mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-10-26 08:41:46 +01:00
fix build errors after arrange
This commit is contained in:
parent
ce090a4ced
commit
6f6950d14e
@ -1,3 +1,6 @@
|
|||||||
|
.. _release-notes:
|
||||||
|
|
||||||
|
|
||||||
#########
|
#########
|
||||||
Changelog
|
Changelog
|
||||||
#########
|
#########
|
||||||
|
|||||||
@ -12,8 +12,7 @@ Operational Mode
|
|||||||
|
|
||||||
Operational mode allows for commands to perform operational system tasks and
|
Operational mode allows for commands to perform operational system tasks and
|
||||||
view system and service status, while configuration mode allows for the
|
view system and service status, while configuration mode allows for the
|
||||||
modification of system configuration. The list of all operational level commands
|
modification of system configuration.
|
||||||
is available at :ref:`operational_level_commands`.
|
|
||||||
|
|
||||||
The CLI provides a built-in help system. In the CLI the ``?`` key may be used
|
The CLI provides a built-in help system. In the CLI the ``?`` key may be used
|
||||||
to display available commands. The ``TAB`` key can be used to auto-complete
|
to display available commands. The ``TAB`` key can be used to auto-complete
|
||||||
@ -75,9 +74,6 @@ When viewing in page mode the following commands are available:
|
|||||||
Configuration Mode
|
Configuration Mode
|
||||||
##################
|
##################
|
||||||
|
|
||||||
The list of all operational level commands is available at
|
|
||||||
:ref:`configuration_level_commands`.
|
|
||||||
|
|
||||||
To enter configuration mode use the ``configure`` command:
|
To enter configuration mode use the ``configure`` command:
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
@ -112,7 +108,8 @@ thus also be easily cloned by simply copying the required configuration
|
|||||||
files.
|
files.
|
||||||
|
|
||||||
Terminology
|
Terminology
|
||||||
===========
|
###########
|
||||||
|
|
||||||
live
|
live
|
||||||
A VyOS system has three major types of configurations:
|
A VyOS system has three major types of configurations:
|
||||||
|
|
||||||
|
|||||||
@ -1,11 +1,12 @@
|
|||||||
.. _firewall:
|
.. _firewall:
|
||||||
|
|
||||||
|
########
|
||||||
Firewall
|
Firewall
|
||||||
========
|
########
|
||||||
|
|
||||||
|
|
||||||
|
********
|
||||||
Overview
|
Overview
|
||||||
--------
|
********
|
||||||
|
|
||||||
VyOS makes use of Linux `netfilter <https://netfilter.org/>`_ for packet
|
VyOS makes use of Linux `netfilter <https://netfilter.org/>`_ for packet
|
||||||
filtering.
|
filtering.
|
||||||
@ -24,8 +25,9 @@ or zone based firewall policy.
|
|||||||
OS, is a reference to as `local` with respect to its input interface.
|
OS, is a reference to as `local` with respect to its input interface.
|
||||||
|
|
||||||
|
|
||||||
|
***************
|
||||||
Global settings
|
Global settings
|
||||||
---------------
|
***************
|
||||||
|
|
||||||
Some firewall settings are global and have a affect on the whole system.
|
Some firewall settings are global and have a affect on the whole system.
|
||||||
|
|
||||||
@ -140,8 +142,9 @@ Some firewall settings are global and have a affect on the whole system.
|
|||||||
Set the global setting for related connections.
|
Set the global setting for related connections.
|
||||||
|
|
||||||
|
|
||||||
|
******
|
||||||
Groups
|
Groups
|
||||||
------
|
******
|
||||||
|
|
||||||
Firewall groups represent collections of IP addresses, networks, or
|
Firewall groups represent collections of IP addresses, networks, or
|
||||||
ports. Once created, a group can be referenced by firewall rules as
|
ports. Once created, a group can be referenced by firewall rules as
|
||||||
@ -158,7 +161,7 @@ names.
|
|||||||
|
|
||||||
|
|
||||||
Address Groups
|
Address Groups
|
||||||
**************
|
==============
|
||||||
|
|
||||||
In a **address group** a single IP adresses or IP address ranges are
|
In a **address group** a single IP adresses or IP address ranges are
|
||||||
definded.
