From efd6ea180ad96a82ee8b0cc38582a9d505e794fb Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 15 Apr 2026 12:08:34 +0300 Subject: perf: convert all images to WebP with PDF fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction). Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds use WebP while PDF/LaTeX builds fall back to original PNG/JPG. Co-Authored-By: Claude Opus 4.6 (1M context) --- docs/installation/bare-metal.rst | 52 +++++++++++++++++------------------ docs/installation/cloud/aws.rst | 16 +++++------ docs/installation/cloud/azure.rst | 12 ++++---- docs/installation/cloud/gcp.rst | 10 +++---- docs/installation/install.rst | 2 +- docs/installation/secure-boot.rst | 14 +++++----- docs/installation/virtual/gns3.rst | 42 ++++++++++++++-------------- docs/installation/virtual/libvirt.rst | 22 +++++++-------- 8 files changed, 85 insertions(+), 85 deletions(-) (limited to 'docs/installation') diff --git a/docs/installation/bare-metal.rst b/docs/installation/bare-metal.rst index be5f9342..5e5e9e90 100644 --- a/docs/installation/bare-metal.rst +++ b/docs/installation/bare-metal.rst @@ -37,39 +37,39 @@ motherboard). Pictures -------- -.. figure:: /_static/images/1u_vyos_back.jpg +.. figure:: /_static/images/1u_vyos_back.* :scale: 25 % :alt: CSE-505-203B Back -.. figure:: /_static/images/1u_vyos_front.jpg +.. figure:: /_static/images/1u_vyos_front.* :scale: 25 % :alt: CSE-505-203B Front -.. figure:: /_static/images/1u_vyos_front_open_1.jpg +.. figure:: /_static/images/1u_vyos_front_open_1.* :scale: 25 % :alt: CSE-505-203B Open 1 -.. figure:: /_static/images/1u_vyos_front_open_2.jpg +.. figure:: /_static/images/1u_vyos_front_open_2.* :scale: 25 % :alt: CSE-505-203B Open 2 -.. figure:: /_static/images/1u_vyos_front_open_3.jpg +.. figure:: /_static/images/1u_vyos_front_open_3.* :scale: 25 % :alt: CSE-505-203B Open 3 -.. figure:: /_static/images/1u_vyos_front_10ge_open_1.jpg +.. figure:: /_static/images/1u_vyos_front_10ge_open_1.* :scale: 25 % :alt: CSE-505-203B w/ 10GE Open 1 -.. figure:: /_static/images/1u_vyos_front_10ge_open_2.jpg +.. figure:: /_static/images/1u_vyos_front_10ge_open_2.* :scale: 25 % :alt: CSE-505-203B w/ 10GE Open 2 -.. figure:: /_static/images/1u_vyos_front_10ge_open_3.jpg +.. figure:: /_static/images/1u_vyos_front_10ge_open_3.* :scale: 25 % :alt: CSE-505-203B w/ 10GE Open 3 -.. figure:: /_static/images/1u_vyos_front_10ge_open_4.jpg +.. figure:: /_static/images/1u_vyos_front_10ge_open_4.* :scale: 25 % :alt: CSE-505-203B w/ 10GE Open @@ -202,49 +202,49 @@ Pictures Rack Mount ^^^^^^^^^^ -.. figure:: /_static/images/apu4_rack_1.jpg +.. figure:: /_static/images/apu4_rack_1.* :scale: 25 % :alt: APU4 rack closed -.. figure:: /_static/images/apu4_rack_2.jpg +.. figure:: /_static/images/apu4_rack_2.* :scale: 25 % :alt: APU4 rack front -.. figure:: /_static/images/apu4_rack_3.jpg +.. figure:: /_static/images/apu4_rack_3.* :scale: 25 % :alt: APU4 rack module #1 -.. figure:: /_static/images/apu4_rack_4.jpg +.. figure:: /_static/images/apu4_rack_4.* :scale: 25 % :alt: APU4 rack module #2 -.. figure:: /_static/images/apu4_rack_5.jpg +.. figure:: /_static/images/apu4_rack_5.* :scale: 25 % :alt: APU4 rack module #3 with PSU VyOS custom print """"""""""""""""" -.. figure:: /_static/images/apu4_rack_vyos_print.jpg +.. figure:: /_static/images/apu4_rack_vyos_print.* :scale: 25 % :alt: APU4 custom VyOS powder coat Desktop / Bench Top ^^^^^^^^^^^^^^^^^^^ -.. figure:: /_static/images/apu4_desk_1.jpg +.. figure:: /_static/images/apu4_desk_1.* :scale: 25 % :alt: APU4 desktop closed -.. figure:: /_static/images/apu4_desk_2.jpg +.. figure:: /_static/images/apu4_desk_2.* :scale: 25 % :alt: APU4 desktop closed -.. figure:: /_static/images/apu4_desk_3.jpg +.. figure:: /_static/images/apu4_desk_3.* :scale: 25 % :alt: APU4 desktop back -.. figure:: /_static/images/apu4_desk_4.jpg +.. figure:: /_static/images/apu4_desk_4.* :scale: 25 % :alt: APU4 desktop back @@ -304,7 +304,7 @@ HDMI mode. Partaker i5 =========== -.. figure:: ../_static/images/600px-Partaker-i5.jpg +.. figure:: ../_static/images/600px-Partaker-i5.* I believe this is actually the same hardware as the Protectli. I purchased it in June 2018. It came pre-loaded with pfSense. @@ -330,9 +330,9 @@ port is eth0 and the right-most "LAN1" port is eth3. Acrosser AND-J190N1 =================== -.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Front.jpg +.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Front.* -.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Back.jpg +.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Back.* This microbox network appliance was build to create OpenVPN bridges. It can saturate a 100Mbps link. It is a small (serial console only) PC with 6 Gb LAN @@ -403,13 +403,13 @@ Optional (WiFi + WWAN) Pictures -------- -.. figure:: ../_static/images/gowin-01.png +.. figure:: ../_static/images/gowin-01.* -.. figure:: ../_static/images/gowin-02.png +.. figure:: ../_static/images/gowin-02.* -.. figure:: ../_static/images/gowin-03.png +.. figure:: ../_static/images/gowin-03.