From 7d07926f370e16642e8a69b6487459b0de51ade6 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Mon, 18 Sep 2023 01:08:00 +0930 Subject: [PATCH] Added new section about the different firewalls Updated labels for the pages Added new pictures. Signed-off-by: Nephiaust <29741794+Nephiaust@users.noreply.github.com> --- docs/_static/images/firewall-netfilter.png | Bin 0 -> 73608 bytes docs/_static/images/firewall-traditional.png | Bin 0 -> 53437 bytes docs/_static/images/firewall-zonebased.png | Bin 0 -> 55621 bytes .../configuration/firewall/general-legacy.rst | 8 +- docs/configuration/firewall/general.rst | 55 ++++++------- docs/configuration/firewall/index.rst | 73 ++++++++++++++++-- docs/configuration/firewall/zone.rst | 6 +- 7 files changed, 98 insertions(+), 44 deletions(-) create mode 100644 docs/_static/images/firewall-netfilter.png create mode 100644 docs/_static/images/firewall-traditional.png create mode 100644 docs/_static/images/firewall-zonebased.png diff --git a/docs/_static/images/firewall-netfilter.png b/docs/_static/images/firewall-netfilter.png new file mode 100644 index 0000000000000000000000000000000000000000..dde3766b0b0eddf9215dd58a3047fa78b0793565 GIT binary patch literal 73608 zcmeEP2_TeP`&Uu4qR?W=mKNLC#=dW3O^bbLFqSN18O9Py3lc&og%+hnmSo=|Q3*8) zC4`D0gh5&V=Vj*J3Eg}D-`96<-D+XpGw*xOd(L^D-?N|y zEAOG8ScV6mYpIumpNfZ+9Ko+8?t9b}Dbi}0!8h3ijEW(~$;-yx5k`~Tp_Xr6J3G)d`@WJ5wU?SYY z3L@g*hmbJ8C|ull?tY{#%9&W9HrmJD(Gkflq$*%s&Myf41%-Q&Hb^&nvMQjSp)g3>xn3!1i>oVm z>I$NiZNzoeRrVl_-7M#N3duvj+h&N);Xh)2_3$d@nLMybhGs=oM`@}M&8#F$|hUcoY zK|2z=N4y6bwJ+{~3ietd9T%1w*jr-&`9Sn40-GITAwlSFb(FoW9kFF031YoYNYcH; zj=0+)tgGWAf)TLf$-t*z=kc79;lh zwlQJDXrNnrr2ssK(%gY(CeL%e&I6aMVZ1q`ET;i2uIqoinM@6D&E zslQ*@X5St@nD|^r{)kN79Z(o62nirUM0;Qy?VV9dzu^y5XoGgfD4`wEZr~t}x5vzh3`;ZygLWdjLBY}97Ge$z+69y%iC0$OT>$)l!DrCB6LA;@vC-@` zkw>8>k?t;YKx<>~1#zIF3q+16Hx*A%8ARI}avGska~^BaG_#EASrB341-H5nJfiPKKb#iTM4 zO_MY1U*Vzu0dW##=N}R0--Mxa3_eTVLVw6e|1z)@1t(A%LD`qu^BjOIq8fiovHK-# z!ALMhCUr#?(Vc~fWh9FD=cTR?QMdhaYKgYQPdT;1V)N&gI2u3R+%8o25ju0+@l(#M z5J~AJ0yKP~s!U=~a#fjB_8l?pLRDFJ|GuAiW?_Ov82f{nB|7WA@0k@QVhtG_>wC|7 zaQ6UPoa7DtDY+L0|8kCD;zX^443|lso9}#*7s}iPy!$7nfu$qb%Hc~@>q{kQo?(E3 zS&O3J;DIj{GGG`;h{1)CVzb{M-7q8%C8>U3ji>_u4N$cp+rb@Zuo$xIuWDNVGFxK4 zVlP6RK$1lG_NK%F>qSJAA1)~I`yZlcC%wTBYgz~|)KRo_l@!1t6y%8bDS=L6o*4;S zsHXfFI7hO8$b{L?KDR<*|C-5NsHrUA**_6tzx-RjFJhCgNiF=m*eVrit@$@^lNdi- z>~{enF;7B#dl@A(e`!wekKf>jl~E!@hX5Il{eMZFq)+`-NA53u?GGaa$T?&Y-Vh=w zXe8bcf%6MV2>$+uIH4r%>D%*$FiH0P{swa-Lu&HJWrqKLU4!WJ{j0nHEEjQWk;QBm zaUn}#G01jV#7voQ$;=J^B3|KtnXR&b^2Fz@sC|24U%+njoBVN!o#-_BFOdHiu>;N{ z>WU=rBVYFTE1?f_aK8x9FEEoyJ|R*|-=5g#`vT^-_~X+0!bQHHdbI#1NYtQ7BAjG& zlldD-O9S7xzmcR3k)hbny<8wP-<2%3aEVX&A6hS%4XpY~kSr;F@b_?Ja`c@2mJ|y8 z{*KDO z;-hB+r+>vqL*e5G?OnYMeMD^b^64r$s~l7jRkm^XEAi340#9cn{D0KIQ;CIMYSMB$ zxpX9zkrXs?RS*J{KacO94Wa(ef}$5C&HrA-|K-R0Z~U0hLJzdoLsGLu{|0+?-kyT_ zP5uZv{GznHP=%ixTe5YuZ|;--3+|b@m-zSlUKV)7NlSMmwEOnvsPKIDncw6OOUwU# zki;)s{x5JD1{|w@GcJo0!`i+k34T~oCQ39i`}-Fx&(hZ4vxjg#UCoEcZ;#3gm}h>I zKP)LP4A=R!6W|M&B>B3@yo98+Kyo{Xki4V|M6y)NTFmL`*SbZ zz(|`Z=Nkt<-qbD(p!vC{cD~o-$A#mCuH;{vcjmGvEZDpQ{{c4dNEmov1r40_w6Ob} zz4u$&?p4}j@K;u{$hPqRS@h3u`A&Xi`k9}6LRgHH6O3dd{V(ivqHBgERfI+7H~J%3 z>WdQULJeYp)9DwXk_Qqm`gxI{v-$E0_IFU~f}~X6HKqPdK`hon4#NBS#Duk#uwr)h z8W>$IE44Wy|2>F>EDzvfsmP%DT{L_J_S^naQhGm838H-emEG?v!TG{UUkO|yXDw*N zzu)YBa4!!_Z*Q!tf)+;Gz(QZ*pt>50?=L{)4%9--t=1W^N>luIlf`g|jGWEi@T^c7OW(xg{<`lG*u-`O{%U_ccjZ{9FC$ zj=S}A#nmN@4jKzv^Vz^*UfL+Zzu!$tMAd)U{u@$yR1!9k zHc65Q^V=ISq>#GbTl^7im_>PLq2LAT93*W(ycm?_+RX;a0|sdqVn`s&6C6DqOVLG*MAv&!XRdbn2dyGaN_m<4nJX}wRlpKq~%gllRttB=#NN*Y!PVz zRogqw=7?XI_?XN@nYC?Z6MKs)a*HYhfLV~PksN`byvoFCmF=BuLA* zfvHsmCmEpJkRZLgD#F>t17o4$fZ+JA81zDd#Dgl3 zmZU=uW*b?!X^h+-H1~Pd4@b(2|66u*VWD|@Fc-1qyQ5YR)Bb7fosWT_7C`m)D$VZ?pG4$e+m4GU^0~iA=^Spa270-0DK7Y z!=UWIpnUEZ*%!ouFYlgv`pYtCEf7@sWuf?7>HKN|{4Vkiq??H~K}a_Da6`hP2XcPq4oJJJTlZ-sVpfzByFApj?UakjLb`=CtnnvvZL zPJRKW7Vuj-BAp#9tWlo!P)1`#fYX2R5pXsR@tK7jx~MilQft125kM{|XL%ePctmza z$oI#83!@ts@E;jRk@(}Qp40^j(5zEd5ozTBVWzV+=~xSpVDV3wZjMO}h-a=qy3+!- z6%-T~RGnpL(lI;G#TO3c`QBN3v^$*N9uT2Bzm**lGG_k)B7uBOpxH0?5fCSWjDSd| zl8_S+IGkfv?0i1}zDTUy0t)&cn23vVGEoQlQxlPNkkh}-MieHR>m(&ilt^MEYWem) zHkbqv<-XSB4{IZmIE_pX-0g+}AcnDb2DaNbaio!%8A7vi7}6-oTq{4XNg)K*sen2H zjR%Rc7PBaR2oXy{8!}2-fRI0>yFo}qf}fOwg*3~gMBij`@Q3j@fDAVkDpY|4tqX!^HnWyFac_Bw{idh3_He-xpLy0V57N zh>lD)&Uw?eE7^h5QUR1J@7)J}B6jZ}6MVwI1mEoGl0>6GSahCehvexY14PpK9OQ-p zDPK5=wEtHBtC)z6!d@+u`#}*SUBqszrU+a`^RKM)f8n@UG`a?IXOh{Bzs^+rC(l$A zC3#AS!kTmp9vNv069M82(j=CBKcq=CqRCKffkO8Glhcs&+)F$z6YYkvL)${h!Bl=P zUBt~mTreSD_gvJdCE@|OAYYW1*qOgTUzEpd}h)O9~yZV1rKO3k#_nv>{ok$7z zNDCEz{0#B#|14M4AJP6FG4xMqVf}VwISH{BdKte*>uS+C{%4GF zL9&piOPnWWy5+ywKR{EspDpGK~Q2Gwlr$3i2D%w*CM`DHVGVKYep zXQ43J5g%XDCrN&jsi})vQ2*r8%Azns>;{=so40NDcPBK_&{pAB;|Gd`78+>{et~c# zq_Y*uZN~!b_UCmhi@@RY9LtN42TX7=$MSbaAAccz)=#PRh=HIj@}&cjA6V;I7#}ki z75K*jLiCq_AQup#;$ITPA}s%7NCYAwlSzaH(Ek5(T+BVbNDv#jTVhe+L>$pS)q#m1 z^)J(bMM>LNhzcpm%KqP}z+&@`@)eusRr_HzV3JeukBIuG6l0=-3ztVp-Y_y<_J=Xx z7l{;7MZ004?Xe4%jL57V)nC>QhFqA5h>P=+**X%W-SwIQZLZd~lNTOcIi$yv09;$~PZ0NKT^vA5Z_nj4#6q7p{u!MnhY} z7HrH|u$5cvmsgxz1r>u!@QV`lHWGu0{kH9bObh)%+y}pw!xrBx4wn#IxXps7@R7~( zk7H{rToY6I^E?jlU(8R={P6h-rx?+>LPilk2;YBCi(-E{GVEWvEGA0S=!xq6I zB;0mGy4Y!>tx=9&Y#N;X*4iFv>xOh9enETyNhm3;50>1y^d#@j%bh~~7q8^K3Fv+jy#4aw!-0nnA7)>*b7{CQj$?b^Q4Mvw z-8525S8m^V-DmaP3T-8E#GMxlodyJK#Sc(d9oP?Hz?ly4rJF zvg^4)=~eptvxjNs{+;4I5B^*{a?c0;LE9yohRp*KGbKl-OP0giLkdAg(y6wR1 zKS8dg)WcjaqFg3Y1=CHgh&(&S6*|g35=Xp4(3p}Jr*^Bf#dy8olJ(uIjxg-f|6p)q zpX|A7c%^Z-ql^NQVq%_C<;PcH?FK(aO7U{mUJ*>vSZ@|ek-qGTk5<${Tf~ci6`5(B zY3i}z%tcy9Wm?tp$67pRtCL$2N|+WNWzo7vsdbS+87p8>Qn2TSV^Yuwe)FQHwj4kDw;s%GBTdl*Uv3+3ao!XM>v2b>E_{b_90r;UY@u$Q|gm0uvHEl7hHDPE!*SXpJR-Xpr2g-=CK##MxX2*bv^FX9|##(m|ZSW3T zBPjJ#4P8C1?s+NNz^7fGq%mHkmwP#&6Lk6l|1|jD(xFd^mft`WNd6 z$k3{kkoRH6ff5m83eqo2f}mMA#lJ+?S~Yi|#cj5qn~pqs^e853Z8%fvzMT^Sh8b@< z5?c<0uhQ1hnbyMX?PMSBsvFDI-V-K|-ky9#UacbNlRM>9c3uvgZj>u2bQJ|B_j8%n z6@%6jth4y3 zoOJim|9rvXVW&(N%iErFfD+`(Xbh8?ik6xALGSl)*^%m# zaTZ%(ixucq#xo7JIR$h|G2pNCjLJ4D^$eO97@XZ=4N>bd&Zna*4jm934udG>9;JrL zn{sSR^tO;|qjK#?vsEJx8ebQS>@VQb6UuaK)aHGDUp>S!zuxZ&sO`0^RT(LYhk2M0rO#F^SK8LL#+6%R)Co*nJRxQe7S-UeX~7G%p+ z6&Yh3=QLf$_4@%gU%E)4BF-E?9j@XA=O{LbY)f@oHtDCCdj3UKXYnTXnO3MzS{Lb- zgkmDrKyN2_M4x(6AJ@sP{d|3IS8=EFv6|OcqteRz`7Uur-&C2p7|mwhI5PE6pvJHG zLGoHz%w7L%76eD3}pZNvI^?lu-WBTQS* z-(l_Xim21guky{x4GBO)Lwt1`;D?@mkIvawv8BB162f$Wo6(@8uh!mR)KfD`i)ASC zrQ+1-x;B}_Q&(@^Gzmj#eaIfOLN!rfbI4{hrO0%nhUTNw`dLY8RB})r1l0~ zuDV+H=v8NN%Ziq&IVifTbdRH$#aOlh>a^;4`McL_ckFx6!4qL@GLlu>^r*3UB7Wvj z&&PVPq|EDVUY}nLVt8*DW2AQEl_Zs_?Ktk!r%2;vQ{i))q0sC|?SofzcxDUV2>K9$ zgpqF%cF201nK*)g(sMN)S3%TwPvl4~ZzXpM_I;pK!9iryw&8GbtKoxBM*QQ_S<Q+p`J4#08L|(jmyp7-AxDx>Wr_vW1GfwF57Rd^Jv9= zo*Vjp6P3bs`Hmx#TTUom$HJW+jz6Koij13SVg&}h26m!VG(R3XJ&OtyfY|7|t>MqW zET>RjF3U?