|
definded.
|
||||||
@ -182,7 +185,7 @@ definded.
|
|||||||
|
|
||||||
|
|
||||||
Network Groups
|
Network Groups
|
||||||
**************
|
==============
|
||||||
|
|
||||||
While **network groups** accept IP networks in CIDR notation, specific
|
While **network groups** accept IP networks in CIDR notation, specific
|
||||||
IP addresses can be added as a 32-bit prefix. If you foresee the need
|
IP addresses can be added as a 32-bit prefix. If you foresee the need
|
||||||
@ -207,7 +210,7 @@ recommended.
|
|||||||
|
|
||||||
|
|
||||||
Port Groups
|
Port Groups
|
||||||
***********
|
===========
|
||||||
|
|
||||||
A **port group** represents only port numbers, not the protocol. Port
|
A **port group** represents only port numbers, not the protocol. Port
|
||||||
groups can be referenced for either TCP or UDP. It is recommended that
|
groups can be referenced for either TCP or UDP. It is recommended that
|
||||||
@ -232,8 +235,9 @@ filtering unnecessary ports. Ranges of ports can be specified by using
|
|||||||
Provide a port group description.
|
Provide a port group description.
|
||||||
|
|
||||||
|
|
||||||
|
*********
|
||||||
Rule-Sets
|
Rule-Sets
|
||||||
----------
|
*********
|
||||||
|
|
||||||
A rule-set is a named collection of firewall rules that can be applied
|
A rule-set is a named collection of firewall rules that can be applied
|
||||||
to an interface or zone. Each rule is numbered, has an action to apply
|
to an interface or zone. Each rule is numbered, has an action to apply
|
||||||
@ -281,7 +285,7 @@ the action of the rule will executed.
|
|||||||
If you want to disable a rule but let it in the configuration.
|
If you want to disable a rule but let it in the configuration.
|
||||||
|
|
||||||
Matching criteria
|
Matching criteria
|
||||||
*****************
|
=================
|
||||||
|
|
||||||
There are a lot of matching criteria gainst which the package can be tested.
|
There are a lot of matching criteria gainst which the package can be tested.
|
||||||
|
|
||||||
@ -413,8 +417,9 @@ There are a lot of matching criteria gainst which the package can be tested.
|
|||||||
Match against the state of a packet.
|
Match against the state of a packet.
|
||||||
|
|
||||||
|
|
||||||
|
***********************************
|
||||||
Applying a Rule-Set to an Interface
|
Applying a Rule-Set to an Interface
|
||||||
-----------------------------------
|
***********************************
|
||||||
|
|
||||||
A Rule-Set can be appliend to every inteface:
|
A Rule-Set can be appliend to every inteface:
|
||||||
|
|
||||||
@ -439,8 +444,9 @@ A Rule-Set can be appliend to every inteface:
|
|||||||
several interfaces. An interface can only have one rule-set per chain.
|
several interfaces. An interface can only have one rule-set per chain.
|
||||||
|
|
||||||
|
|
||||||
|
**************************
|
||||||
Zone-based Firewall Policy
|
Zone-based Firewall Policy
|
||||||
--------------------------
|
**************************
|
||||||
|
|
||||||
As an alternative to applying policy to an interface directly, a
|
As an alternative to applying policy to an interface directly, a
|
||||||
zone-based firewall can be created to simplify configuration when
|
zone-based firewall can be created to simplify configuration when
|
||||||
@ -453,7 +459,7 @@ An basic introduction to zone-based firewalls can be found `here
|
|||||||
and an example at :ref:`examples-zone-policy`.
|
and an example at :ref:`examples-zone-policy`.
|
||||||
|
|
||||||
Define a Zone
|
Define a Zone
|
||||||
*************
|
=============
|
||||||
|
|
||||||
To define a zone setup either one with interfaces or a local zone.
|
To define a zone setup either one with interfaces or a local zone.
|
||||||
|
|
||||||
@ -477,7 +483,7 @@ To define a zone setup either one with interfaces or a local zone.