* -.. figure:: ../_static/images/gowin-04.png +.. figure:: ../_static/images/gowin-04.* Cooling ------- diff --git a/docs/installation/cloud/aws.rst b/docs/installation/cloud/aws.rst index 2901b6d1..89f4a152 100644 --- a/docs/installation/cloud/aws.rst +++ b/docs/installation/cloud/aws.rst @@ -11,38 +11,38 @@ Deploy VyOS on Amazon :abbr:`AWS (Amazon Web Services)`. 1. Click **Instances** and then click **Launch Instance**. -.. figure:: /_static/images/cloud-aws-01.png +.. figure:: /_static/images/cloud-aws-01.* 2. Search for "VyOS" in the Marketplace. -.. figure:: /_static/images/cloud-aws-02.png +.. figure:: /_static/images/cloud-aws-02.* 3. Choose the instance type. The recommended minimum is ``m3.medium``. -.. figure:: /_static/images/cloud-aws-03.png +.. figure:: /_static/images/cloud-aws-03.* 4. Configure the instance for your requirements. Select the number of instances, network, and subnet. -.. figure:: /_static/images/cloud-aws-04.png +.. figure:: /_static/images/cloud-aws-04.* 5. Configure additional storage. You can remove the additional storage ``/dev/sdb``. The root device will be ``/dev/xvda``. You can skip this step. -.. figure:: /_static/images/cloud-aws-05.png +.. figure:: /_static/images/cloud-aws-05.* 6. Configure the security group. We recommend configuring SSH access only from specific sources, or you can permit any IP address (the default). -.. figure:: /_static/images/cloud-aws-06.png +.. figure:: /_static/images/cloud-aws-06.* 7. Select the SSH key pair and click **Launch Instances**. -.. figure:: /_static/images/cloud-aws-07.png +.. figure:: /_static/images/cloud-aws-07.* 8. Note your public IP address. -.. figure:: /_static/images/cloud-aws-08.png +.. figure:: /_static/images/cloud-aws-08.* 9. Connect to the instance using your SSH key. diff --git a/docs/installation/cloud/azure.rst b/docs/installation/cloud/azure.rst index 77d00814..f77c9bee 100644 --- a/docs/installation/cloud/azure.rst +++ b/docs/installation/cloud/azure.rst @@ -14,28 +14,28 @@ Deploy VyOS on Azure. 2. Choose a VM name, resource group, and region, then click **Browse all public and private images**. -.. figure:: /_static/images/cloud-azure-01.png +.. figure:: /_static/images/cloud-azure-01.* 3. Search for "VyOS" in the marketplace and choose the appropriate subscription. -.. figure:: /_static/images/cloud-azure-02.png +.. figure:: /_static/images/cloud-azure-02.* 4. Generate new SSH key pair or use existing. -.. figure:: /_static/images/cloud-azure-03.png +.. figure:: /_static/images/cloud-azure-03.* 5. Configure the network, subnet, and public IP. Or use the defaults. -.. figure:: /_static/images/cloud-azure-04.png +.. figure:: /_static/images/cloud-azure-04.* 6. Click **Review + create**. Your deployment completes in a few seconds. -.. figure:: /_static/images/cloud-azure-05.png +.. figure:: /_static/images/cloud-azure-05.* 7. Select your new VM and note your public IP address. -.. figure:: /_static/images/cloud-azure-06.png +.. figure:: /_static/images/cloud-azure-06.* 8. Connect to the instance with your SSH key. diff --git a/docs/installation/cloud/gcp.rst b/docs/installation/cloud/gcp.rst index f6b6732b..7d70e007 100644 --- a/docs/installation/cloud/gcp.rst +++ b/docs/installation/cloud/gcp.rst @@ -25,27 +25,27 @@ To deploy VyOS on Google Cloud Platform (GCP): 2. Open the GCP Console and navigate to **Metadata**. Select **SSH Keys** and click **Edit**. -.. figure:: /_static/images/cloud-gcp-01.png +.. figure:: /_static/images/cloud-gcp-01.* Click **Add item**, paste your public SSH key, and click **Save**. -.. figure:: /_static/images/cloud-gcp-02.png +.. figure:: /_static/images/cloud-gcp-02.* 3. Search for "VyOS" in the Marketplace. 4. Configure the deployment name, zone, and machine type, then click **Deploy**. -.. figure:: /_static/images/cloud-gcp-03.png +.. figure:: /_static/images/cloud-gcp-03.* 5. After a few seconds, select your **instance**. -.. figure:: /_static/images/cloud-gcp-04.png +.. figure:: /_static/images/cloud-gcp-04.* 6. Note your external IP address. -.. figure:: /_static/images/cloud-gcp-05.png +.. figure:: /_static/images/cloud-gcp-05.* 7. Connect to the instance using the SSH key you generated in step 1. diff --git a/docs/installation/install.rst b/docs/installation/install.rst index 80e4a5f6..b820659b 100644 --- a/docs/installation/install.rst +++ b/docs/installation/install.rst @@ -93,7 +93,7 @@ downloads. used to deploy VyOS on KVM environments. This image includes cloud-init support. See :ref:`cloud-init` for more information. -.. figure:: /_static/images/vyosnew-downloads.png +.. figure:: /_static/images/vyosnew-downloads.* Building from source -------------------- diff --git a/docs/installation/secure-boot.rst b/docs/installation/secure-boot.rst index 1dd6713b..b0912f00 100644 --- a/docs/installation/secure-boot.rst +++ b/docs/installation/secure-boot.rst @@ -43,7 +43,7 @@ previously generated :abbr:`MOK (Machine Owner Key)` to the system. First, disable UEFI Secure Boot for the installation. -.. figure:: /_static/images/uefi_secureboot_01.png +.. figure:: /_static/images/uefi_secureboot_01.