configuration/vpn/ipsec/site2site_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
@@ -78,7 +78,8 @@ Tunnel information:
     * If Route based VPN is used
         * IP of the VTI interface is 10.0.0.1/30
 
-.. note:: We do not recommend using policy-based vpn and route-based vpn configurations to the same peer.
+.. note:: We do not recommend using policy-based vpn and route-based
+   vpn configurations to the same peer.
 
 **1. Configure ike-group (IKE Phase 1)**
 
@@ -108,7 +109,8 @@ Tunnel information:
 
     set vpn ipsec interface eth0
 
-**4. Configure PSK keys and authentication ids for this key if authentication type is PSK**
+**4. Configure PSK keys and authentication ids for this key if
+authentication type is PSK**
 
 .. code-block:: none
 
@@ -146,14 +148,16 @@ To set base64 secret encode plaintext password to base64 and set secret-type
 
 **6. Depends to vpn type (route-based vpn or policy-based vpn).**
 
-   **6.1 For Policy-based VPN configure SAs using tunnel command specifying remote and local networks.**
+   **6.1 For Policy-based VPN configure SAs using tunnel command
+   specifying remote and local networks.**
 
     .. code-block:: none
 
         set vpn ipsec site-to-site peer PEER1 tunnel 1 local prefix '192.168.10.0/24'
         set vpn ipsec site-to-site peer PEER1 tunnel 1 remote prefix '192.168.50.0/24'
 
-   **6.2 For Route-based VPN create VTI interface, set IP address to this interface and bind this interface to the vpn peer.**
+   **6.2 For Route-based VPN create VTI interface, set IP address to
+   this interface and bind this interface to the vpn peer.**
 
     .. code-block:: none
 
@@ -243,6 +247,8 @@ Peer Authentication Commands
   address. Useful in case if the remote peer is behind NAT
   or if ``mode x509`` is used.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> authentication rsa local-key <key>
 
   Name of PKI key-pair with local private key.
@@ -270,6 +276,8 @@ Peer Authentication Commands
   Name of certificate in PKI configuration, which will be used
   for authenticating local router on remote peer.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec authentication x509 passphrase <passphrase>
 
   Private key passphrase, if needed.
@@ -370,6 +378,8 @@ Policy-Based CHILD SAs Configuration Commands
 
 Every configured tunnel under peer configuration is a new CHILD SA.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> tunnel <number> disable
 
   Disable this tunnel.
@@ -406,6 +416,8 @@ Every configured tunnel under peer configuration is a new CHILD SA.
   Remote port number. Have effect only when used together with
   ``prefix``.
 
+.. start_vyoslinter
+
 Route-Based CHILD SAs Configuration Commands
 """""""""""""""""""""""""""""""""""""""""""""
 
@@ -435,6 +447,8 @@ for each remote network.
 Traffic-selectors parameters for traffic that should pass via vti
 interface.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> vti traffic-selector local prefix <network>
 
   Local prefix for interesting traffic.
@@ -443,6 +457,8 @@ interface.
 
   Remote prefix for interesting traffic.
 
+.. start_vyoslinter
+
 IPsec Op-mode Commands
 ======================
 
diff --git a/docs/configuration/vrf/index.rst b/docs/configuration/vrf/index.rst
index d8b81bac..5965f857 100644
--- a/docs/configuration/vrf/index.rst
+++ b/docs/configuration/vrf/index.rst
@@ -20,8 +20,8 @@ then enslaved to a VRF device.
 
 .. cfgcmd:: set vrf name <name> table <id>
 
-   Create a new VRF instance with `<name>` and `<id>`. The name is used when placing
-   individual interfaces into the VRF.
+   Create a new VRF instance with `<name>` and `<id>`. The name is
+   used when placing individual interfaces into the VRF.
 
    .. note:: A routing table ID can not be modified once it is assigned. It can
       only be changed by deleting and re-adding the VRF instance.
@@ -66,9 +66,10 @@ can be used to filter which routes zebra will install in the kernel.
 Nexthop Tracking
 ----------------
 
-Nexthop tracking resolve nexthops via the default route by default. This is enabled
-by default for a traditional profile of FRR which we use. It and can be disabled if
-you do not want to e.g. allow BGP to peer across the default route.
+Nexthop tracking resolve nexthops via the default route by default.
+This is enabled by default for a traditional profile of FRR which we
+use. It and can be disabled if you do not want to e.g. allow BGP to
+peer across the default route.
 
 .. cfgcmd:: set vrf name <name> ip nht no-resolve-via-default
 
@@ -230,8 +231,8 @@ For VRF maintenance the following operational commands are in place.
    the round-trip time of these packets is used in calculating the minimum/
    average/maximum round-trip time numbers.
 
-   .. note:: Ping command can be interrupted at any given time using ``<Ctrl>+c``.
-     A brief statistic is shown afterwards.
+   .. note:: Ping command can be interrupted at any given time using
+     ``<Ctrl>+c``. A brief statistic is shown afterwards.
 
    .. code-block:: none
 
@@ -535,9 +536,9 @@ address-family.
 .. cfgcmd:: set vrf name <name> protocols bgp interface <interface> mpls
             forwarding
 
-   It is possible to permit BGP install VPN prefixes without transport labels.
-   This configuration will install VPN prefixes originated from an e-bgp session,
-   and with the next-hop directly connected.
+   It is possible to permit BGP install VPN prefixes without transport
+   labels. This configuration will install VPN prefixes originated
+   from an e-bgp session, and with the next-hop directly connected.
 
 .. _l3vpn-vrf example operation:
 
-- 
cgit v1.2.3