{;(Pd@hi~^jzWnNlJQ=4djI5N1OoAaHM6E`vf2;`8mq)Mc6O{8=Bmw)N zfAN5j};O$?2Qn)!?np0!b2tXd4q-vVJ?q5xs<9 z)iNPl&%u02!t-U$h-f_Thx)?vn(Nh)O82WN_M@0?o5k;}$zwK1hY#GEh%>%;e`k(& zT7|1HqWKj=PhUkcT%9>rq~LYd?%fqDq@R21G~B+sD;&#sW#d@!rh%-)q@u7fJwJGk z5c8o^(BR)y0rbXaD%%9no6QANH5!!-I2M{7>K@LCmJ8WhI?V2aVk{Qu$-r#Q{S0`8 zyZfTN_pXRBzIc?*e+?6&2ZilQMmm;xeu#PT;w(p;gi$UogN}KC5r2F2YBno~b@*tv zkE`81zHOWqqP*@MOLUc`D!g&60cRQUA={>>?o?rTpXOJD)){5(qtSn-Y=saS*z%64 zn@%q{;(9d$D%+kc*oGOR+-Rs9b z$@KTHA1Jykb)=RGEA3l@+h-hg(6M!FEnhKJF{(qsI-)9%5Uaa-#i)F8inX_Zg0xRz zx0tv;WmREYm|4VTi&+c>H7}p7c|EAvQ&Af?SlA{q-Fhph4{>2=t!;~b&Fhl!V6~CA zJ}hE8uqmQ$-stShEy09Wey>c5ZH*$flnwS{t&CP=HKTy!by=E|ypA~^ZMSsWZWmBt z1O6VQF~EV6pf|Z6$kl+dKq{tnm(zK8cnmZo#akVwCqHveIrUb?w}z?9p&~HWsokst z9!ZX+TUHE~56eK{5O_}=NYl$fE$RRf&DVcazPt9B@g?a4k<-Em-E8%wZM3)XQP&`m z*I2vk=?!%>JoJ#1$K%dSRxmx@%yDVaK;n4=kd8|cXrTvnlmS7OtIqaBy|;sZlY@`R zV0%I^L2rFGCRC+B#fK>(MOPF8-)msl&vOhdfux^c=wawPcGeL6mewqjyC@Z(T_(96 zR@nlS70YApg6af@K6$hNfjp!Ol!iJBG( zPScFCRzs`{88g0X7g_3*)zT_zkTaIbEse+)X0BIm+;$`ONz4ry&Zk{P(_1U=T^wj1 zbdHqmhILH<96QAbX%}-!*^z#LZ*W?Cj0Q?I85@y5yo+~Mbvm4`st(8aMJUQ>7Kg}N zoD5zU=-=vUz{MGZVvFn_EGZN2!CG~t^Cj6sq?<+U#nHJ034QFN`>6b!qqvw(`0bUW zyVZ7Q1^8$x7C&=+=@5CApBcVqX+r;9^>nH0Q_jpoS^dobV$KACPI`~y_<&xpaW$a& zUKiQEyY-b-m6au@ui;NMe?CxPHELE_S(#>$=hD9Rejc`U;9PcW9ea5kE*xOV&48*v zakaN$aLH8=!z9Kx`rdGH=JTwYQ!e zeG($9Kcc6(vQbPriI(P5OLyihcgk=ah-~FNT>@a{-b31t${6c{S8D(P*&RLH7Upzs z=+Z3xFhNp%9fS;a5r=s$_YDp`1Lao~?hRBv>$c6sfzD9?dRsy9G8f#lodJxa=8FVp zP^o+b^{1Amxdsk{{`;CjtBn*OWX?K&VPa z9apL`z5;QJ>-KH;uo)iv&X4Yu69U{*NG{)t#j0|OxKM5xeOx-X84tc>lwYs=%9JxN zW-NaQH0=#WA~B`a#SC!mNqI2ZwLW+*1Xgog-ZrI9viIIrj=KJ`>>>Y<0d?bT_}9Ci z1)L$2MzM0^N8=yM$>SuV#NTg5tcxb>M8v84q$j6n7O3M=mX$WD`(%k^>G~ACHj9#F zw-4h=`#kQ_vcCD)2wPNbG~vEj-L8)I58N|55N)ehZ5KF0(2W|6B@8cL(}Q8g`k0sI zkGC|T%S%dT=O;s*?Od9t5=0Nm&>PCDMus;{dSwh*K9jM)!J=p}TM)0za5YhDqblG% zN>S!poIe{OQq&8i4Fl=US@fk!9+&7aH%I8Wt6y#n-KAINL&M6SqFlMNaZLS_;7yc}(=P zB7*m#DKCDk?B)yyf^F^PnNLp#($Cy=$YUC*8ZxaY7oSQCgZ`@%AjBv;+^G4S4EY3#vkh-ft`+Sev_*y7CUF4K$a*0EC!T(@r@iE`OrRl~yMRm5QU;hxD72LZ;9jta>EeANEDgC8p$ z+Kmx%t1h4EY}?2?$eZ~5B*9530Y9eU(ikz7t&V$C=HBrl%G@B2^_*F|+6pvP5%nF| zw2Mt-VCnfVtJYnFU8}Z#yth>MtWwtS(6QQqO6idky_P^m+AU?oAMcknfUu1kFm&H) zAN^!2(Xa*u-Yhk$$Z$ihbDPqhQ)}`@8btEuMprpVgM zOZc0NBEy3pyb4f#zinm*-sn<9NT`4tyH@8wS>McKEv1daAH8f>b)Fqtxk@*HW)(lL zYG%fs8mAS zb#g10vR3mmBEwmZD{dP#QDUAkKiA}Bi5pv^xHfmp?iu$9mduCn>7(q730`h_QGU#@ zh+b(}JGCw4h$+VuLs`c(?#)tNE$RMVu4F0UJn!|nIxXSU{Garaqa6-Y#l0xwOI$s} zi#z==T-JvDS~mxaXNtxv1srRXp;mcI5|>-vkg)UY9Lz8lF$CjzUa}&_;uGRhpspnP z-1h)NYr6>0%N4OnyMP5GNC~My%ZnKzbsU8m5tg?e#cJz2TDrT=sBE~C&2V|`5@mV` zWp>7wdfTg&qC{V@Mwhb}y-Zx=8ccg_Ytf@OwWAKf6Eif5iPncIa-#`hly0SK5U+!G zq-)FSpBGkP(TE!CB#n{GnZ({|@Q%yOY;TAjCHDKqjM-^-HT(GnJY?8TI4s!bWx z<$-%S83(&uncaDP>(|GbH_vhDTFmv&Hh@ckA12cLeXB<^;L>pgz@`4X6Le0UQ0Gx? zxhk>bb#({>kE~2#pTV%OpE4`WM{}g^IER4b=a#cok?$k{a&3qL{a`PwiGidW2h@*c zNxU6-c8$ht6YjYk77Uu=M)d=`{P(^N%y?lYCVYtQ(x(=~3Ul{GAyA^9*`Nk+m>uP$ zGxKJjHedr>bOge-y5Wj*1Q3&@G+rE%+Mm4H&x?mtKa?)jtJt zZGIg@X*za7*_2C!(?4FOa)p`t+tK5vsUvO|+&TWFg$q;7SW@j6R@q>7H^T4jK;jjg zX*8GbhfCq8;$}s;D8h${bF11<)Qmc1(xPjU@>f23U&1uB9AlDV(-rNP*oPlC8j@|b zYR;vhnLGh&opS!rMNP;CV6J-du*$f)NA4Ejt9rT&P^OMjkvvX2Di#sXgFn4h_0hd> zLDc!QW~EaS9CsQsb1KrJWs1x_d-KeitB;EF_R&8H1u4 zV?f@z?Nt_ZEOmsdVxl0KPjUIg)WPs-{lo5tr{18;sS5aj5Dm}h!WJ>U9Cdy0zKiQB zr|(2V`&rfg(Nk*})tvD;ihLL9V%>5PlBLJ3q-3}vI;RvawOF^NOmbMCWoz&nE6l8a z_HG!=zSc!Rk_AD>W;HoAKnWupek!!>7SAyq@En>e2Ru|xMZNxTHp3Qfg3YuYbqHh_ z&CBrHc-cj$LO%;Gf_U20Igt>>NEul(-I}fcQI#X%N#}>QsbenF9!RNM@YM>*o%=s3 zBgQBrYh~YO#}0q!wt9BtL+f2QBQI`pwSq;u2tD3<On5bdPg_3>p?;`++@A=YntsqM!G&sfR5J+(oJaPgu?Zjut2{P?;h994djYAZu(k~qt zF5CQswQJp)r3|~oCeD|d(NCxk?4;@a*st(5KnurKZvHwLTfyq<=gvFf!ucj6+_oiu zO9+N>X+~P~2=fwQ-pKGb75fvW%6FXFLJ13$Vf3QKHeBY|Gmfnchk=a_|_{86S=WtF!Q@jnr>#Px$rW zbxq$4UihTp5*iVU;Vqg>lzi&1Na0d#qZb5|zf_kQUq5PSTeM;$+^``tmb2U_Ph32B zx4&wO)kZ2SDovSCsj2Nok%@7G)97|@j<;_;$|fj#C5xO816A8UiURi6Iv@|31eC9G zAvj+Hq!d2w)Mct$aOe6e8%iEV-KYqbSUP+~5NCPj^Hzq}mopD>s9&Lw*}iZjNfk#hY~7q%*B6W_ z>BBCkJGDi;yib_DjCm$V7|}wT?Im#_#$UrFh$rbD-5O;d&szDJ8C}EO3L83>-17^L z;PGUMEU|JinekBnaAKGAm}>G~w()a{79|o~rJb7tRx^6gH_$Cr_@rcdvFt$t)y8s; zjt(8>2vcGH4}|gK(N%*wb}K?ROqQKLLPb}^)2$gwFpr?HsDu18%hm63_#Mvh+XYBs z4=~!3`YTgWbjV{W%%QACEtz+s2&*$`1UgRA*>Xj3hHUPC+FADaNnOU1jytEe-hZ*F z5v#mhzp;w)h}s1qnirM|O~@TH#_w(O&dP~TCQ&W1eCwK9c~j2rSzr|fhq!TQ`(e1e z*fy3p_nuISDzi&c>Lw4-M@^Tx6OIRWOV$-<$Onk>2GX`gyx3&J zWu&yPR5IA2h|y&ekCe14p1}U3>m-7wUgGkF-b7|b&O9+j*Zz=Z(aZ5vE00Ngyp^?P zu2LyXROgXC;^m>pV0apN=$U6Zmp@aFN`h-<0GcJTws_qd#xegQyCLz`cKN)etW3u! zFECY}vcgTkmLAfEtjLX90XZxwAH5BRNkah)lTu_jb!B|`Y2{;=Pggws%SveHGpLW-d!RkC-&gU)>RUD<_Ts+llx2AyH51Dj^HMu?bR4~S^^$GV zH95qhZo4vfY|Np~&EsQAT>d=l!TQwahF9rYOhc`@mFOoQ+_5)get5@*?(pQ2ipWlt zBUs8uQ`E=<3RFx!71D@zF2_@7gLM2dt~VOvkYyK+iDMW|f-kAPm6LcLCi&4lO?T=} zETLQCFq2AY&NNt{C_06erZL=57Ff$RL@U_OhtnLq;mQfdLiHRFncK%ont_h`lm?8E z{lRQl!Q^VJGo?fzA7ko0y~CVK>27na?QGkS<9xrTW-NI1d!A#wt&`zSCA4`)@G+fn zN5jjfp=}Me zVl<+yC&<+yc!M48l+`oxj@OJwI}UlRwyy3xxv~3vy`SpBTDhyrmO~6=4EZMLx3SGG zp9n)*`qY7~{t3nDnV({Bzfn0Ic2&S+V(4k&Wf*@ikV~+2x<`9~Q)Bl^pxj^WR)vE~ z4jcxLv21m0dko%95NJ@mS_b)-A!{G_Ruacp-KIc0L#jZs7mWn>0#E4a6~G(u{t}bv z3L@7EsK5*8zyr&;-h^~hASd*}=i}^euvW-|#|*$x@=yx&zG&=puPt~O4toEd=zfu= z{Rm#E_>CkG1ZM()M!2KkS=b!y>ng9HZq5|~u()~&@ZHq!PrD8jxmF-Hx{8BLy__mgyJ=55GMETru9=RE=ez4;uicYCa2d1}e!t3P|&lZz_oa4%ag!Q4+{o3;J*scv{R)I%6QR14y<08Ic`VDgmcX zIVNV;LC_y87)kE|_C|nbThU-7YfK{YAkUQdRxkjpK4l(|w}%Q0z#hz%Ex-dOC=Ui; zEo}}OxKnp;1S83K?Utz?)SvYk>UF;B^8KNQIp2iXwfa17IYFTb0t1prHq@rubY| zS3igvg04fk%3;(9a~%E;$q!8&eB;Q^+H;N#^-Sbj`^{9FqA@Y1`VQ;wa=pA)7uFvCR zk3%M zy}n4%{H#R3K$Jg+z1ga+(Vo*)n&VY2nWc#Fm}C>lyib~3Q@LDedM1hNcripk&zl0- z2Y`FTDNk_V;`mHF&m|WRAKsxmeANHr!)jBn281T6rv|ZAzjF`+%shwIEi78HI%Q1qp0r{|- zcc~H`-kUBQv;U<^K^OA_pRE)7O+pF&kqLe+uY<$NL~=(8!SZ44L0UB(9i6l@7?&c0 z-xe{tTd8+Y?$3UbBqs;2tHGxvB{J+8yJ|n4pdc7|7Zt^&8!@I4l`N7u-u0nasAW34 z*J;sQaFAfVIeet;^YHbW*`kvQ~WL=H%)5!wI zhs}4|^B{PsnK|(q2w#LxN-|ZHzkq#YGMoDNjO@du8Sl1 zAtn$74)UE%kfPbm0?>&0`2CSIlSYe29K~$=Lb2MRgffDWb4BHW_~vmlUYv=oXfP)q zu6J+Zg$qwk5|ZkYXMrDuQLx>xmFE@z1Xs9l#^RVY;rm~ z%9EzUPYMBF?jW{wTFpHe<1e}c-&l6Jw)kNBhzD??66B&DHV)Rc$Jd>~6eL%3vpL%#1XC9B;>-oQdsC&FSnNj4Do_84hV$W4+lr;aYie`U(el)h({H;D zj;+YT*4YZAc4vz58Q1sb7pAYYEaJfL*aXM$))=01 z-5C)2I5;a;xew|H;?bf$glQr-D@XADP-lrL_5I}lAM z+=_GEn-cD|?7)#WF~dqa{6tW}FnVQ`><+_rWTrk&nRbeILmrSk8=&>G@bdO?7)H9Q zd&P^Fjd!QJ@?