* :alt: Disable UEFI secure boot Proceed with the standard VyOS :ref:`installation ` on @@ -61,30 +61,30 @@ password after reboot when MOK Manager launches to permanently install the keys. With the next reboot, MOK Manager will automatically launch -.. figure:: /_static/images/uefi_secureboot_02.png +.. figure:: /_static/images/uefi_secureboot_02.* :alt: Disable UEFI secure boot Select ``Enroll MOK`` -.. figure:: /_static/images/uefi_secureboot_03.png +.. figure:: /_static/images/uefi_secureboot_03.* :alt: Disable UEFI secure boot You can now view the key to be installed and continue with key installation. -.. figure:: /_static/images/uefi_secureboot_04.png +.. figure:: /_static/images/uefi_secureboot_04.* :alt: Disable UEFI secure boot -.. figure:: /_static/images/uefi_secureboot_05.png +.. figure:: /_static/images/uefi_secureboot_05.* :alt: Disable UEFI secure boot Now you need to enter the password you defined previously. -.. figure:: /_static/images/uefi_secureboot_06.png +.. figure:: /_static/images/uefi_secureboot_06.* :alt: Disable UEFI secure boot Now reboot and re-enable UEFI Secure Boot. -.. figure:: /_static/images/uefi_secureboot_07.png +.. figure:: /_static/images/uefi_secureboot_07.* :alt: Disable UEFI secure boot VyOS will now launch in UEFI Secure Boot mode. You can verify this by running diff --git a/docs/installation/virtual/gns3.rst b/docs/installation/virtual/gns3.rst index 31bb6887..2c0b5224 100644 --- a/docs/installation/virtual/gns3.rst +++ b/docs/installation/virtual/gns3.rst @@ -35,54 +35,54 @@ in GNS3. Go to the GNS3 **File** menu, click **New template**, and select **Manually create a new Template**. -.. figure:: /_static/images/gns3-01.png +.. figure:: /_static/images/gns3-01.* Select **Qemu VMs** and then click the ``New`` button. -.. figure:: /_static/images/gns3-02.png +.. figure:: /_static/images/gns3-02.* Write a name for your VM, such as "VyOS", and click ``Next``. -.. figure:: /_static/images/gns3-03.png +.. figure:: /_static/images/gns3-03.* Select **qemu-system-x86_64** as Quemu binary, then **512MB** of RAM and click ``Next``. -.. figure:: /_static/images/gns3-04.png +.. figure:: /_static/images/gns3-04.* Select **telnet** as your console type and click ``Next``. -.. figure:: /_static/images/gns3-05.png +.. figure:: /_static/images/gns3-05.* Select **New image** for the base disk image of your VM and click ``Create``. -.. figure:: /_static/images/gns3-06.png +.. figure:: /_static/images/gns3-06.* Use the defaults in the **Binary and format** window and click ``Next``. -.. figure:: /_static/images/gns3-07.png +.. figure:: /_static/images/gns3-07.* Use the defaults in the **Qcow2 options** window and click ``Next``. -.. figure:: /_static/images/gns3-08.png +.. figure:: /_static/images/gns3-08.* Set the disk size to 2000 MiB, and click ``Finish`` to end the **Quemu image creator**. -.. figure:: /_static/images/gns3-09.png +.. figure:: /_static/images/gns3-09.* Click ``Finish`` to end the **New QEMU VM template** wizard. -.. figure:: /_static/images/gns3-10.png +.. figure:: /_static/images/gns3-10.* Now you need to edit the VM settings. In the **Preferences** window, with **Qemu VMs** selected and your new VM selected, click the ``Edit`` button. -.. figure:: /_static/images/gns3-11.png +.. figure:: /_static/images/gns3-11.* In the **General settings** tab of your **QEMU VM template configuration**, do the following: @@ -92,17 +92,17 @@ configuration**, do the following: * In **Category** select in which group you want to find your VM. * Set the **Boot priority** to **CD/DVD-ROM**. -.. figure:: /_static/images/gns3-12.png +.. figure:: /_static/images/gns3-12.* At the **HDD** tab, change the Disk interface to **sata** to speed up the boot process. -.. figure:: /_static/images/gns3-13.png +.. figure:: /_static/images/gns3-13.* At the **CD/DVD** tab click on ``Browse...`` and locate the VyOS image you want to install. -.. figure:: /_static/images/gns3-14.png +.. figure:: /_static/images/gns3-14.* .. note:: You probably will want to accept to copy the .iso file to your default image directory when you are asked. @@ -111,17 +111,17 @@ In the **Network** tab, set the number of adapters to **0**, set the **Name format** to **eth{0}**, and set the **Type** to **Paravirtualized Network I/O (virtio-net-pci)**. -.. figure:: /_static/images/gns3-15.png +.. figure:: /_static/images/gns3-15.* In the **Advanced** tab, unmark the checkbox **Use as a linked base VM** and click ``OK``, which will save and close the **QEMU VM template configuration** window. -.. figure:: /_static/images/gns3-16.png +.. figure:: /_static/images/gns3-16.* At the general **Preferences** window, click ``OK`` to save and close. -.. figure:: /_static/images/gns3-17.png +.. figure:: /_static/images/gns3-17.* .. _vyos_installation: @@ -157,21 +157,21 @@ necessary as outlined below: **General settings** tab: Set the boot priority to **HDD** -.. figure:: /_static/images/gns3-20.png +.. figure:: /_static/images/gns3-20.