|
|||||||
|
|
||||||
|
|
||||||
Applying a Rule-Set to a Zone
|
Applying a Rule-Set to a Zone
|
||||||
*****************************
|
=============================
|
||||||
|
|
||||||
Before you are able to apply a rule-set to a zone you have to create the zones
|
Before you are able to apply a rule-set to a zone you have to create the zones
|
||||||
first.
|
first.
|
||||||
@ -496,11 +502,12 @@ first.
|
|||||||
set zone-policy zone LAN from DMZ firewall name DMZv4-to-LANv4
|
set zone-policy zone LAN from DMZ firewall name DMZv4-to-LANv4
|
||||||
|
|
||||||
|
|
||||||
|
***********************
|
||||||
Operation-mode Firewall
|
Operation-mode Firewall
|
||||||
-----------------------
|
***********************
|
||||||
|
|
||||||
Rule-set overview
|
Rule-set overview
|
||||||
*****************
|
=================
|
||||||
|
|
||||||
.. opcmd:: show firewall
|
.. opcmd:: show firewall
|
||||||
|
|
||||||
@ -663,7 +670,7 @@ Rule-set overview
|
|||||||
|
|
||||||
|
|
||||||
Zone-Policy Overview
|
Zone-Policy Overview
|
||||||
********************
|
====================
|
||||||
|
|
||||||
.. opcmd:: show zone-policy zone <name>
|
.. opcmd:: show zone-policy zone <name>
|
||||||
|
|
||||||
@ -684,7 +691,7 @@ Zone-Policy Overview
|
|||||||
|
|
||||||
|
|
||||||
Show Firewall log
|
Show Firewall log
|
||||||
*****************
|
=================
|
||||||
|
|
||||||
.. opcmd:: show log firewall [name | ipv6name] <name>
|
.. opcmd:: show log firewall [name | ipv6name] <name>
|
||||||
|
|
||||||
@ -698,7 +705,7 @@ Show Firewall log
|
|||||||
|
|
||||||
|
|
||||||
Example Partial Config
|
Example Partial Config
|
||||||
----------------------
|
======================
|
||||||
|
|
||||||
.. code-block:: none
|
.. code-block:: none
|
||||||
|
|
||||||
@ -770,9 +777,10 @@ Example Partial Config
|
|||||||
|
|
||||||
.. _routing-mss-clamp:
|
.. _routing-mss-clamp:
|
||||||
|
|
||||||
################
|
|
||||||
|
****************
|
||||||
TCP-MSS Clamping
|
TCP-MSS Clamping
|
||||||
################
|
****************
|
||||||
|
|
||||||
As Internet wide PMTU discovery rarely works, we sometimes need to clamp
|
As Internet wide PMTU discovery rarely works, we sometimes need to clamp
|
||||||
our TCP MSS value to a specific value. This is a field in the TCP
|
our TCP MSS value to a specific value. This is a field in the TCP
|
||||||
@ -788,9 +796,11 @@ value for IPv4 and IPv6.
|
|||||||
in 1452 bytes on a 1492 byte MTU.
|
in 1452 bytes on a 1492 byte MTU.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
IPv4
|
IPv4
|
||||||
====
|
====
|
||||||
|
|
||||||
|
|
||||||
.. cfgcmd:: set firewall options interface <interface> adjust-mss <number-of-bytes>
|
.. cfgcmd:: set firewall options interface <interface> adjust-mss <number-of-bytes>
|
||||||
|
|
||||||
Use this command to set the maximum segment size for IPv4 transit
|
Use this command to set the maximum segment size for IPv4 transit
|
||||||
@ -808,6 +818,8 @@ for your WireGuard `wg02` tunnel.
|
|||||||
set firewall options interface pppoe0 adjust-mss '1452'
|
set firewall options interface pppoe0 adjust-mss '1452'
|
||||||
set firewall options interface wg02 adjust-mss '1372'
|
set firewall options interface wg02 adjust-mss '1372'
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
IPv6
|
IPv6
|
||||||
====
|
====
|
||||||
|
|
||||||
|
|||||||
@ -15,8 +15,9 @@ collection of all routes the router has learned from its configuration or from
|
|||||||
its dynamic routing protocols is stored in the RIB. Unicast routes are directly
|
its dynamic routing protocols is stored in the RIB. Unicast routes are directly
|
||||||
used to determine the forwarding table used for unicast packet forwarding.