|G#zLH1|#-k zA-5TQYMlTztSi_m@NGmKVGD5ok7LBeP7(r6D_@Z8e@ku2J6w^TC9^VZxJFsBtJ7K6 zQDUr|p?K8Tu*fxm=e$(;1bmMj11Q~)B31~?auKqCghF2WA|hU z1IHA|he=yQH(mYS0`Fc51NpIpld&!aU zbkRL=F;_Tgz4CNd9|B&w zjC$4l8eQli|ORm!m9jrZDm_oEm$Y=R_7bN-<&SCnlNLZqdqV<3g8=;7bKxwO7Co5{@&6)vh}h0mN2W$A(+?9Tl(rlkDqXI+swer#YItm zQ&I7vVbjdm!_(V?liFiLOt_0SI31o^U>%f zyBFWl+I>f#5OPD#0iSKx-0=A3QMQ|dRaf@+#xbViZ?`;D1G?Q=`DvQB#>rznQfCv` z&b*Uqx^*eLRq*N5p`(&9F9Zdd2K1H3kFt%+%XG6pOnHCRAU=6ilKUB3%@UoU=@FCl zdn5RcVmZA1ZmOOFZlxttF>m;dnknv#IMew*G|&4GQQeleeNV>t8)KtgxR=|ywH1=r zZ$X^m<`4VOqPgwBD5XtxqUjmcb&om|!}aX@hYFKgg}RnVo0>R}1>3~km`)6`Ok0u4 zwT^}(;g}Iu*iDB%nE{siew2F**NdAXw~cWO(}|KFlgHBr)RtqjRU2F zfSz0@L$T`?bVKY%UqcLP%4WY54eJuqEE7#d{bU1+t=t*cZEtr!sz}&R(8N~K79r0S z4EiJOBdCtZmav@Y8{u|94n&F;KWOi`4^UO>z;#MD0i5q3%M+hhG0-UKxj!rHPZ(7E z;8~)OpkcSs?%q>YATk=#@E?=b`)B?n>Ch#Fo6*N&I@iNfB<{ zad90wuj#2{d*JzfxW_l~{)X!uc{iQMs+L$jw-*SA=XZIYb(!<2gW1dG>+~BfFkn1D`j4V+IU7C zP54-`{|+5Jz9^5{`v4VwIU=iKoTsgbam#0)NY?$98}ROva*@|sy~(|OXguq)}dkzo0a1}Pj>CHa2Ps39gWL6IPaQL-KjOp`rkMMS7OJ6QLggK5bi?210pv;TD zk))`K9p&tr@!Fhu@sY+Znnv}K286fW!;7uk_l0zYPrcl6NR6`mRhg`0!$S8KSP%%W_H^hvlA<;HvH%3*S4CjP(nrd3#h|PTA)W z&mgvC>~ntAP~Smgu}?YdTi3~=MzJ4Viay}*heX0wwLOv?j^sKw7IKKs5Pp1*`@IWo zHL&qxbGn84zY`?4jU zPkD44uDfmWpvt4NL2x+6$t5VhEoBQngsHz|Q#t=S?!xZ9V@ihSpA|={t6kv4(REV~ z*l@2LcPtubZomlTT5#H@pVkU{pjj08X;Z1M5j9mu3qqXsl1jpvlt>DR;151soH^;S zm_3HH2lQgzO!{%RcUI;<4?-_xqn8%>qGF6^N|G_O!4Yy<0votXqsS`*_#k1-J8*t9_IX z^XRjYHU;Uvotw`yPSqIi?HaSX`NZV&O?#=y`p49q!=zbmnMKRpmzQc`k+7{hhcsInndpHRz?I@7#7DDcRD19AIhBgIGOus~ z=1+cMmaV{=ZHx)!%BOD!QRqz^YAD&6m43Wrs!*N7uT*KYK>%%8*l}=2Pt}nExbcCr z#;z58FWRyPwGC&&w4*|(Y-Qb4PxX7_UkzIG1`}xS%L;cJe=5acS{WufV)l5bp!fM? z8%FsdpAdt_L249RPln6yFP;GDR>CjHXQ zu)0zE^Xih?xLsUR2DAm%fjl!Sd~ar@eD+nO-m?L}Lc=GUYdYNDEtrrc6e5!^*T{WT zx~_JHYS*U-#Rux+h}I~%<1=i0_(xHU4c=Q1sz`>eVLIMPJMeb9LTV?&(iKH3Oo321 zsdn*PYTq>#qx3|t1Uyx*ibK5?fBcA^YnJTTS+oW%(fukEzEWC13v$KpM)T1L5bx3U5|%WD-GHx2?A1}a z*Lk`wOns(~wz`%pdMHh>jMLkcUn5d^d|k70y(Rmqe>iJR2Y_rjm=ImrR{X|#4d-zU-58+ZAi^lfdywvTzfp${|3=bm9?&NHJ z9>7om=kJ|lU*GL;wA%Zw$lz+^IUDv3jTlpWW_T8l1jp2Ur0WJfo&M8?Jt2fC?o8^t zCbW~me!TAtKMw|;e59DKD#ej7SZ#P^`fiNhtGcx?qhNpWSz{wYUWUD8Ouwjazd_HA z2!F&j+nT$Qx-T(KYe!_Ke6?95@*h0ObxEpj3{Q#S3MNQASqf9DO?|Gj|LAlD%D2(1 zqOQ8bW7m}4L|^L35gy0SuZLSR#|#3I7sEa)jD*u<2Cg5DONXER;42Y}xt*I_r4rMy zXD!|C>}qab^obx9CwmpHx(AnR0#TiTR(aTC?KwJ)-qTW;M?F1^k4PHkP0 zM+4=Ov71-wlK7sQIK8OmH#WJg>&YS>^WM)RV`)N9rC3eyu-%R6Pi48XFhpg%v@qUF zti|uenTysv*JHA%B;l{7>K)>)A@&|g_IH6_Y~5H8mdgvvmSf5rE$e1G8Fw!PbrQ%Uo_H*C)=T5rI>_i}K2 zL|L-=@SAtXV$S;vY|N>BThM&0xXEg@H<;7o%XlXbsqse=jz8U2vdU}io6&wK#726l zQf6|Jf0I+agoDl1r*_jb`|!^@bQ^f}Eed3r)0VXrhtz2c=r`_aSy`nJww$+Uq(^cD zXUjiX-YVcT^C;{?m$tub_M6m^P<9cUy6T488uUn!mj~i;PlPRb5j?Vm*cgwNg0(C4 zna1qJb9Wsn^kp)1^FBB$6EmOjg%a{dk6nqP%-IXbu}Y+gN2ZXfxw4EtOD%6L2g|KB zG*NDPV2!VJO;LsPUIZiOS<`LGHPFriO zdiS(@>fN!ka$xxnGj&<3r6}4?IS{7Yh&{iI2ao5vXAz`1)pbcBJT}RI$ ze*Ii2`h&$|Hqx6@)+|E^t`;$+ys;}j!Z@G3w?($t(;jycc~NyL<;J!WL&t`fgGCBL z%Ao|$Ajh_df!uB3YYt2weTJ$(TYvjpfM2Oe_(ip|b;X%pr4D*s<45W7HSuB`FIze_ zi}|X(`3lz!3|AdAm!L13oIpk34KKR4FePQ#*zakvJkHQ+-3nhW@HF4!wN!}}KikWJ z_va#(81=V#fuMM6v`A><@(;RRQEI? zKO3di30+F1>Uk?y-l3=in>Hk^?%AZXqwmysxm@ShuFi zO^Ty9=DcK~@2)dL-cK@Ad}ME^A0(VUoqEa0{_dE!bi}c>ACOHN$eH_cZH4Wu!Go_w zb5rYsD~^dg@aSMI)vXsv@EYsN>C?FAex)m+_}alEI{VL!6)Um5$W(VW#>=v~;2fqi z_Juq=B{wo!Cta}Xi1~iEuGAaL2X|=mq)B=CIT|IMf7bub#GG)$R=dkaFS)9(=}y|m z+xxZ^hHcR&sL6G~;Qd31W=;ATIj6bwfp}|2r zwVPRoSwi2vqq4K4V{-BtQZq+?Y>n*_iil)Kst`GzeyQGu*1k`c>6p|Wy$e|1VlUZ= zz$nVd2Z81dxdtP{9$1W2XY6|V;yiLUmiu{1VvUn`X>UuD63C|0Nn(pS6xK`Jlptp1cWZ7(9tFI;B<|58geBS*cNloHO9g>YVB)8!>3Gn? zd9v4NH#*~a)-@}M2qN)I5`BZ71YBHazrLo3J9(a@;~86`X5U@1&4#)Ki@#Rx>G@mS!;bP}R76FE zve)tYO-ad=F^i=+aN_Sj%%Ng9q~w)3xaFn`>CKGviPYY5v!9&CgIPH8@TDVJdB#zP zd~g_@O)P+w?i0^^FMlvG9lZ+b)S+spGgS87(ej6~BPO@_{f{>%+&m`jx_Y=u#xo4N-mLAnE5$vEoly5mM=Lh;i`wwcfnCoTZ&v_&C_2?XTLoi4 zdqJum-@VV*RwzZ-W0<8Od=Y|uWA)}|Y?U$Yk=tGiH>l4sjb9Ra&5RKlw1CwxQ?-&C zt+R|dwtF$`-h$=zEtlll-oUb-7PYK&A5m6G21<=pt&E?&I}E+k(EH0jp(=bA$spAE z!`b-&_sMc>Y*pjumh=VFLQo7NseQo&s;d@&{?k`l2}v^4`AKZ9Oe{8)T-A#)j&C|1 zLit_ZD?GmH{dzMjy>Q^545h_ul8d&7du5`fp{z81U1jbXeaHUxr;iY=(M;>(#b zPRt)!eujjxu1*y!#@1~q99O);mw|NHPiMc{aB{mF=G#AHbgT{^P%HljyNoit5$;ZV_^GgKUj-${feS+UapCykHDooGG*P5; zV%!*3s*!h&f&G;xmQIOA!hwMsjvocJGh;!8lCc_?U#C31Y?&U}`;76%o5F!W2cN{ms_ za~hG>5Fv)D$@+>@uT>-VZ`)$srOQbeV!N9pd;nt~-#T*(rA1l%L9zOV)d#c@VHS9E zgu)Rn*)ulR5!MF+b&oe~Cr4L_k*8(G393bpR^o4_ysHa5N4K#Wnm#FaDgu83D#P*? zKB1(qg7M{yl@)viF{@lE(=Cvx|V51)T7YhK`$;H384#n~u zaDaHdC3kz98>GhwjdRuq79%#p4mJD#RkEjFaUHh4II{yzAWHMOK4PBJ1)XGYV7uZ# zG4Pbe^gGRxJt}xRb(Dx?KTqSpA-`T;8`~AM&Dy@ds-RH*L}Qp2u{&rpIvTEO>G-m~ zI0ZVb0LsRWVKvrv1Y^{U5o(|60cOD43D+F6-Lf436cOFh_xva*g&I6iKcFjbA6-BsLG&HKnAK(j8+f~F?Og;$?``wBfWbopEn*eSw?-MT_wY4ikDyDgRj`OXT zo|b+WgO2gw?g_By^()HI2v~QO8vtL8;UPfGUUDVR3DxS`QeVjjr`z&}=Zg}GZuWYG zDCN$<4@{DxpH+9p@R6*0J#&V;2TL7S5xa6?mhN#^X=D2g`m1(a+(J05mTT0d6tLT} z)qW;IPc9-?!qBjWylYgXBWhy;xC>QQZtrq8mf}*FFUnLLu}^jy_9e)DBQ)_tqcfq% zj3|cZCG5#^+9j(=J4!{X2;U0;|3W|u#`ZF8_J+IWxnoD~!JgnTEs#QffBghE<$ZOE zx@m;f;5GmZDO4ww^YxQcD|kAUydEd6!y%^-D$8l}Mm_L}+x^KdXKn$iO;M$T0MuYe zNR2Ku!(90w80r=<1p6I3bPxMe%ymdE_y^`EIXOj3Sb2VqpsklLNshN8Ntl`AFBiCU z2z3c8lqi5f{lJ{WGjo~!5;hbj=Xrvhx>t2b7-&n9zFdK)#&J__Hp{Q z>I`Q%pLCduIcfP`bk9+S|doh+YVLDSn!C;hAL-sL!T?0VL&=)%~w^T zX1ptOdn04TD6Yu%^X(%J8L=hg-5uMQNo7rG`rz0)2;6+LQ}mZ*rKV@yCWVL}!rnq7 z_X*K}CF9YxN{KSTQ{M5tr*J5f*{ZFKu8xUs1v(PCj+!OX5)}zPN>Y4SU?Q^E;wwwD zO#ImBCkV}XJZ#U4s{CY`+IVGag(G?BF44f|b9hUBz-NQ2F_S~TED`Ima4&O*XiGsi z`{V{uSkpn3YqGRR9=B!3kV*Ta(I5Lvdgv1ggmLh#`nTT5o8pPtYNtxntt7_5uu#ES zXN+LSPaO&4>UNe`78mh#1!+gmZj71z#yaaxFs^*B&ap>_4H%+Q?TgLa(wHxUNEQt|pQE zJ0D|~r^{4?rxP1R_zl;by4V^{`Vqd`f}WBm{71}50x{g;DO9cQK^}984dVLQ<5R8y zYL>{~r$k!z@r2BV*i=;;8o>uGL_Ko+7RRM|yzh@Q7OVl1?sD4gnu%zeeS}0toMKSO zFF!A2F_v8jxixW1`bCkGVNdLrOErt$xtg*urvm!nv8 zLPX3tvf-b-5}>n~j+Vh2+m}po+fug@P+Fv>DUwXiPsvm+^G`&%^Uro1I=EYo+5%`o z$9};FZL}D>+4zwY+#c1)BHSNhNiyl9Pn3s6hnL@@=t)8(Fd@WeUG);yaSCh)Pkxwb4fLt&nK7 zmNb&{?Js!v0&G-^rMR$;(x%(U$BO)oLrJ{35|wKp(1jYwqZu@pyL19rwC|v~8ilB? zWSnGc(!S}0DA}-+)0A@hinD|@rP>zjAfsDq5s&+f)DCz7zq5Yk%UiY6XF38iMD62) z5733K3_^Nxw5cV^rNjf74n_w=?OrMBHN5Yina-RgYRUk=8s;*&W)gZNMrnmcso{q$ z$BMG1uw9c!0VcUi0p_196!kD%CFqg$)#%90&rptN2&<5al4$+aOkzm9=g$PDMe*^F zj*$1l%|vXl)vnpy)CS+T`@GJB&o4{K936U_wEshK{{ebhJx1hWmTP}>B`^j3 zN_6|NDcsv)VdFV`l?o!`Hs>EYooxB2C0ossEk;eA*CT6+^d+D4E@D%DC02y^0z@TM zhkAqGxN)PbHiU?r-os(_lUQ|mhZ zRD0!&XOT-vp@5#oHMyrLkT6U*(Z?)?