* **CD/DVD** tab: Clear the **Image** entry field to unmount the installation image. -.. figure:: /_static/images/gns3-21.png +.. figure:: /_static/images/gns3-21.* Set the number of required network adapters. For example, set it to **4**. -.. figure:: /_static/images/gns3-215.png +.. figure:: /_static/images/gns3-215.* **Advanced** settings tab: Check the **Use as a linked base VM** checkbox and click ``OK`` to save the changes. -.. figure:: /_static/images/gns3-22.png +.. figure:: /_static/images/gns3-22.* The VyOS VM is now ready to be deployed. diff --git a/docs/installation/virtual/libvirt.rst b/docs/installation/virtual/libvirt.rst index 20b3ff1a..5da1503f 100644 --- a/docs/installation/virtual/libvirt.rst +++ b/docs/installation/virtual/libvirt.rst @@ -123,28 +123,28 @@ Deploy from ISO 2. Choose ``Local install media`` (ISO) -.. figure:: /_static/images/virt-libvirt-01.png +.. figure:: /_static/images/virt-libvirt-01.* 3. Choose the path to the VyOS ISO image. Select any Debian-based operating system. -.. figure:: /_static/images/virt-libvirt-02.png +.. figure:: /_static/images/virt-libvirt-02.* 4. Choose Memory and CPU -.. figure:: /_static/images/virt-libvirt-03.png +.. figure:: /_static/images/virt-libvirt-03.* 5. Disk size -.. figure:: /_static/images/virt-libvirt-04.png +.. figure:: /_static/images/virt-libvirt-04.* 6. Name of VM and network selection -.. figure:: /_static/images/virt-libvirt-05.png +.. figure:: /_static/images/virt-libvirt-05.* 7. Then the system will be taken to the console. -.. figure:: /_static/images/virt-libvirt-06.png +.. figure:: /_static/images/virt-libvirt-06.* .. _libvirt:virt-manager_qcow2: @@ -163,24 +163,24 @@ Download the predefined VyOS ``.qcow2`` image. 2. Choose ``Import existing disk`` image -.. figure:: /_static/images/virt-libvirt-qc-01.png +.. figure:: /_static/images/virt-libvirt-qc-01.* 3. Choose the path to the ``vyos_kvm.qcow2`` image that you downloaded. Select any Debian-based operating system. -.. figure:: /_static/images/virt-libvirt-qc-02.png +.. figure:: /_static/images/virt-libvirt-qc-02.* 4. Choose Memory and CPU -.. figure:: /_static/images/virt-libvirt-03.png +.. figure:: /_static/images/virt-libvirt-03.* 5. Name of VM and network selection -.. figure:: /_static/images/virt-libvirt-05.png +.. figure:: /_static/images/virt-libvirt-05.* 6. Then the system will be taken to the console. -.. figure:: /_static/images/virt-libvirt-qc-03.png +.. figure:: /_static/images/virt-libvirt-qc-03.* -- cgit v1.2.3 From d0a0fd4998b35af5b4e59374a5706ffeb27c7ee5 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 21 Apr 2026 20:35:22 +0300 Subject: fix: resolve all line-length lint warnings across 14 RST files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wrap prose lines exceeding 80 chars and apply stop/start_vyoslinter markers around cfgcmd/opcmd directive lines that cannot be shortened (e.g. long option names with placeholder arguments). Affected files: bonding, wireguard, pim, conntrack-sync, dmvpn, ipsec_general, site2site_ipsec, vrf/index, bare-metal, inter-vrf-routing-vrf-lite, lac-lns, tunnelbroker, OpenVPN_with_LDAP, dmvpn-dualhub-dualcloud. 🤖 Generated by [robots](https://vyos.io) --- .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst | 17 +- .../autotest/tunnelbroker/tunnelbroker.rst | 14 +- docs/configexamples/dmvpn-dualhub-dualcloud.rst | 39 ++- docs/configexamples/inter-vrf-routing-vrf-lite.rst | 3 +- docs/configexamples/lac-lns.rst | 3 +- docs/configuration/interfaces/bonding.rst | 334 ++++++++++++--------- docs/configuration/interfaces/wireguard.rst | 39 ++- docs/configuration/protocols/pim.rst | 39 ++- docs/configuration/service/conntrack-sync.rst | 12 +- docs/configuration/vpn/dmvpn.rst | 60 ++-- docs/configuration/vpn/ipsec/ipsec_general.rst | 20 +- docs/configuration/vpn/ipsec/site2site_ipsec.rst | 24 +- docs/configuration/vrf/index.rst | 21 +- docs/installation/bare-metal.rst | 3 +- 14 files changed, 383 insertions(+), 245 deletions(-) (limited to 'docs/installation') diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst index 0ddd7e3e..ae997905 100644 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst @@ -39,14 +39,22 @@ Here are some PowerShell commands to quickly add a Test Active Directory. Configure VyOS as OpenVPN Server ==================================== -In this example OpenVPN will be setup with a client certificate and username / password authentication. +In this example OpenVPN will be setup with a client certificate and +username / password authentication. -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look :ref:`here ` for more information. +First a CA, a signed server and client ceftificate and a +Diffie-Hellman parameter musst be generated and installed. +Please look :ref:`here ` for more +information. | Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` + +.. stop_vyoslinter + | Check all possible settings `here `_ +.. start_vyoslinter + .. literalinclude:: _include/ldap-auth.config :language: none @@ -93,7 +101,8 @@ OpenVPN Server configuration can be carried out. Client configuration ==================== -One advantage of having the client