|
used to determine the forwarding table used for unicast packet forwarding.
|
||||||
|
|
||||||
|
*************
|
||||||
Static Routes
|
Static Routes
|
||||||
#############
|
*************
|
||||||
|
|
||||||
.. cfgcmd:: set protocols static route <subnet> next-hop <address>
|
.. cfgcmd:: set protocols static route <subnet> next-hop <address>
|
||||||
|
|
||||||
@ -152,8 +153,9 @@ provided by the Neighbor Discovery Protocol (NDP).
|
|||||||
To manipulate or display ARP_ table entries, the following commands are
|
To manipulate or display ARP_ table entries, the following commands are
|
||||||
implemented.
|
implemented.
|
||||||
|
|
||||||
|
*********
|
||||||
Configure
|
Configure
|
||||||
=========
|
*********
|
||||||
|
|
||||||
.. cfgcmd:: set protocols static arp <address> hwaddr <mac>
|
.. cfgcmd:: set protocols static arp <address> hwaddr <mac>
|
||||||
|
|
||||||
@ -166,8 +168,11 @@ Configure
|
|||||||
|
|
||||||
set protocols static arp 192.0.2.100 hwaddr 00:53:27:de:23:aa
|
set protocols static arp 192.0.2.100 hwaddr 00:53:27:de:23:aa
|
||||||
|
|
||||||
|
|
||||||
|
*********
|
||||||
Operation
|
Operation
|
||||||
=========
|
*********
|
||||||
|
|
||||||
|
|
||||||
.. opcmd:: show protocols static arp
|
.. opcmd:: show protocols static arp
|
||||||
|
|
||||||
|
|||||||
@ -22,7 +22,7 @@ System
|
|||||||
name-server
|
name-server
|
||||||
name-servers-dhcp
|
name-servers-dhcp
|
||||||
ntp
|
ntp
|
||||||
options
|
option
|
||||||
proxy
|
proxy
|
||||||
static-host-mapping
|
static-host-mapping
|
||||||
sysctl
|
sysctl
|
||||||
@ -30,3 +30,11 @@ System
|
|||||||
task-scheduler
|
task-scheduler
|
||||||
time-zone
|
time-zone
|
||||||
wifi-requlatory-domain
|
wifi-requlatory-domain
|
||||||
|
|
||||||
|
|
||||||
|
.. toctree::
|
||||||
|
:maxdepth: 1
|
||||||
|
:includehidden:
|
||||||
|
|
||||||
|
default-route
|
||||||
|
eventhandler
|
||||||
|
|||||||
@ -12,4 +12,15 @@ VPN
|
|||||||
openconnect
|
openconnect
|
||||||
pptp
|
pptp
|
||||||
rsa-keys
|
rsa-keys
|
||||||
sstp
|
sstp
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
pages to sort
|
||||||
|
|
||||||
|
.. toctree::
|
||||||
|
:maxdepth: 1
|
||||||
|
:includehidden:
|
||||||
|
|
||||||
|
dmvpn
|
||||||
|
site2site_ipsec
|
||||||
4
docs/configuration/vpn/rsa-keys.rst
Normal file
4
docs/configuration/vpn/rsa-keys.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
|
||||||
|
########
|
||||||
|
RSA-Keys
|
||||||
|
########
|
||||||
@ -261,7 +261,7 @@ Page content
|
|||||||
The documentation have 3 different types of pages, the same kind of pages must
|
The documentation have 3 different types of pages, the same kind of pages must
|
||||||
have the same structure to achieve a recognition factor.
|
have the same structure to achieve a recognition factor.
|
||||||
|
|
||||||
For all *.rst files must follow the same TOC Level syntax and have to start with
|
For all rst files must follow the same TOC Level syntax and have to start with
|
||||||
|
|
||||||
.. code-block::
|
.. code-block::
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user