*!P8IML(Nz2wzrC=6I`9H0Q0$d?8Bbmmfcc zi~=^~PN|QW&OM9@JL`5xl0_Fo7T~^OUB`LdKQIAF|Fn+6a*|P{2`UvWG zYsTYkEK%P?wUSj$sw{FNFhnqysB8JdMJi~qlB-njQu!Gtci1$tAZg{sM|BxZsY$`^ z9XS)s6h`29xS16Y=hFR}5?H6HBcJIETfyM7YfopGKG^D~&n?H^+Ezku>YLn|(|wl~ z#ZF<)Wz@z463(krPAeWPO|Oq;`0-=|+$r)YQj6l=aywm#jneh?Ma`Q!q|FJ;N$E>n z9w{3rCKap4=y)|sh8vY+gMvYi+vkFt!ms_N`B|y6|0an~$b}F_&Zsk(qQ3^2bw{`u z{;u>XOx${k>JUJDRg|QrX~jtvZR;6plfNf(RH85;h-Z||A{}CwW-_fS%uEgV70%uhV`Ohb5TXrBoJIHIm`TR+jF6eOj5E$Wv*{b=;!R6_)Fi#CBwk2b(xo|0Vb2G>heP>>SA8x!y0#D) z>gA(bc1(t5iNX)*1Wzk{bhE#+HAKE;;9@6~BdENVB9T8uYNq|w(`2LW&Tp}lx(`%u zd&a7?(VKE61Wm+=)&-`Wfh6=Xq6vQYl-e8HYyl{ek(J=s59Z{{@9m?v*Ka1Ba)=jwCXEWFBHHC%Qz^zO1T*n^c_d@7|X4`^`T8~#P zbD}Ct*cC&&Yi@>9W!geL+nYr>H{ct{W2Wga2CLEWOv4e0iwxJ4BvSc2A;|BJ`ZyUGrbu?C0$KN~JLO?|;Ou zhCffyDH8x&-%Q1fiPdHR?knG}FL4OTyJXTp7nS^^`cbf(a?f}DQbP*il>x9X{J@u6 z>k+PujA=r$Na$*K<*2pjUCI)EYaMKcx|yZ9vI1mJSncz__LFVg~t_{7Ix^Y4Ep671ptW#inyyjYDRy^#u{?3NzF= z^Y1)b4C??nJHPVw3a+#?-XSqgBv@|TvysPHV01pxaLP`sc$s4*eed^hKCF^@>OIL^ zZ{*|V@AZzQWptqq_Z`x5kC`011$pj!;W-|wrm$|XL2Mxeo?Lcx^_4tJM zfc%N|WxCO87a12FY-#y+nt6^QZ3d&s`kfWlOxYMlM;-lz-ni?2J6;a1>LYJ}j>e2x zt+^l^2eTg+73~oSnYO4Jv zr?5I$6yYN5#08I0L-9!j>n1wSaT;=QOIZ@1k0s!=4J~{2CVea#vV4os6lRrHa)zC+ z(J4|G9*Q^Z90#U@bUk;9dUgSmLO8$;2y;lhVT8PbzObnZC1Pdp(f{3UsKU9FlP34O z%veKQMw+JFgW?zWeZCCGQ%ghm)RbL2pW;Qgf|>z7ev*80TD{uhhl7&g!Qs8gveNc* zBvB~*uIT0YzA!y%;^y{HLi44jAM{tC9zzl~oa?jscZu1F^hdnbo!Z5@>_`>#ne@uz z433F7IazaU%^$F)?p%DO_>TlvU3)$7p-W$1z z*YD9ThQdgiMP<|h@?-)t{}O|!B!r$b*Xoo>4fZ$RQ$33RQDvAmVgkdq#JmR6FF2_a zY^zm`!rI%MHW|)ltJH}9^R`coHu4vltD}b_hT;05JR7T_Hi>ocO;Y$EWr(xK`dXd- zRr+((zp_2p*>~VS3MRcOT@dM}Mruk@A*JHk^9`4A4Zi~!E|Bv!Mqpq(q)vOc@$PIc z=6xTOvE+@1|3(9{iSnYzfIBrIKwj9*cd)0pL(DO6xhydM&|R%dB`ew3CGH}xl-QS4 zxiMPf#_gZyL#Z7XkYy*h@MvoBe#@*5Vx_A*$3uTS3}6uu~zpgCa&TpXa0) zVGrBCZkn3xB6CHA){%vjOyu(NWm@|BfE>FX5rhT*0%F_d%N3l?GN#sS&6Is>mC#yZ zWJE*@GZiluAVbFZQTX|@#ZYURX2DwNssMi;QGc$rj#C$@<*Ji2Vt}>d{7Aeg?r8WVr0QM`Ck{T@^wOKsPQsk@S#hj0 z^-LpyV{~j-j$S^=BL{W}9iR68Fv=1s$1kV{my%uLI$X#XwL!iO3Tu9R_AGN!GXgO3 zwDiQjGgN?_yct1XeQItxam!=0n9hHMQff3L<(@IqGtBE`1O3==**Rw2L{ZI7gpPi` z8RsaaqdGw~#3AtIrJ*6WFK^(N#OpuwpB^`>p z3QzyS^t>37woFV~@{%DEews#uW30)gaGez0B{I|gW(R<@C%b_nyl+X3~zWOjt|G3)R>MGbfqPz`403 z6dLHw=$3*5|CB+)S`Mdb+LOjTy=q;4L9@w*O-iJrs>6`7gV_UU5A%fREbX?bE0+re z0SWZvu7X_a#7M-4Sp-2++9RUJEJUdWjbqM6t5uk^g{ueB+HXHuu!la$&%Mw;4` zIpD_&Nk|$4Wulv3EFYy1vo^6Ol3IGRXYFC*UBvWYi;L^v;pGxrZHR7KlX5k{o-yhp zq7Uqh-#&W=c+({ni)WHmLEOTc$WB;lrRXZ@gl{l;APM$h(&6y$an;Qt--Evt4a5BU)bRCm^%%c-2ykfI(im)URdOy_Av&BSL_m=0|MGjmCL6YKS z8TmUk*L0@Jsc~8AimwHT=uh;!9v3B znU|H(?wgu@Z`(bZf7CDtPItU(5mk|P<1}7U>H1!_@T0J)GFJJ`d`{c?Zwn5b!MCk~ z&MNbiL+fai+UhgQEvMRj&Xfwv7iL(=*XGPR^|~M0>HRv1-y~7`Hm**#N2XE<@&zG) zQh^!|ommgFfqm}lOL|eSHH6aVcXDqBXz+jmiKp7y*I~Eb)E^}_ zdGdSe7-Xseiji826T%glV?e_b>|o-F{&hF(dy7CBm>X0>R0xGF5WamUpH58E@J&I) zmWe}5CEP9alal6lSOmm(?OyS!#7(e)QdC@JE>U}F%OQ7pbP$n*E6Q(y4%F3ml5wmr z+4%Or>(bcXbDHeSfxm1J|9&X@s!~&AWJBlB=G z_sf0Vs%K~Hzep*j$C5!z9;YTdw_Q+l`q>b;YY8%oCe8#7sa31s1Up-)jzNxz==%D)dCm;~_7vS>0x-!&D;Uhr@K z)fGyQnvW>eoBH0Ws`#B5^ZR!y=f}k3_m2L&J4sl6?W9o{iB~r673f^XA=meH+jq~R zaYno4R4{MZ+n`g;3|WGPWW={8itMr|LQs9v7Q)Tc>P7*QT8+bGJ?lk3vk8YmyceKd z6e2SsSuVU3)N2DFIRp6_{?H}fvDRYhBl8)R+f$TAiKd-+QQJ&myixxWj_Qq>KNTkTTHhyX*@YmOXF8nFQFL z$6MLl$JICQ!lP~>3eI?gFm+U8;?|w}Kw}lKjg8VvRX{8g0b3e&$2jA4VM6hA>v!*V zqvs&Pp!$9VC!a3wFXw${w<;S@T5CXYF;WyJWeKzuq3ce-tUw)3+rOe1wBic|g?81_ z>LL(**8#!xX`7vZUnV~`aw3e#K42o6X!Z7!2~ew-2b0|V$&eck?h^sj-ltK1SIeG0 z#aDjja_RuT`!7Yio)(nNZ3fDwK--EC!0(Q$J^bcOmzgnt2iMtqeFm|CK#9 z-5vN2HoK0$%SSH(`IC7diU-J++j#NiHgzzif*qUI5!bqk6@xa5&cpP*?hjSZ7v5X1 zsK;XfoykBvWua-?C%T>v?3dRJ<}ZTO^*aQ-Y8iUfZ{umyWPr>ZiG7qi$4|gexw!Hn z9L4KyO9iXG>+T$Dc>uzm0#(_Vm{OUvy{~$kO@A67r&%#0QvcGGhC zk_g3myjF)p)=QdiI(CPNyZFj)Xt>A17DFSjk2N7v7esu^%*UDBeCb>Bgl`wd;z9B~NuT;)7Ph_4|4cid z$|vwp9>?CbG+2$x>d!%;)}PXhV^4p!RVL&OkGB3Mlj<)2{0(S^)^2_Q&GN*7NL*Pz z(>}zjMHa~#%9XnlehnX1Na619@@p?QxM6iLlhOIe4Mh+bM_Wyw z`=C#M7B1&TY!}Yv?OQz46obeg0c8s0sr@K#uZz{Xl0FI_31otVhn60 zyOHDmPGJeDPaXQ{Hw)%gT!+dZtM}d%tQtR7Q*&<`f1KqrFjDC{$d)cHL$ITI{d*kyH*FmB7D_gKM4+UnvgQeg--^OKUBJ z?-^R6B$9fa0>3>10ADN7G#|lNE(XG ziw+l9w%C~Qj>P-YpFo6-^?_VZj702RY0sKBNiiRuK74!-4)jz3{FF#4iBbMEX8RpG zTvWvMC6U)j7}6SuyMk}tCj{*%&vOp|$zd=kAk7)~J%`JYtuC#oi#?G?9S}%*N8~r> za|xveMscH7$hRMHjjqIb_oQG8tTQ|Kbq7D15|C&rxaT+jo!B`-EsyQHeG;4Q24%JY zfi^3*x^xS%6~4;)BEazFiu;v6H=ph8HS! zIfm!X_DGvX7Ddu^$a@zR&(fACR9tG%-~}Efh`dDM!***(YzWRsHMI?_koAqu#j{ ze>?cw6uz}D_}0EkkDZCJ{|WWKp8*h{cOm4oTDJ1nbARIX?DGRqH8K3U;)2Ih{+}yC z6PWFL)m-`C`1&*Iv(HyROwH>{`Oj!@ocq7J0xO3our6fxEne90zxu)dfBy#lm~24{ z26PVbVIEAn#BY`PddG+t*LA^S!v|gy=Q8keb#dg6pZ=Ew$5}u3Z{Tjit;P7|o^GDr zF$T1KpocoiVK@74P~9HF+aO1EjO~v_A8@}^o6y3pzBtEn19v=Wslo005PJx<0Q{*MX&*Doso z%K?0Z(g7{px_%Y&LS7B)hoU5tmwtl%fHLI95u-Zewj_Y&Y}Fm?8}2Fzowj?V{TsaS z;p;l>6FgR%YllyW*K1191EK!T%=ARm>mY-D{p+c2fVzo0A-GiiPxB%8l?Y+ygoo(h{hx6?zzcHRipq@(&KOss6# zMcUtc|Lf5y!;1qQ3OW(}wcCHb1QeRUmhIs4R?*0r^fb?X9s-+p-!Nz)br8is5LgJ6 zOXYvV*Ji0f0b9BxfKaRv+`K^BX$uWka_UW(@GpyX-T3gYH*SK|qVY4q4sn)RYDs7~ z;-$UQ)48m4zn5##?^wczwXwMY6?yN_g!Jw%+V)1P%m&~l`BKruVi_a1u<@%A}8}v zG(C=+9clOWPfG0qX56LtAao|u1p2(dMXh{rjEYIxVuLRk`9-4vD=cBl4o-zC`UiU$ zbhu9p^}Ua^ho*7ko}dhQtPYJ6EYr6g;X;&ij?p)D8qB7taix7`b+I7&ClVX|7KO;j z&vl3ZmWepjhwINA3&8eONaJ2P>z_GhDsk{(_Y+sI;Xa_oIjr8~=j{g?H_34x$pX|& zAoJ0aK#c=C6#Yd97~IR#;XzA5%=R$`MVYwONHIFUa?;t+Rn3FTLjm&5DU_AF72^9! z1w8`fk3d9pi-7==Rm741O^~&A!&>|pVZ5r zU`aP*7)vX8F}2^lm?53q034TN6;yft}_0b)CH~a(QRXgWAwA`#+Yu zZw`7=UXdLb`;)5wAyqAV9sTILxN`Su`p=0m8s=n!t$scQOZ-HC}G(-4xlMM#1s7vR98+$2MM#9v_%in7eN7 zv@K2bf8cNXOhaSgSLRApgOA(r@HcsVEIHJG)2fgFZQ+E`K3!f!02}120@C$14g7bRzikg}w43-T&*J}C tRgDQ)!ScS!n05~jL-;>ez&P#RY0sne1Kpbo!RNpqTv&e*jX2cK84Q literal 0 HcmV?d00001 diff --git a/docs/_static/images/firewall-traditional.png b/docs/_static/images/firewall-traditional.png new file mode 100644 index 0000000000000000000000000000000000000000..7eb2b49dcead6984c7d4ae17c7248400a8ca7f2d GIT binary patch literal 53437 zcmeHQ2_RJ48@H!Iw0dY!DY7(oX3P+;F!m*~rc`Da3}Z%P7?h#~?NZch@l+};v?)nR zixj<*qEeQ6RFvhlN9lj=%)NEZOw0eh-Yb>fWA2%A&$;)U@B4kr`ObHixJg4p3)ErO*M9#0JmGw^3n13A>ta03>d3yQ$^p=^If0E6x?sDsDh3Hmr=eTeK1 z5w!^BL}T#F5Hc_(K+^>EseyDB(x4MNhQVY~weZ%41~|}^wiDHl!Q!&RgR}@1;M$JG zr8B`_Pz-)MyMbR*!T%6$7GyY!tOGuphlMfeUUZrR13ZnjA%Sc_Ac10S2U~Y1M=d-B zd}cC2=-`hH-7ka<-$DuEutPzKH3X3jaPU7+=td2oau}E<;5ValseyvGV%x<;vjfNk z-mIy?VII~jV<%hC4O}OZ&IxC*S;)&n24n+6!57@DI`F7< zs{t3d`B9morCtnwE+8M6UWpKYi19eMwk@3z7=-kUH%8hGrJ{9_7YPrd`m=e0+xbP< z`4NmGI+`3d8#ITRKJ3?MrO+q}oe7gLI*dp^fYSc|d*2NP=N$+Aljc~SWNUBkERq)^ zh|YFl1>1yqL;6S`kyK^`GPZFk(mgH31oo5OPkMv28{fm#+p+)yUCg1|=(JA&oU z2LnLQ7XH-mApQmX6@1}Bic&>9)a%PZO%VF((lLHh7P!! z%ZUb!^4^nzAu>=w7%D)^ICLhJ%ZThwN>qd*1K%|#j;BPY{QZNtumO~Tr$D)khyVl1 zV??sx)zO~9*%2H+I&v30CZDDeZ1*r?3w22#A#eSzO9ZsgF1b`rAf5X+x+DN#wFYp4 z4$j9X2dT~HgiqBJVHk^95l$hKDHeW=XnhL@PY=rgcUOJLNHBIEBh&B@I@b?I0+B0_Ya0McR#^!R_p_mHhOhzEg99(u7 zD5WA-e&AUE{CDFs_}LL0hF~`0Un4vUcS#Ko698=hBMRm~i!hiR=^U#_&=^eHFh>Hk z;|rD0J#)OHoOk>I zkq~}Bi4})jW4M@%Ogol~(K3{#u?