certificate stored is the ability to create the client configuration. +One advantage of having the client certificate stored is the ability to +create the client configuration. .. code-block:: none diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst index a14a3199..e34cb779 100644 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst @@ -220,9 +220,11 @@ Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, Firewall ======== -Finally, don't forget the :ref:`Firewall`. The usage is identical, except for -instead of `set firewall ipv4 name NAME`, you would use `set firewall ipv6 name -NAME`. - -Similarly, to attach the firewall, you would use `set firewall ipv6 name NAME rule N inbound-interface name eth0` or `set firewall zone LOCAL from WAN firewall -ipv6-name`. +Finally, don't forget the +:ref:`Firewall`. The usage is +identical, except instead of `set firewall ipv4 name NAME`, you would +use `set firewall ipv6 name NAME`. + +Similarly, to attach the firewall, you would use +`set firewall ipv6 name NAME rule N inbound-interface name eth0` or +`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst index 7bcfcf84..a3a4e619 100644 --- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst +++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst @@ -6,11 +6,12 @@ DMVPN Dual HUB Dual Cloud ######################### -This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3. +This document is to describe a basic setup to build DVMPN network with +two Hubs and two clouds using DMVPN Phase3. OSPF is used as routing protocol inside DMVPN. -In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) -as a Spoke. +In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, +SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke. Network Topology ================ @@ -80,9 +81,12 @@ Spoke-3 NHRP configuration __________________ -The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE -multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub. -In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud. +The next step is to configure the NHRP protocol. In a Dual cloud +network, every HUB has to be configured with one GRE multipoint tunnel +interface and every spoke has to be configured with two tunnel +interfaces, one tunnel to each hub. +In this example tunnel networks are 10.100.100.0/24 for the first cloud +and 10.100.101.0/24 for the second cloud. But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. HUB-1 @@ -211,8 +215,10 @@ Spoke-3 Overlay configuration _____________________ -The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol. -But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol. +The last step is to configure the routing protocol. In this scenario, +OSPF was chosen as the dynamic routing protocol. +But you can use iBGP or eBGP. To form fast convergence it is possible +to use BFD protocol. HUB-1 @@ -378,7 +384,8 @@ SPOKE-1 Monitoring ========== -All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF. +All spokes created IPSec tunnels to Hubs, are registered on Hubs using +NHRP protocol and formed adjacency in OSPF. .. code-block:: none @@ -468,7 +475,8 @@ For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. -Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES. +Now routing tables are changed. LAN networks 192.168.12.0/24 and +192.168.11.0/24 available directly via SPOKES. .. code-block:: none @@ -541,8 +549,11 @@ A new Spoke to Spoke IPSec tunnel is created Summary ======= -If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role. -This is a simple example where only one internet connection is used. But in the real world, there can be two -connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection, -choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level +If one of the Hubs loses connectivity to the Internet, the other Hub +will be available and take the main role. +This is a simple example where only one internet connection is used. +But in the real world, there can be two connections to the Internet. +In this case, there is a recommendation to build each tunnel via each +Internet connection, choose the main cloud, and manipulate traffic via +a routing protocol. It allows the creation failover on link-level connections too. \ No newline at end of file diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index 36dabd73..1f02da8e 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -16,7 +16,8 @@ where you might need that some network can access other in a different VRF. The scope of this document is to cover such cases in a dynamic way without the use of MPLS-LDP. -General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. +General information about L3VPNs can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. ******** Overview diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index f622b48f..5f344d54 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -101,7 +101,8 @@ LNS .. start_vyoslinter .. note:: This setup requires the Compression Control Protocol (CCP) - being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` + being