+h;JoGORCn7sPMx6fCGSYVjwuS&d zVF*QO>EFj%03O}C1gdCvc<-@Ti$|2GkC8J9Bmqo%6rvkgU`X7LNevHY_yHvOpr#-M zt^r1VbU*lp?%)bwmu6&01d{tBp!A*5@&|ztMZ7PsIFOMkN7)C3VzkGeOUsB3hM{FE zcUweD!l<}Fr~%y`ORe4MP>e=^6p6@eRQ98yJ(S_^4{OpEydVab?iNP%gB4F6kiVd; zyY?&q5HYIpmlV6*VGBZG3?p@kVsvK$Qif8**O$6@)F6LvxqzufY>6LoY6&FaxkW~! z=gqCCx^FjGz#Tv2%;Hg{7XfIpsH%)IC{|TQ%f2C|6;+j;J=}lbnT2o&jD2Kg5og`E zJ+lM^YcP`5Gn((gbp^IK>J9xNxfddLpJT`f(MmA5jCyXq@kthyxgxy#3DbbaWc!75 zSGBq;K|+QB9r8D%lfez$6*6EL7?a2ZDvAFMmBU3nlxX|F8nFic8=z{zwnI43V7Zv< z4{BQ9nJpo#*b|WnL?yzPHzh=@7owp78E5?d2NCV)6ZBZqf*`7+I670z!6Fpwi1;Ca z&REEdghbVpo`G|y1%wf1Kll2mvgIh~W)9 zs-U5~K_naCjdAaPkO@V#r!UVN1XT9De*yu?pk4M{X87mp8i>#Lb9n(+E=K-Dakh&Q zo<<y) z9}i~Cj-DDr3~p9e|&#N~g0%Mfs^{>Qj% zgoL$yND}l|Qbr^i#{T{Z%Y54UZ}t!h)0HqpetA?DVIJWwdn_r7hU@&?3D6BDQC~O4 zONg!oV(lQ*bBJmNU*8TAjVb=Q5um#S?6Fge<{Q8WpdZ?`Z`|GFM3*ZuEQ|X3zipO< zL}Rdi=y}BpZ{0x+`<^$m2!&!e_QzhbfzZvA!p1?*n_AHTnjd>=g}o*{7mh_;$v-#m z2(l=MY~CUFfXzF`UJ*Q;7i)?m&z%+R;UDNmarOF~l`PB_{!c~!yvuj;Gt-Z7@(BV7 z%?XCuNdJbNj<{w}sX{Om?zAUZ>S761RD%$4I{hS6Y#_1N&tihkgyj|VUr?$@QmSv7 zQvahM7JqyQ!9$-!aH8-?K@5AYv!kDlfXLqmv0(B5ic3WX&#&0<73kgmQZ&7vp)n%g ze`fdlKyW^R@`1o5ENj6d{_SS>BS%HhqN91U%^kT;Ub8%ngKcf-`kw)%AIK9X$chN> zoqZ?i;R{UY`-eB=erO9XQz#wUyF6!T&Xj+eFHLOLH+0@cwW{Qy!ZW zGRu$3ffJ?)_)pAQ?-$IzVuYkoc_+0+!}o}I1H@JR&A4#Hl9s5+@T2?Fh36JohQ!$U z;{53l;=V?8#sAcw&UBgLY-DTf9XyTTuOC2$qMYcs|K3obM=`il;hp**Yp@Z#DF$47 z^REr@@b($_+7iw>2qO^x0_Gp|!iCOZfDE8;!bE=A2l-f_g@an4#>Yrnpg4b|9)hah z+5Q_eJt~S#=q5>&Fu%MJgND?-@3AM^Fk*Q~RPX|I4wg0`UJTB1%?W_>fWg`Yi5eOP z$Xf6lTr%NAWHe5<90H`-5peEde$r3?0%N`klci1T!myqk zVbc9qKy4M!m-MtK63j|GeFEkRA3O5VjSIje@m64WUBojOwzkq)a=E30Zgv-#k zc;5nF(0#zI*Dd|OA0yn4Ju93VKsWGXhlauD6wvJeCxCIL1qwb`qFyshU2yUXIJLll z#-y@BX8F@28E{5p3xLy~c?&oj2f0U-L&XXTRIT|EMgUe&@_8H_c!W743m&e5b4h)h`6bOqM@-tOZE0_z9*HFsT=E<_fGkiLfmWXN0rnGch~;9wA~;w82o4 z2txjl?gl*3*Z|GJg3dCU=o=#kdyK~coKVT9*pE&0eA;AC52C}!Mu9g?n-T<0O9fDF>E;f8 z+qvjq1Rvq2;Nzbzi5LY0Lm|%&>gmA%B6>at)-XWxg`=eXpL%vk#L4Dvj`Z+gqPMf1 z3(tW_wsQEKb^dOS8?n(fusaiDGyXhN@oS!`Xoz}B5MhlTgNGqa0s;`-NE0dhc1RO3 zqA@5YqLBT6avGMNZpd+&Yz{Yw9SA1}vwB}D#?62%m|)jE#TvB;9$*EzSbjsK-FGI) z3Bm@ZunXQv2`as`?o1e~h7jNDJ%Tk>x02i+UNq zMe9oJ9Dg0-O6;Q`9QH{_Mj-w>gJisMch5D1o&$j5*}nkEsCtXK352`++nD^dkxSH| z;>Ui78c`UN$&vWeX6j}$83Sh_0dvGhclt!-H%3hrYe9X@r4_L-gS-YtstIkIeeZ-u z3~eg|8v~$NII^k!;138#qO$zx932tu_Q!QB6Uk&D$FdmmfN#SA!Lk15P|mp&v7BRT}%)g z)-54cI3XkYNgWsgsqah&Hbl3tAPOmJW&e9BFiGerUy_hlt;cG>s8jJ{MEygGF+-f_ z@+j&J!|1X-#()-U&p+clT_Q5sx4$bN{vk{3?EVJSxw> zYsWkqhVoOmgFWO}6epuD2GpZTfKa~#2Dp2UZ2#ik`7eas;%yhiz4J-q1ts6_9lXi^ zI(QqRi6~Gt1rmx){oNi=V9&rtb@v zu3uh7B%!McXpdjYDfqPm!(g=!9=eZt&OVTZ;m1p^8o*?P*@9j5aJG2Cu!&jH{u22e z5OduKjUYhvCNbLy=Vsl_*Bf1R%yU_)8aiP}f*WZH$ zBgm&f1QRgwZ=TBV$$%1+4nOH%L6Px0bIOWP9hxx}C8sYhJRuxOXtyC6Ux4=cx4p7o zU3?;%7zWjTrbwlR0r|+!!$Sut$@%Gwzec_|BQZHr5p4&9u-{^iRPh4zi?4lsP=)y< zh@$7I{-_`dK|(HLJVZp-RZ&d)7jP63wx)s0MacB|hLDtx%^x_C0>y0(H7v-9?N4WR z+mp!u)}KKQZ4L<*3%AYT%OGv2k>@3aQqh_{j?wvc+Bcf#ftby0G zN4xZq>Z7v|?`>|D{|PRbBxS9zqhCUtrmwuJ)EZ?R4YwGn2R;r(J|B(JH0yo12 zhg2PVA@^T=U&nSyTz-nH6#XXuE7d-rUCQd*XIGV@2F2?XDb&l>L(=Dzcu~f4s?F*Z)NB)Mg{_Mm5U5$*KmuR?3j1he<3~oy&Qu zCut)WoixHz_nh^`wh?xFWla_5Dj1C~H+Onol0RfwzcI>Z#>QTb@m%z_fVEsZgsum- z;*vZ9(oocpIj(Z!deWUinjLxzD=v(%b~=~6#JI0@Xx`{Zxp@jq8Qb4qH=QV=`Tpu_ zGb(}Q*vI2YMbZ{~Zkevha#dEi^lP*F+JiIfo{XOqJa_BHf;#f8iFcML-+Sd_H9Kon ziK1zqGET+D#qrdT@b#8@+n`9hKNqBEU7;;#_puC-TB`f<>YTWZaZYjB8%87;G)<2_ zbL@oHFHo)*sVi-<${DG8w>YVJostfv%b}o*mAVQV>q_v^1od$qX%fN8l4hE)wt_) z$+dj9rb_&zHxg47Zz#6YR7@oEUgCB3&s7a$c$_WwjNKCxmUm$8s05Ndy^>_5vXB#u zo7FZpX7neiI|^U!HusQ{zMgX~W&y*3q@s7LF#6XnA@vnz&My z+hU0jdfMJ}ilpqyS$#F6=U&M#J?Ax3@{+eFT2``2hXr8`)vVBpR z^~m#%7gjGQ-L&>`GDXU~A$Zn~OPOVQBVR5b)vImE*r8L-2e+qq7R=~<{Eyfz>lfMH zO))dvo^Aj5WKynGU4?n|WglyWH)})g%#`i5d;b2ap}eFGMT1N)sZUDM3D+n%-k@xw zY*nhKSAIeEyzDN!S*@Balq7q$T*HEjlm`b=ZsB$vB{fY?ee=lvrnSP1)$V_^D5z%z zpLWw7PQ7wsT~Jz(~Ug_nKfY+j{ahxP7|Wrc`5RCA+J}*X zUNm$&wZSDjowSQx`F!uj?dlNMjg^`=p~Xz!q*a*|?`75J;KT*bqGgniNbMfUIe*;r z2zZvS+O@_1k6VD!*~lvK-UWgp1=OTg$f@ zIo2KAqPCNL(_W3m8kL}NFfV?CQtnRAiKR2jhLq&E_sOxapSER9&b_Dk8*)`ErYY`V zH#PibU00FnpN~9_e>u^1NX?wtkIv=o$X-mEst`TO-!NpqLXSuL?Dk%c^Jn zl~MELLI2jtvn_d7t1PA`omzb+^NsqvvI}s{GU!^b&Ll8fS8kcDkaNmxH(TluTkWf# zyF}HZef`ue{vDn^bsU8!=96gPjb0xa5aCgNu!Fa-b1 zmqh@&ni6c7YusYyr0(2K&evyUlJZlktJ2imnXZF8ny1&qHc?`&6=IWVvaz-VmlIK^ z9Zt^q>!scc2#mfC*;Re)pV~ZE*^w-d)u8sC3Dv95sX|;!mk2U}kHK8at1sjf!n^;h8v-{lXal&E4Mp)`gu6Pb*_r48wa_szxYN z&R@EBV~yV-U-!(m(3m6RVnf`97hD@WD#5^R&$%NVy@FRqS?s^S__Oa69=j0>pMIo}e&vtB4cRfZoBL?U&y~3`V7-#*#zfT=AE$%ESm6p!*X}VJOz978 z>i4=8#6y^EG;^>4^s10vT9SWbfm)|#{b;jB zS-0JGCB2SLI(d6w{{>x@Z@iscH>dB(+t<& zd1|jMqn}Xfj<;|9eQ35XHMsxt6^Z=bm{RCw^aX z`-`G=aoG~Gdm3F+*w>dCb8XgERa}#ANP_gZ6W?BoXgGhva=H0^O(*-oe&;pwyMDb3 zPaBK6Oq2C%wpw=4Vpmm&sd`}5sgphthBk7Y1sqF-Uiqo^ZwBN&3(|-mU6-G2A7eG; zE-Rei(QGK?ak*evRJC8^5S+epuXG8rPJ+wfftDku9ci9*!aZWM=e&jTHzp=5F?(}# z;OR)SezS*D7LH?hB#tO2LJBjry)IAiHT5-pvQ>7#!&jXO_Whwn-h-7^&D7X>e_iOc z1F9bV&j3ks*>6{A;V+Q;5|+hH_>T0vTj5D(GdxIB0*6;NdfIc?sauA5uRJ3kuBElv zY~zs?lxumpH>MU|0JuQRR8h+e$vN5e==$Emj;FIGJuQDNsj~3x$PH6Rg@>0$Fi;}(j)p) z)I4-`+nF6{a-n4d7RRYj6p!6`#Ut0mu4EqC(l=G2L!lNJrYD7dC298Fvgu^m$%5)@ zy8=(pJBJ>5cDJ{+!oCqMCBfTrX(0q?wCue%v7o;0?6P%olA{uc+VqRt%qJ{Rx0Iiq ziF5Z#Sw_e`z4_W0+IjUkP;8lznf{!Sz*1PEOfOR&^mN%cdQwg%ZqJtG^xtld9>h9f z*CZSD}EjIe^}g zqP+CguY2a_nR#rUM`UG?PFU<>(9YBJ*B5SAm$O!A3R_wRRE+^=OuK3}c|>#_$c(Sf ztSlc5`D@7zJ*IlZ?%CozIGsDgEi7jS|`Q1Sc@DX)U^GpB&Wao%#lVT&hwtJg_o z63mTepH+V5$XT^5d{MH+-OU5LD!}kuxxAHqVY?zB5sWz}FQV~^S->w@-gDa+RzrAB zK%4YGv6A34{j{wnTd$a}4voswya&;=r!?cAU7tGt%}o=H*$q!~i-RjPnlIhgUOsY6 z`RyT9S?SuGWGlQH}Ui(^6&<-|6GIX7c2Sh(XP3nx;S1KD7BVBQT?V zuC+pO`}D@9C5P`NYS?ec;HKp@rEIKjz8gF`afDLecvm~k(;eEDeP(WRs+*R5ZgVIY zeA%sK{YMjNNrTN)jUU`l7{V);NjJ8ds{d|9C0wuTZy#A1dKc;&2%9_YuUl#vOS4B_ z^lBS(+lPGzT6E~vCfRKlb9QGvuZ#_5Ds~Lk+SwTA6IdseE-_D<*)r4p>BYfCzZMaF zt*&YJ6xSwEA{{8*DdBZi`ON*eT}mta#wEsI zyH0dbwbZuR}f1qw%AC zLVvMVsJv^k>*@YK?6j26Oe?xtR1)_@s^*IS{7vdf!yQK?ICrE!+bjQ;XE<`utkf~I z#;`JbuM2uZ))a063Pk#Nr~c;t2m0UjvCb*<8NFslHsgtVCVO^e8LfT5nZ}~kMFB<9 zFgn~Z+;llawI7t?hWE%C@EB4c>UB-a>RJ&VJS(jO9uL9*r<