disabled, the command + ``set vpn l2tp remote-access ppp-options disable-ccp`` accomplishes that. Client diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst index 187720a9..7637790c 100644 --- a/docs/configuration/interfaces/bonding.rst +++ b/docs/configuration/interfaces/bonding.rst @@ -62,20 +62,23 @@ Bond modes :widths: 20 80 * - **Description:** - - IEEE 802.3ad Dynamic Link Aggregation. Groups only member interfaces with - the same speed (e.g., 1 Gbps) and duplex settings. Member interfaces with - different speed and duplex settings are not included in the active bond. - - Provides load balancing and fault tolerance. Uses the :abbr:`LACP (Link - Aggregation Control Protocol)` to negotiate the bond with the switch. + - IEEE 802.3ad Dynamic Link Aggregation. Groups only member + interfaces with the same speed (e.g., 1 Gbps) and duplex + settings. Member interfaces with different speed and duplex + settings are not included in the active bond. + + Provides load balancing and fault tolerance. Uses the + :abbr:`LACP (Link Aggregation Control Protocol)` to + negotiate the bond with the switch. * - **Traffic distribution:** - - Traffic is distributed according to the **transmit hash policy** - (default: XOR). - - The bonding driver applies an XOR operation to specific packet header fields, - generating a hash value that maps to a particular member interface. This - ensures the same network flow is consistently transmitted over the same member - interface. + - Traffic is distributed according to the **transmit hash + policy** (default: XOR). + + The bonding driver applies an XOR operation to specific + packet header fields, generating a hash value that maps to + a particular member interface. This ensures the same network + flow is consistently transmitted over the same member + interface. The transmit hash policy is configured via the ``hash-policy`` option. * - **Failover:** @@ -92,15 +95,16 @@ Bond modes :widths: 20 80 * - **Description:** - - Provides fault tolerance. Only one member interface is active at a time. - Other member interfaces remain in a standby mode. - * - **Traffic distribution:** - - All traffic (incoming and outgoing) is routed via one active member interface. - * - **Failover:** - - If the designated member interface fails, all traffic is routed to - another member interface. The bonding driver sends a Gratuitous ARP - to update the peer's MAC address table, linking the bond's MAC address - to another physical port. + - Provides fault tolerance. Only one member interface is active + at a time. Other member interfaces remain in a standby mode. + * - **Traffic distribution:** + - All traffic (incoming and outgoing) is routed via one active + member interface. + * - **Failover:** + - If the designated member interface fails, all traffic is + routed to another member interface. The bonding driver sends + a Gratuitous ARP to update the peer's MAC address table, + linking the bond's MAC address to another physical port. * ``broadcast`` @@ -109,11 +113,12 @@ Bond modes * - **Description:** - Provides maximum fault tolerance by duplicating traffic. - * - **Traffic distribution:** - - Every packet is duplicated and transmitted on **all** member interfaces. - * - **Failover:** - - Traffic flow is not interrupted as long as at least one member interface - remains active. + * - **Traffic distribution:** + - Every packet is duplicated and transmitted on **all** member + interfaces. + * - **Failover:** + - Traffic flow is not interrupted as long as at least one + member interface remains active. * ``round-robin`` @@ -122,12 +127,13 @@ Bond modes * - **Description:** - Provides load balancing and fault tolerance. - * - **Traffic distribution:** - - Packets are transmitted in sequential order across the member interfaces - (e.g., packet 1 > interface A, packet 2 > interface B, etc.). - * - **Failover:** - - If a member interface fails, the sequence skips the failed interface and - continues with the remaining active members. + * - **Traffic distribution:** + - Packets are transmitted in sequential order across the member + interfaces (e.g., packet 1 > interface A, packet 2 > + interface B, etc.). + * - **Failover:** + - If a member interface fails, the sequence skips the failed + interface and continues with the remaining active members. * ``transmit-load-balance`` @@ -136,14 +142,15 @@ Bond modes * - **Description:** - Provides adaptive transmit load balancing and fault tolerance. - * - **Traffic distribution:** - - **Outgoing:** Distributed across all active member interfaces based on - the current load. + * - **Traffic distribution:** + - **Outgoing:** Distributed across all active member interfaces + based on the current load. - **Incoming:** Received by a designated member interface (active receiver). - * - **Failover:** - - If the active receiver fails, another member interface takes over as the new - active receiver. + **Incoming:** Received by a designated member interface + (active receiver). + * - **Failover:** + - If the active receiver fails, another member interface takes + over as the new active receiver. * ``adaptive-load-balance`` @@ -151,75 +158,88 @@ Bond modes :widths: 20 80 * - **Description:** - - Provides adaptive transmit load balancing identical to - ``transmit-load-balance``, receive load balancing for IPv4 traffic, and fault - tolerance for both incoming and outgoing traffic. + - Provides adaptive transmit load balancing identical to + ``transmit-load-balance``, receive load balancing for IPv4 + traffic, and fault tolerance for both incoming and outgoing + traffic. * - **Traffic distribution:** - **Outgoing:** Identical to ``transmit-load-balance``. - **Incoming:** Distributed based on ARP manipulation. For both local and remote - connections, the bonding driver intercepts ARP traffic and changes the source - MAC address to the MAC address of the least loaded member interface. + **Incoming:** Distributed based on ARP manipulation. For + both local and remote connections, the bonding driver + intercepts ARP traffic and changes the source MAC address + to the MAC address of the least loaded member interface. - All traffic from that peer is then routed to the chosen member interface. + All traffic from that peer is then routed to the chosen + member interface. * - **Failover:** - - If a member interface's state changes (fails, recovers, is added, or excluded), - the traffic is redistributed among all active member interfaces. + - If a member interface's state changes (fails, recovers, is + added, or excluded), the traffic is redistributed among all + active member interfaces. - * ``xor-hash``: Provides load balancing and fault tolerance based on a hash formula. - Distributes traffic and handles failover identically to ``802.3ad``, but operates - without the :abbr:`LACP (Link Aggregation Control Protocol)`. + * ``xor-hash``: Provides load balancing and fault tolerance + based on a hash formula. Distributes traffic and handles + failover identically to ``802.3ad``, but operates without + the :abbr:`LACP (Link Aggregation Control Protocol)`. .. cfgcmd:: set interfaces bonding min-links <0-16> - **Configure how many member interfaces must be active (in the link-up state) to - mark the bonding interface UP (carrier asserted).** + **Configure how many member interfaces must be active (in the + link-up state) to mark the bonding interface UP (carrier + asserted).** - This command applies only when the bonding interface is configured in 802.3ad - mode and functions like the Cisco EtherChannel min-links feature. It ensures - that a bonding interface is marked UP (carrier asserted) only when a specified - number of member interfaces are active (in the link-up state). This helps - guarantee a minimum level of bandwidth for higher-level services (such as - clustering) relying on the bonding interface. + This command applies only when the bonding interface is configured + in 802.3ad mode and functions like the Cisco EtherChannel min-links + feature. It ensures that a bonding interface is marked UP (carrier + asserted) only when a specified number of member interfaces are + active (in the link-up state). This helps guarantee a minimum level + of bandwidth for higher-level services (such as clustering) relying + on the bonding interface. - The default value is 0. This marks the bonding interface UP (carrier asserted) - whenever an active LACP aggregator exists, regardless of the number of member - interfaces in that aggregator. + The default value is 0. This marks the bonding interface UP + (carrier asserted) whenever an active LACP aggregator exists, + regardless of the number of member interfaces in that aggregator. - .. note:: In 802.3ad mode, a bond cannot be active without at least one active - member interface. Therefore, setting min-links to 0 or 1 has the same result: - the bonding interface is marked UP (carrier asserted). + .. note:: In 802.3ad mode, a bond cannot be active without at + least one active member interface. Therefore, setting min-links + to 0 or 1 has the same result: the bonding interface is marked + UP (carrier asserted). .. cfgcmd:: set interfaces bonding lacp-rate - **Configure the rate at which the bonding interface requests its link - partner to send** :abbr:`LACPDUs (Link Aggregation Control Protocol Data - Units)` **in 802.3ad mode.** + **Configure the rate at which the bonding interface requests its + link partner to send** + :abbr:`LACPDUs (Link Aggregation Control Protocol Data Units)` + **in 802.3ad mode.** - This command applies only when the bonding interface is configured in - 802.3ad mode. + This command applies only when the bonding interface is configured + in 802.3ad mode. The following options are available: - * **slow (default):** Requests the link partner to transmit LACPDUs every 30 seconds. + * **slow (default):** Requests the link partner to transmit + LACPDUs every 30 seconds. - * **fast:** Requests the link partner to transmit LACPDUs every 1 second. + * **fast:** Requests the link partner to transmit LACPDUs every + 1 second. .. cfgcmd:: set interfaces bonding system-mac **Configure a specific MAC address for the bonding interface.