QGc*H+=zn2kRR2WV6*O>YwZ!F0n^)g44BS zR*z(E-!025dQ2_aK4Yxh{E{_yl^Kl#Rhv?%nv1Js6J<>c$hj>8x zYe$ya_l0O#18b}MT<>qLQnn?o_PM~DaN^fFt!p}cl-tAVweo0ox~oXC!yXNQER!u~ zhR|-;xciqxgl;HjTAivtL{m7Zy7noDbE1=3=CLu=jn)Fofrya{lj;d8HIBZc^@+D^+ro45rL-)l%zgr6GOd^CsxpJ#1_=c#`7j_eSO= zq5fXdxeGBBS2U}QTeXUP2CjX(y3?Zd*nBA^$=q#T4R^ASGKzEBcf{qzbS46#eCt1< zVVFLr^}wjPBZ8il+tf^-cSF7KTpUTV@Kj^L)$9#dZn}+?YLjC{EXvs2Fvle1&YP8v zT?35h=QF0)y>FpuYVtmb`3lD$#JOl#nP1M6ek(oqR_wlv&eo#EMg3~1>Ge|SauGfIB)h26#&mWy$Hzxr+%4L}e?X7#IO=TbWWbKLPNgR}T`gT@< z)|v@pEbXcmlb-*2Kka$&1s3i?|Kx|ZV;42gA8MbawT`2Cp*Zv4{7GRKvpavaEK1sv zXfZTu9g*?2|I6w1hlcv7`Wv$M}v*y|1Lo84x3CuGG5AL~=2y(&s1i^s233Y#sT zzlMAK)my3IkvTi!&#-FR1^{%6P1*6xNZ##NUqNansqi+3%ZWX z_HVwfE91Cjj@IOd%PD3<6dAjAd8)r!SUmHh`Au&1Ue*9N*W>1$Lk1?6S9s=c^jCaz zr|@m+C<*=8Hx7Z(+7I@cJ+F=%l82L2l{#StMrH^tce0G~jj|g5okk09+jnI?*_y6+ zb|AN?{-o6W#xm_?7A&1M1)bH4J;`qto8-Dca@heD(Pk4gE~RLes{@jY8D;;_)?UV6 zWo}I#v-0iwF>^ML-9F=wV}r))h1MHPOga3QMd<|njhf{;pz;JQgAk^qOoLpCtmYmw z)~MosdcQ~|n8|~|-7%PAUhiC!)A&|m*e~`wvwu%88wT!poDpzYRSLMm%l+Wa^n4y} z;CscRfmi(e!VSOr0S|eC*(#uBJ~$B8tHQ9wqKf4|zv2(>u@x;xi&D3HkGQfjaOk?f ze(mcX82`uP=aN9rn`k@xMr?bM`5dL(DNc49FXt|c{>{YPu%AWs(H$#7)umQ7>J+6z zGRKwz0`$@fYDi^Gcn6`V}WNEHKo>Gxp`kI;mVok-46~Tbj@($G0E0tVr*w=Rs zH>P=F(R|5ceW#7h+RaRzy|S}aiRZQO60Jf-eO$;A6PL@EobWY|Ou-9p9&)GNq+aEW zUcEJsb!Bi-^h)inODc<$Dh3$eZcH*S3E0%zRGN7=a{R*#(-}=Vx>WVNIUQ#8<9Npt z9ybpr*Zi5WY;LaKv=Zid*DH2=0*}V@8b44v;}#$>?(}(89bUB!3n96FLt1E6OLpfS zwVT=Nt`1|{Mx|?48-`mcR98OAPpRs~3RnNLA-&>gw1#rigQd^$2Sk@`&OvN=v0|Uj9aQ2AU!-HFSqGXT6)(C z6D3O3X)S~Gd)Ih6_bR;CHL;>tm7A7wS8=3lO>u@U<^EBVVb8gH(w}bh9RCZXVBgqL z=RGQ+tL$jouTPWATQ#$_AE)q^tW>(VX8Hp)v-?^)HGLjEyemEJ1hFo5p98Of^EfT5 zd1he#>ZdO{Z>P)cn_JWCjaFc)wo&L{N}XY-*&6~)HFZ+q+u6`2{a-F7)5f zIpU$_`rOC1X$wL^q<+FSKzBD}O>vuoP#`~?{8I6zU7?T@DL7i~I{irz}6 X?q^M1yhnG61o*MDnrxY4;k)2}L%0;E literal 0 HcmV?d00001 diff --git a/docs/_static/images/firewall-zonebased.png b/docs/_static/images/firewall-zonebased.png new file mode 100644 index 0000000000000000000000000000000000000000..46b2f6236ebb42fe6246579524e3f21d554f1501 GIT binary patch literal 55621 zcmeHQ2_RJ4|3^YKS+X>w#gXP^=ewTo2{zQ%oI6`+HWL%mTx~5i zBPJ&10N`^72OID^9o@4W_`~dMq^ZJ`UM~ECiRsD^MSU~H(cPNhfM=3Gs*Zn>K)`H? z&J+oxngjxYC6Q!s1gs4i>*y@wgr@*azAeGTD z;1>)fBa4yUGJZYQ2Jb|>p&rqb;NXCjKxm+4V8E@G>0zx1P86cEtprj9IM#Ne;2nU! zKr`^$z!>^1iD*L-waQ|+Kj)|dJj!~5^AT; zdbGU`*-g(L2ZLLVzl|%N>`Wj!(Ow=dgONdxpP+b<@Z+tPWTKlho;==60$$&Fyd6nx zL8?o@l!3me{~=XrqYE53VS#5H8+Cm=1(*{G^#(9k0^V)>J_Oo$Yq+~iEz)9>1M6(Si1Q zv}>rNHsK0tgRvFXfw6TH0Y?GIhf1#~_}CC5VAQL%@B|xMTF(f1+I=0d;I*_Dakj0=J`^KKj$(MUL*Ocn2y8gTqMc2cWe7|93wP2Kf^Q{hix6 znPN1|C_7{~5p3~9Lnk{;k{Mi@)`u(B!G$)q<5S{H@c;)K?}SsP&KWRDPDCf*DivFb zqXTdR2R@RCE>5^HFaYRT1&4LE9Xp_&q8=DxDF7u?*#+nb29PPh=2QYAVL!hU?Gf;} z33LASk^Vg1ns|V_DP#}erf#1}0f3>ger)Ne0Bj@U9k3LF>qJt*(kRmA)9t3>DaI-P z{2+!z0Lp-;0J#iB0|t=CP?+&Y0(){Mx{$5#v~N+zm1E&*($ z-WlwYf+gGFDgQ&4NB~$h05|~$=j)S0yLyZhzI7!7!>H_V(X-cARk0#?NUP|WZd9{2 zF_MPMjlam($kf>$PqCsR0hJJmE))lX6JGTb{!kmOiB1$%q63i(TqJ=&0{=9C$3vE{6f1-S9M}Ux^5CF8&#aiMW z42jMJ%DBj|BvL3uN4g7?9SAm5=AaNsKr5DZWCc760RI#CjQZ>}9EMZbXzZBAqtq_3 z&ZKdmwI;YzIZ%Z}B}Y72-4(bQmA0uI383AWkaBbfUYTSogLQL8$ym8K0}q8K@36sA z@NQUucD~G`)EC3k2z-ofzdpU6nd1}XeBuwdER7#PVujI;>9`m}n|69G2HQZIrf1mi z;h}$kIBBx;YsC34Vdyx6kC8XxtBmxEfh`(9IV#YBwDiwoEdU-9x&&0wUj%CrG$rb5 zfxk+_uu*4de01t7^6HHAswYAt7lx1xSwBDeyuYbl3DQH_c(gVHZX z%U=XW5b=Jz;((z|ImkXB6oWlZTfG56)4}LyS=~g7rX|s-xPVXtbbESgok)jMXauw- z2AK`Yeo(YK5^y-GCavOTOQ7J5NmwhY;^_v+U!ZNG_B;+CQ>ey2QtVEIEjS2cbW#^J zh3<@`wSg4z-%DKtO}CvmwKQAex13s}?BuznjmGqwTSj$XTYsE8e#@CffJ!e7pfQZ9 zGRUCxsxsL26EQ8Ls%)^)=-}AYW6XnV1lZ!BH}tpU zUN~mr9K+>kS_vI4gPxn8e3BVuE(7m=!!)pTAX?c^RJA55L6ZyvJRFC{V}LJARLB6s zKwcJu#LAAH!ICMUhZ4L$V2x-1{u@BmqS_A5fCfvUJN}}k^^4gOlNEauZ301w@Z(Jh z2I~cdmchW}KmX7~JNN|C*0ew}>L|Jfs>(nRit32?ErCvck{JnSR8yu0&Vd#XoiO{| z=N2LR%S{6 z{dnF$g0k=P6O5A#*yZ$PhQA-zp!s~imlpubMGl9W%65@MSR!Sqw#yV|%4ADseE6sE z3jboZ3IpZIO^T@fcw%Q@x5-^jUt*^@js6Dm{~>mO^Juyv2!8ZokMBu+7>D~QfS$oj z27N+cPd}d6C;I{>_c(oNoiWJwTSp7vFq#Gpig3{Art>#~p@E;<-w0|$bSURK+Y zXk&z-@wkfgIfdGUn$Snhxx+e`(lV&&Z~GaQ|KvxHB~JgzkEW)N+YxqpZ1zN18%rCg zI;q>Kqt&eKzb8NXPvYrVhW~U;Je6nkQiI`kdg%zZfeISEDo6#CZ|C=qrBMHGNzqf1 z=HFNG|M)Tgjvtd6=%L1XKs5{fFW9S-))Y+caysbnQ_?b{3O_!!baAvF?vwux_ssZ1 z{QABZ29G!xx&zVf$D5*JGEfF0XhNnTf6q@}IbaLnjR{@$;Az}$!UYGn~9UhMx2eYs?nzJiDc0&;r~|l&!>7Pe=7YEcGb~l~IFWa60`VRQg2XDL+qnR4hR+{5P{yB+-t`6W-rO2rBJ7xL`{L}hUu)H5y zo+jV_RQLNraz0Y^3yDkgtVJF1pSQXn#@)rz!^3T-vMxn$(+*R4J1tGT^mjn%7wUwK zS4E_*o&6-~sRwka?_XY!`=uqk4wK5EeX4T?)=c@k_0p!S`Ub|0!J=obcs$lo27#ki zG<74A?RQvV$<%^rOi5adCd2RUPoF%u zv@j%{oj;X79Zqv!gSz6s>Q8qt++ZN5C2wZ81&Nck#=zb6@UVa1P{6wrD4VG(^=0IN zRn@?v7~t4!>==!pE}x+ut5K^CQW0qEfXYAMfgzqu04jh|3nq@WeUXpHwQ%4n;EJ!2 z^tj^umFsAz`irf<0n4L;*aR+;1PSxU8!=!?-RB;sqYX194>1Z}K%JvX8z5hdTIHH- zO|1h))h=YQjwFDr$A1Hd4%9+qmgEUF1Y~!*P-_p575$WU9;?PotsxDEkpQj$1Q&Q7 z_+&%9PK^wdx24{Kt}Eb)e!i*%^i@r%{QO1U{edzV4U?H=F!@f?ZAr7tq&8gf580K-C1tu^RD=g^%e>lrh_8tgts)MFOn`01QL9MtTII)>Wq6 zR*m3j1LSKv5G;Y;SWg!+9++AUU?&4S84Hwm*U)w%xlnc(xKMyUGS05RwgLYNcEK48 z2pW;mDVcy%2Mjq)fG(P;0n)~QuV+q`^E)p7NT49ocCsPkot^2$;<$v9K&u!7yERZn zD4aU8G`R`P%%|@%P|VMf076f2|CY#uV-PYh8tj5tF@?|r9oh6`gZTN(6B@~X4IFHM znqmMUP~rG{40;5NwowJv65RA)tP{pXWAy%@@y}y^IIu4Mr|RZN#H2NtQ`A`n(VKp_ z!M2}=OBwU#7#QoD?wbiKr0DQ@lA}l&jt2IQ0icw@wPZc^1DpZ70;}tOp>Y00;8y`A zQx!(FEmUD+V4(`Y2TTS|tqu&dkN=@NL2H%8j>9zAXU1Q#=EB zG3`!NBpZLYv4*kl&^;KnyUA_fTYSF5n4tTDTW>=7e=CBs6>*0%)*3HkMRX)l_bI?@ z1DpViv!%`W2Q|=ZMt3c+^9!(RfsCaC*2#Vc4)02!Ry0-taQZvH0_=@L`wk@%R9?|U)^7HW@V|F70|Iu+2$RA(yq%tT#V@_EWtd%_#Go5hYwiZBv z#cwd(IFoLo?YTnLofy~_29twnj4?F0%?|Zoffx=B6OCqvc*!3+5dn@ zsJgVV<2 z0PIjXMzLR;=zmKTf<*UCSx7U$elbyqkOLCdCP_n-Ea-Fp=j0(0F83Y%PG6x&!(=)N zH=@g}D-`MVwG@}5Cp5)m9 zJw0@Q2=328Zy12}!a>shSN*TDD1BvPUA(g$%FIC9&`k%0QP=sNIR6C4&6L?SRCgww z&G=_e#s6|oMKtIsp$Thn8$3GFMA86a0%_9Pejd`K8PRko#-Nb>|Kv1PdK%NV%OsL1 zwnQ6haWM7Ity8!eXaN)YxaX8cEe#Lo1^JZxMw52Gm>@?^HZUi<(0;s4iv&ZfG%^Q+ zVj%tg&(a(8=mRBqfqhUv@0&|=Cj+|U_e2EfV+2!VVIxr!)gD=zQVPVb{vWp=OH>|z z&hL39umB$zsQCJKXjlJlwW_{G`(I<|-_pYRv}HMn*ofzZ zA(;m8zZfJVW|Gd z!Df;NoP|ibEj}jFCn&$^)YK_0sQ)swG9}E=UV~1mO_>S^fzophA3nXpPhYnEFSnFZT zj~UMj{JMZZ{}B-M0s<{JkszjE`RO4MXoO5B5g4HT|L3?E|N0b3Z1ir4DTNblM8By6 z(?IGM(}B_8@)epw3R>C!oC+*EX)9mZNnW*Ss{w;f#jg?dZz;ymFvjpG=nbROWv7h+ zKSidH29fMWT^`F2GNQ9~H2zpS6nbHXl9Q96vvuUb)%P?c`n0JK9f?d2;WkCa&EJ%6 zRH5@gE1zi z{_Q#rm_N)<&-|Fl3a2d1xk5(~(}eGTrl8n&XNLWvVKFpKqo>IeYSjP$X<(qf_TyDV zSum;q_V}Zmg8y}57**|~4&B#0XJ4qo@cR{4wRRwow18Fh)N1kL!!|`o`$yDwpqcA( zUWGAgQ1oI2PKL2O0?0+sk zX_^=vs{JXEiX{Q^ajXsx9wR9nPmF>L`XV@&0pA&0>o`HmSn3(#Niz# zEE*g;iz8rd$XG|(3ECHcT6;j5HtPNtLC@p-nV6O^X{#xlxSRK!V83dv9&>jO#%P8w zceuu&fJR#=`?wV|Ka4uDpHInR6Gr(u0DHRz_DuFC9(@ zir%+q3rm7uqxT04@?~RGpO=mP`|{T(+)hdwMDBX7`}Y3o!MNFy^H!tC+aZmxCWH2fBxvupWTMqBDfT zR?X04db+JzfTh}J@wJbAEXTPD@AhKyx95}d&(6ykmS}xr?NYx5X~EIRrOU2Aqn-Ia z)7BilgE=Fft*#dM))&lOqxqD(K?!E6Z|7PpzqqP@mr`s2U#o7bVe9pLr~GT%gC2L~ zZ>~#2`i%Nqxc1Rr)b7+41Z#?lQXvUNN)ZdF^*!xlwax$7jBG);$;>_S&xGL7epZ5K z&aUK><)+R`@bq9D8tx>zsc*(P(3C&#$fxW7AIvTB9%DXCI}ln)<# zgzxGw$FUwfbZz$48uaT6he}vs={oIrlci%M%~>eTZIp z;e=sVn^pLo_{7k%+r2FU=?xY!z~jT@VsTcIx^mv3(%G@e+DRq@YP>wcFN$tucW=<- zs}k}u+IQC@KdF~}Ks!jhJlN&#sYt|uzIgm_(rN9*&2cZg(suaYu$EwZwywnAY5^Rz zx%B{)h5c-`c&ZQ7%RbT7zVe8N)^qO2s#qUg!