** - This sets the 802.3ad system MAC address, which is used for :abbr:`LACPDU (Link - Aggregation Control Protocol Data Unit)` exchanges with the link partner. - You can assign a fixed MAC address or generate a random one for these - :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` exchanges. + This sets the 802.3ad system MAC address, which is used for + :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` + exchanges with the link partner. You can assign a fixed MAC address + or generate a random one for these + :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` + exchanges. .. cfgcmd:: set interfaces bonding hash-policy - **Configure which transmit hash policy to use for distributing traffic across - member interfaces.** + **Configure which transmit hash policy to use for distributing + traffic across member interfaces.** The following policies are available: @@ -229,10 +249,12 @@ Bond modes :widths: 20 80 * - **Description:** - - Routes all traffic destined for a specific network peer through the same - member interface. The policy is 802.3ad-compliant. + - Routes all traffic destined for a specific network peer + through the same member interface. The policy is + 802.3ad-compliant. * - **Hash inputs:** - - Source MAC address, destination MAC address, and Ethernet packet type ID. + - Source MAC address, destination MAC address, and Ethernet + packet type ID. * - **Formula:** - .. code-block:: none @@ -245,13 +267,16 @@ Bond modes :widths: 20 80 * - **Description:** - - Similar to ``layer2``, routes all traffic destined for a specific network - peer through the same member interface and is IEEE 802.3ad-compliant. Uses - both Layer 2 and Layer 3 information to provide a more balanced traffic distribution. + - Similar to ``layer2``, routes all traffic destined for a + specific network peer through the same member interface + and is IEEE 802.3ad-compliant. Uses both Layer 2 and + Layer 3 information to provide a more balanced traffic + distribution. * - **Hash inputs:** - - * Source MAC address, destination MAC address, and Ethernet packet type ID. - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. + - * Source MAC address, destination MAC address, and + Ethernet packet type ID. + * Source IP address, destination IP address. IPv6 + addresses are first hashed using ``IPv6_addr_hash``. * - **Formula:** - .. code-block:: none @@ -269,18 +294,21 @@ Bond modes :widths: 20 80 * - **Description:** - - Routes different connections (flows) destined for a specific network peer - through multiple member interfaces, but ensures each individual flow is - routed through only one member interface. - - .. note:: This policy is not fully 802.3ad-compliant. When a single TCP - or UDP flow contains both fragmented and unfragmented packets, the - algorithm may distribute them across different member interfaces. This - may result in out-of-order packet delivery, violating the 802.3ad standard. + - Routes different connections (flows) destined for a + specific network peer through multiple member interfaces, + but ensures each individual flow is routed through only + one member interface. + + .. note:: This policy is not fully 802.3ad-compliant. + When a single TCP or UDP flow contains both fragmented + and unfragmented packets, the algorithm may distribute + them across different member interfaces. This may + result in out-of-order packet delivery, violating the + 802.3ad standard. * - **Hash inputs:** - * Source port, destination port (if available). - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. + * Source IP address, destination IP address. IPv6 + addresses are first hashed using ``IPv6_addr_hash``. * - **Formula:** - .. code-block:: none @@ -290,8 +318,9 @@ Bond modes hash = hash XOR (hash RSHIFT 8) member interface number = hash modulo member interface count - For fragmented TCP or UDP packets and all other IPv4 and IPv6 traffic, the - source and destination port information is omitted. + For fragmented TCP or UDP packets and all other IPv4 and + IPv6 traffic, the source and destination port information + is omitted. For non-IP traffic, the formula is the same as for ``layer2``. @@ -299,29 +328,33 @@ Bond modes **Configure the primary member interface in the bond.** - The primary member interface remains active as long as it is operational; - alternative member interfaces are used only if it fails. + The primary member interface remains active as long as it is + operational; alternative member interfaces are used only if it + fails. - Use this configuration when a specific member interface is preferred, - such as one with higher throughput. + Use this configuration when a specific member interface is + preferred, such as one with higher throughput. - This command applies only to ``active-backup``, ``transmit-load-balance``, and - ``adaptive-load-balance`` modes. + This command applies only to ``active-backup``, + ``transmit-load-balance``, and ``adaptive-load-balance`` modes. .. cfgcmd:: set interfaces bonding arp-monitor interval