`U;0IlDvf_RK8JHPVBg0x(sDRwOf6rR}H=ol#ouMtZ$)q%1g zTx8a|b_bIYyNu8Bs6t&2+oJ$(n>CLIQG5XEpn#s~do@b_-1a0m3SSu8#3>fQ`IJ`y zI29}1=t$Te`7zb_V<@yil>hb!p^&>^Rf#y#a@kU^S1vnQ)893oH3)p1%cro=C^iUN z{_IHEgM`xXcaG(kOX`s}*;hVlKq4ag+Ht)}vGy5e>owyOd7r%Czp_L#`5cn-_TJHU z@@w_^GPcZW{yA6s9|zveHZu=}9)I&DDnVQSx{8tY;v?S8r)z_(;VxN1$t)*`*NfAJ z3oW9~=XV$P6CO!!VN1@jF0<=gncAFnsM^)T5efINx+jTpl zKEBoxzn2-K8XBziazKHQ_g*mX!>QF_D>v>};(d0dVNsY&?xDgZ9EtD)Ct#0#%3SLm zPw8cKs;3{})nkRB)(j}+8bw1?Rx9pux2-J8sPsV#;<g3KLE z=jM$@1?O;xUXY^PYP?pIo;iVe=R0;Uv}fM z#@mHig7Ct4Gp{TW7)#>46QmvMP3DGjF4$FxOHt|q^(dqMGU?5lceT!~X-_}j?}GG?y`NZ2$D9hco zgp7K%Ijk_vELNkUG>NNCH}sWPVHMZgnJbg~CDS$i^B$;iM%~pvN*WQ`>V$@SHs5MP z2QJC#=M@Wp_%%zh6fWJu#)QP_iTba($-2XFZ&Ez$K|1@BkZ{#V!Z}W|VUq$RdqAN} z|5cJSqDTzy&BFT%(ybdK_GX5;d!J-dP*>Wh#u-y!HE7YR zmyiP^e`vghZ15zl;Bs|*cPA(zKY6s+^i^;(i(cobfx$y(ce#e(Q;Dr5A<{$p3pAsG zlv^acjal3D8!E7u1MFe~oB8Ypw%}MFy>ygjkuNd~5w2PH$d`Zdvo|uiD~*C8W^7oe zjGH7b#3Z*k%&l(D(L(o0=ygK+m~yQoEBMdKyH#uA0@M0>N9)j3p!)oX4-B##h*`GO|ijTuw8!4Fx^KTx45l z_;E@3jGG+C>k~TpeHSy2YV3C7A~BKtM`Ji1bF_9{S~EIhPskyUD6z0QmQ^_|j;xI{ z9XJ}d?s=_Q_fW^EBU5gE=$d;WHtbPG#+htU)#v@>l>jp7T&$~iwZJFtZpwqr+c;Np z39~jr&O^Ke<%Hc=kfaaX*#3@S5hAu9?IX6(!=XD9!vCI4sW3j1o#b=?s>UsP;$)IL zpV4+6g`3s6HBg~+^wHz5DAq$+WU+vemjq?#?>7?(-3(+WW^ZwiLB6OA-Fko1r+%R&uey4(3-g6ge7M9G;XaYu6Sx4#kVj zd%Gx6T5Ht3;m|5$qm(=0r-{r>A2kn~+t1Mxp~71^u_jI41$y;nM76GpO^hF)<8kag z=e$(5LwM_1#exN((@FPHpaWvtIqC!@$$J2{uM`~_{5Z!O3- zGYb~c{J59fac@?IxMhcrCjKTHVQ=TI5ZR+@kkF{=`rUi9&$NE@uo{C?muSWc}2DNN|?xOU0uHvaTV=E z*qSw7+WFQ?gP}r_XLnjA+aZk)cfVGZ*MJCWYV+E^z#mcA`M#{~MCJ=w-fM#a^3iIL zK2n2{SLG4pmen6l`#klTnSU-nAtGs1OKk1Zp+ux0fo0c@+XDHonFvB5UbAH-f}vjP zKDrjWxWtwVvu|{F8s2#OR3_&I*FmVOTSFi* z;O1id$tsm6!M9#-Y%`?%g}!~DM%>t_*0FN)!MKZ6HD%e4+~4tXt>UOJ)e;y{(SKUl zihuPWwfDGlUk}$ilwS;{zz+7%j0&Z7eOXy8E(?)f~qxlfJ89rMy@Ph0ex_@o65$YVuRWUiE-cjRR z^`hha@WFd6zznhV+-YBzLwdDavwOG2gY~hN8g|Rz2N06{B4t9Mt=Pia0Aq`hKH`Oc=3t+W~a^0!{In7g)v!KLIBV=XtA+;CL zSGdoX87%hae_|+Or@tPtD=P--)pFseOVi$&28!O1Zx`n1oaa$x_sZ$XIsiS)y0XM+ zWyw>F%QnO&b~rAVOKOhB%gTOhgFb@})cZ&0pLyzKclUQ?hAQX1Zw?ZXwIp0m%L%%* zSf%rfQtrLfsM8y?368VsL;XkQM>g9YRLqEaa5B8*^KxbGjb7P*9ffB$(y(u z-iG!ID5{QcgIfk2z!f>A^1_SC&0V*6)b3QcP%)S|!%Go`NrV$NEDtmDAO@3Y`vv2J=!LFR-!Ze?) zVljLtl2ctN?8gj3WUF)Sa)OL)5)W%>7aD5L;6HX@bPu1^9@+jbAs>VDqLl2~64_Te zO-)O;3BhZ$XS>W(6(AR>K+MqF3?L1qD=#-zVP0)XGWUG^OdFpq;#s~dvAf=8$Hryv z6cP{SulXRV*JQ$NkTdFleqDgcLF$fdeI6A}84h()2kbbL)~5%de8pEW{X7qn z@FD>z3*HE{3c2~TFK-R>`D@W0ehv#leMWEA`c(J)Ih}289T!)}!5!Nxo|Le6E%na{ z7Ks*CxpLGATSItq<|RQTByi8`6upL0RDNG;T@y;@U}j)fqkPm|Ve2YrRS?!uiQU@8 zJcS!>QmeEuYvj5WVz_Iyk1J=DiJgvz>((o1C#B^fBMWn+-Df4jEcai4h7_w7h!M9P z5Z`{E*<_wjR~KnGbQ^B|Ik%T*JVXk^1vIw9t!J3ssH2qRypmwoIte|+<#O(5pcSG% z6nb;cntA6&xA%^`PnIIsyPe(Q6q=C2)`>>cU)A5aFnq2quTfZeO=L)SmK~v$Y2y<& zt3l!k#ELAARpyYVn@C)SuT`&S$O&gJfbR>~5NK-mRzs}9D$h@nt;v;JZ_6tDyn%BI z;M-pGt{?Pp32RsZU#yC?OiuAtaJpchxaY-|ykonNOY~Hw)DODt8I3;e=KZL-+HG}m zXPK>3SP0Uh3D!b?Q|KjNE)GxSBiEq_b^5{IZRPlCyOm zsb_!bi7L@y$q&TZQ*jjbB$~g7fLFE0n)rotWMsW3Vnnn&H!Y=%3 zr&n*>@H8@LAStl?LKOW+=qothqolI8FfXmH18W4*ndGdWlkyi4b*z| zu|0<>Uj21<$vojhr^I9SMZKHNi`n58S!{Rc2~!n`nAe_eemwkDVZ7~W_o~}R?_Xcs z-V{EHm}3vwi0((`W0-S!mk@Jw*AKwm<5aJREtYCZeXhazOhxAG;Nbn6Fv*dt2C>Gq zry>PHm9y&_2aaEna>KD-M-gAG^t|GwADy$1w_=Nz^L)$Al8=Q|QQK-UIwEPFq7T=- zzOLpxc-(5)Xcm=BH<-2(1Xyhg8{=! zbBmWCJ09*VIdQXG!(PAiiCe|ywVo|cLk+d#JT0-Zhfo$u84lJa+lm(MV6Npf5dbWn zf|%QV7KIms_*4u+t*^<~IBiN%-4d74e1^ zuF-&O*FYEcRk&If1_L`#mdmcbf_U*d}rAcH{0u_)|Djoot0cKqIgtiuP0o; zl%=0><9gbfq+{Vn?yKy}H9onfN6KhZgAT>R{OVxOEVN(NM(efuFJYZGp2`=sP;DKj z?552NB+Zi7iOgy+T&J2}!B=i13Ezj3EqvLScAOh&y8!>d>Veb&1>ClV!*_#3NQF_Z zR*uJT`0lKX*eI63Wt*~+cvQ7&Otm!ckF;MqYp~h-Oz~ESyyAI0u8vV=j}HlGEZj>t zHUI^5j~@LEOB`cy_@1oTOep5O^yyO(D(~ksz2lsncW}pO)zX;Z#Q5tuo)lZ@g4xx_ zsb&EH&-YJxY_T*(;}1srJOBJgOUS z9=Y0*AYEt}P=9%6R7Mh;Ae@h>AxgD=zqRkuLnG(^ihblIzr+_?xp%W^jpk z6g>?ajK(SyD;(Do3COu(y$dT-%mIg$P_y(F<_g{4-9bA`Xhvv{X7P?logc1I~F7GHDuQ@hk53p2&V{57;r zp;f5u!s4Q^r`d}a2b;&-yc=dOf1~cP^0At1jtofLins#nxjh|uI${C(Ex2=+jhoFQ zEGk_ez3x%Y4@%f`XJmI;Wj-N)O{<`VPV3A%|GF93Zo67n+iy~bsKUIV)-_t33VW`| z@#n58njbx+WQegW8b~%=mbFkzS*`ZMAPEw$Ga~NC6Ha1KtZ#Hf)LORc1l&z=H zz@_k_0*Q}wAl1&fH7g?+yZ=h|u@6PYuVvf^>NO2g{Df03=DO`#iVB8iDBcxBG@j5( zklC?bYZTE|ne!6g%3*PQ)JX(3_f5p;N16P$3(wEXWA0@+TwPzhPa%(0I4)uB{>u;2 zp0yLK)_GYKR&brpOb*>?`9_)qy9g&?3+85*y{P_0fDXTRil=Z+^vAC_r8nIb%=gZ(Yy24J zDzvj*=9NlGS!0pn8(=uO*ox6`eMlVBD`rzB*9)=G8n%dn9XqPkh4qMI@QLU%NfPJ z%-gp6hl#9*uspfs&qbp<(vnN8vA}&IoEi&g5^_5z#KZ2qDcOt?F-92)gz9Rnn-;iNS0S%==8cvlRaQ z4np#668_@S%156`Ulw>V`+}NcQkU-upE*`>1it}C3$s=|{mbEtAHUVQxu5C1eENE0 zqYIghBR)Qhc%qk22~#^X7)))34QwI6d^l zqi}Juk)O7NgDTPLx`+p^4!k9_+7-<_;(-PKkwWjsL9S5?>NO;+u_xPMIuK& zir$(Zd0o$6;>-w38)iet&?oP>%ZF&4?Ytj4McWl;-)Iv(%;%BGLozr~*xHq%QNM(zk!R#}NTn}sBD=E&3D3rgn`|zSeHGI<926vo;t+OJbUgw?j zIJcbWY4+;r>5wgc;&|;%){YtvXm5u&xxeS0>OAc?Y~j9&3vntzs$w4x3wXx_QaDAV z(q9Q7yPp^4`Iuh;a7OJ*#^{(QxAWbt=KiJ!!@zj_XN<46ro7jU(GQ-cxJc&`LUh6C^w3l%0vDgEgH0H+q+%iI8#nyN1Ij_u9x(K_2 z_U4C$`_`dmALbwOIDCR+=zEyJ#{!VCUSLa5!V9sQ=RHw5yWi)|zi;;D$=-YSSBoq2 ziv-_jC=9xGt|++cQ~}^n;=47}w=3aUQg#YP{s7d|Z&#Py``Rm#b>zE70v2M5Gl`yC zyvj5VbDUY}(q3j?7(V}+L(8yHN!f!cJLd&(ll{alojneZ{Tj(1pIuR3K6iPm24pzY zfj6^p#PiX$rD6f*VfjpTtBkI8AKXz(K5L{6TmFtbLka$NkoR5g~x_4g~(q_cTzlV$)$jjf9qRyvlovPu!;jMS_GgB5_do)`ve%q{5GfZs{AMI!B&Kz&xoP47$2VW;y}WY&236NBsf23wj^T@QeA1W+Oe3Ry zy$=l5Ef25)#r2euPD?knc;*;oKfJe3oHy#;hg}QzM&MU=+TM?^ ztyGoHjxZF0qsW_ME0Zg3Cu3JjOE-kg2xQtZQ<3QgPk$drNAselI^_NL+ven@OCKp- zb`rOKWaW~N{#EAXTq4d@a;^HU1?4p+FXHQqpOf52bxY>^#CcYoMv5MM z+3P#9$)_&AXyJOv9NA#^m1rhk?wH{+hoHlcm}(9??B!7v3p^tjy8ak0M|=3%5rJ~~ zcixf&OmlSR-mUo`o21{&mLA6JxpyHkD+D?;yB?mu`nZ{v!ReC=UhF$wi9jxVHlSS~ z2YKTm9+o-teM|cWRgHCe*51ekNzY_ibN8SMSaWu&Rvl-P(92+xi>X#pDDaP6-mt85 zZqHvlJ}Nst-X<&}E0jd6W$xd-Khw3o zZ-vH^eNZ8QG!CqP^&}LUVf7$(m4aS|;)Xmow%vX2Acz&}QRe)+mbV*MAfu_iqvBQb!~YTw~h7Cc~kKx()%hd--2q}*3&vHdl9&#g_88jxD- zqt_CelJ!j8nK(A1#K=sRn9#O$7f}`*LzfOeN{#?x+chLqDm)gK8n)GDWW|M>YdDUy z=H5E7u>gzYh9i}C%ee{;yx8^bO~)${i?zKNRyN&| z9*NZD=a`sS2C2CKg6}jSYyED%<+qOv1)QG&#|>;1Egt-JQVeFX#p!-O%CbXn$n+8r znvV|kAzXX5#IDeg^PuVaKJE%B+zE|?N&Y_OR-<0xjVSv$E>Fzr@bCT-t~E>O+P=G* zTym>9C_z{_ExK8xHCWk(lVYf+9eAG-;&Jf0GTNYvLegV@^niKMJ!2nlD~_QRKrr&X z0{MYcn2#je38M#&=M=r?R-hYmm<&7)k^(D-)*s_cd66!jd&f2Sy0F3iyhYuWJ?E}7 ze`N2Fwrz?}$=G;DyVnMDEnA2(KPvs9q1mSEbB4Q{#iPn@Y64nLU*N^zh5d!FnOAF? zwhno=@@ewLxw0m>38`^r%UJ?Sh$Pb-pSevh@Y|!$O0GR4;qXk~pl|N+zD0u@%yXY4 zxd{)2hw1Bf#m*%x&mj!EZz6WF-)8C{0($Ytu6O5$_qz`4TmUqjwosZOM1(wK!gC9E%BK5?#3VrIh7E)~h9Kh1^h9;4W-fzDG@g z$ziwbAzkuO;kp`eEGOAsv0KY0XFkoV*nVcA1lz}oFjT-Ycn6zl%;6{6_?FJ*qvq$D z3M_ILi&JkvKs~BIBEGmFyD{x-&Rdh+`!4$~mJ7;^?|b27%nyIlbaPLsq&}qieB%Bg zzL$xKkIY=oMwXgBXV!r9MCbW-U*RcG;a&)vmutn@`wycOssBT=qwfb7J({l!K0#(3duF`(7#lr3RV#A>-$ZO}dIbu;!TpMbymm|bpeC(sx z2zkBr)UvYhp)~+B)^+npw zhE-jpavHM2WAN^+;BxvkeX&<$iyrbz|vZOb}XR;BFgfS%dBDco!tjw R1(|>!ZFPOMbQO!e{|8rXn?V2o literal 0 HcmV?d00001 diff --git a/docs/configuration/firewall/general-legacy.rst b/docs/configuration/firewall/general-legacy.rst index 041dd8aa6b..5d235eb889 100644 --- a/docs/configuration/firewall/general-legacy.rst +++ b/docs/configuration/firewall/general-legacy.rst @@ -1,10 +1,10 @@ :lastproofread: 2021-06-29 -.. _firewall-legacy: +.. _legacy-firewall: -############### -Firewall-Legacy -############### +################################### +Firewall Configuration (Deprecated) +################################### .. note:: **Important note:** This documentation is valid only for VyOS Sagitta prior to diff --git a/docs/configuration/firewall/general.rst b/docs/configuration/firewall/general.rst index 0e172a24d9..df79bd9ed3 100644 --- a/docs/configuration/firewall/general.rst +++ b/docs/configuration/firewall/general.rst @@ -1,10 +1,10 @@ -:lastproofread: 2021-06-29 +:lastproofread: 2023-09-17 -.. _firewall: +.. _firewall-configuration: -######## -Firewall -######## +###################### +Firewall Configuration +###################### ******** Overview @@ -17,48 +17,41 @@ The firewall supports the creation of groups for addresses, domains, interfaces, mac-addresses, networks and port groups. This groups can be used later in firewall ruleset as desired. -.. note:: **Important note on usage of terms:** - The firewall makes use of the terms `forward`, `input`, and `output` - for firewall policy. More information of Netfilter hooks and Linux - networking packet flows can be found in `Netfilter-Hooks - `_ - - Main structure is shown next: .. code-block:: none - set firewall * global-options - + all-ping - + broadcast-ping - + ... + + all-ping + + broadcast-ping + + ... * group - - address-group - - ipv6-address-group - - network-group - - ipv6-network-group - - interface-group - - mac-group - - port-group - - domain-group + - address-group + - ipv6-address-group + - network-group + - ipv6-network-group + - interface-group + - mac-group + - port-group + - domain-group * ipv4 - - forward + - forward + filter - - input + - input + filter - - output + - output + filter - - name + - name + custom_name * ipv6 - - forward + - forward + filter - - input + - input + filter - - output + - output + filter - - ipv6-name + - ipv6-name + custom_name Where, main key words and configuration paths that needs to be understood: diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst index 567e48a077..4b923143ab 100644 --- a/docs/configuration/firewall/index.rst +++ b/docs/configuration/firewall/index.rst @@ -1,24 +1,85 @@ +:lastproofread: 2023-09-17 + ######## Firewall ######## -Starting from VyOS 1.4-rolling-202308040557, a new firewall structure -can be found on all vyos installations. Documentation for most new firewall -cli can be found here: +.. attention:: + Starting from VyOS 1.4-rolling-202308040557, a new firewall structure + can be found on all vyos installations. + +.. note:: + The legacy and zone-based firewall configuration options is not longer + supported. They are here for reference purposes only. +Netfilter based +^^^^^^^^^^^^^^^ .. toctree:: :maxdepth: 1 :includehidden: general -Also, for those who haven't updated to newer version, legacy documentation is -still present and valid for all sagitta version prior to VyOS -1.4-rolling-202308040557: +With VyOS being based on top of Linux and its kernel, the Netfilter project created +the iptables and now the successor nftables for the Linux kernel to work directly +on the data flows. This now extends the concept of zone-based security to allow +for manipulating the data at multiple stages once accepted by the network interface +and the driver before being handed off to the destination (e.g. a web server OR +another device). + +To configure VyOS with the new :doc:`firewall configuration ` + +The only stages VyOS will process as part of the firewall configuration is the +`forward` (F4 stage), `input` (L4 stage), and `output` (L5 stage). All the other +stages and steps are for reference and cant be manipulated through VyOS. + +In this example image, a simplifed traffic flow is shown to help provide context +to the terms of `forward`, `input`, and `output` for the new firewall CLI format. +.. figure:: /_static/images/firewall-netfilter.png + +.. note:: **For more information** + of Netfilter hooks and Linux networking packet flows can be + found in `Netfilter-Hooks + `_ + +Legacy Firewall +^^^^^^^^^^^^^^^ .. toctree:: :maxdepth: 1 :includehidden: general-legacy + +Traditionally firewalls weere configured with the concept of data going in and +out of an interface. The router just listened to the data flowing through and +responding as required if it was directed at the router itself. + +To configure VyOS with the :doc:`legacy firewall configuration ` + +As the example image below shows, the device was configured with rules blocking +inbound or outbound traffic on each interface. + +.. figure:: /_static/images/firewall-traditional.png + +Zone-based firewall +^^^^^^^^^^^^^^^^^^^ +.. toctree:: + :maxdepth: 1 + :includehidden: + zone + +With zone-based firewalls a new concept was implemented, in addtion to the standard +in and out traffic flows, a local flow was added. This local was for traffic +originating and destined to the router itself. Which means additional rules were +required to secure the firewall itself from the network, in addition to the existing +inbound and outbound rules from the traditional concept above. + +To configure VyOS with the :doc:`zone-based firewall configuration ` + +As the example image below shows, the device now needs rules to allow/block traffic +to or from the services running on the device that have open connections on that +interface. + +.. figure:: /_static/images/firewall-zonebased.png diff --git a/docs/configuration/firewall/zone.rst b/docs/configuration/firewall/zone.rst index a2069e0d40..38869c3247 100644 --- a/docs/configuration/firewall/zone.rst +++ b/docs/configuration/firewall/zone.rst @@ -2,9 +2,9 @@ .. _firewall-zone: -################### -Zone Based Firewall -################### +################################ +Zone Based Firewall (Deprecated) +################################ .. note:: Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all vyos instalations, and zone based firewall is