diff --git a/data/config-mode-dependencies/vyos-1x.json b/data/config-mode-dependencies/vyos-1x.json
index 4a1bc4011..4fd94d895 100644
--- a/data/config-mode-dependencies/vyos-1x.json
+++ b/data/config-mode-dependencies/vyos-1x.json
@@ -1,56 +1,52 @@
 {
-    "conntrack": {
-        "conntrack_sync": ["conntrack_sync"]
+    "system_conntrack": {
+        "conntrack_sync": ["service_conntrack-sync"]
     },
     "firewall": {
-        "conntrack": ["conntrack"],
-        "conntrack_sync": ["conntrack_sync"],
-        "group_resync": ["conntrack", "nat", "policy-route"]
+        "conntrack": ["system_conntrack"],
+        "group_resync": ["system_conntrack", "nat", "policy_route"]
     },
     "interfaces_bonding": {
-        "ethernet": ["interfaces-ethernet"]
+        "ethernet": ["interfaces_ethernet"]
     },
     "interfaces_bridge": {
-        "vxlan": ["interfaces-vxlan"]
+        "vxlan": ["interfaces_vxlan"]
     },
     "load_balancing_wan": {
-        "conntrack": ["conntrack"],
-        "conntrack_sync": ["conntrack_sync"]
+        "conntrack": ["system_conntrack"]
     },
     "nat": {
-        "conntrack": ["conntrack"],
-        "conntrack_sync": ["conntrack_sync"]
+        "conntrack": ["system_conntrack"]
     },
     "nat66": {
-        "conntrack": ["conntrack"],
-        "conntrack_sync": ["conntrack_sync"]
+        "conntrack": ["system_conntrack"]
     },
     "pki": {
-        "ethernet": ["interfaces-ethernet"],
-        "openvpn": ["interfaces-openvpn"],
-        "https": ["https"],
+        "ethernet": ["interfaces_ethernet"],
+        "openvpn": ["interfaces_openvpn"],
+        "https": ["service_https"],
         "ipsec": ["vpn_ipsec"],
         "openconnect": ["vpn_openconnect"],
         "sstp": ["vpn_sstp"]
     },
     "qos": {
-        "bonding": ["interfaces-bonding"],
-        "bridge": ["interfaces-bridge"],
-        "dummy": ["interfaces-dummy"],
-        "ethernet": ["interfaces-ethernet"],
-        "geneve": ["interfaces-geneve"],
-        "input": ["interfaces-input"],
-        "l2tpv3": ["interfaces-l2tpv3"],
-        "loopback": ["interfaces-loopback"],
-        "macsec": ["interfaces-macsec"],
-        "openvpn": ["interfaces-openvpn"],
-        "pppoe": ["interfaces-pppoe"],
-        "pseudo-ethernet": ["interfaces-pseudo-ethernet"],
-        "tunnel": ["interfaces-tunnel"],
-        "vti": ["interfaces-vti"],
-        "vxlan": ["interfaces-vxlan"],
-        "wireguard": ["interfaces-wireguard"],
-        "wireless": ["interfaces-wireless"],
-        "wwan": ["interfaces-wwan"]
+        "bonding": ["interfaces_bonding"],
+        "bridge": ["interfaces_bridge"],
+        "dummy": ["interfaces_dummy"],
+        "ethernet": ["interfaces_ethernet"],
+        "geneve": ["interfaces_geneve"],
+        "input": ["interfaces_input"],
+        "l2tpv3": ["interfaces_l2tpv3"],
+        "loopback": ["interfaces_loopback"],
+        "macsec": ["interfaces_macsec"],
+        "openvpn": ["interfaces_openvpn"],
+        "pppoe": ["interfaces_pppoe"],
+        "pseudo-ethernet": ["interfaces_pseudo-ethernet"],
+        "tunnel": ["interfaces_tunnel"],
+        "vti": ["interfaces_vti"],
+        "vxlan": ["interfaces_vxlan"],
+        "wireguard": ["interfaces_wireguard"],
+        "wireless": ["interfaces_wireless"],
+        "wwan": ["interfaces_wwan"]
     }
 }
diff --git a/data/configd-include.json b/data/configd-include.json
index 6d7261b73..d1f9db796 100644
--- a/data/configd-include.json
+++ b/data/configd-include.json
@@ -1,90 +1,109 @@
 [
-"arp.py",
-"bcast_relay.py",
 "container.py",
-"conntrack.py",
-"conntrack_sync.py",
-"dhcp_relay.py",
-"dhcp_server.py",
-"dhcpv6_relay.py",
-"dhcpv6_server.py",
-"dns_forwarding.py",
-"dns_dynamic.py",
 "firewall.py",
-"flow_accounting_conf.py",
 "high-availability.py",
-"host_name.py",
-"igmp_proxy.py",
-"intel_qat.py",
-"interfaces-bonding.py",
-"interfaces-bridge.py",
-"interfaces-dummy.py",
-"interfaces-ethernet.py",
-"interfaces-geneve.py",
-"interfaces-l2tpv3.py",
-"interfaces-loopback.py",
-"interfaces-macsec.py",
-"interfaces-openvpn.py",
-"interfaces-pppoe.py",
-"interfaces-pseudo-ethernet.py",
-"interfaces-sstpc.py",
-"interfaces-tunnel.py",
-"interfaces-vti.py",
-"interfaces-vxlan.py",
-"interfaces-wireguard.py",
-"interfaces-wireless.py",
-"interfaces-wwan.py",
-"lldp.py",
+"interfaces_bonding.py",
+"interfaces_bridge.py",
+"interfaces_dummy.py",
+"interfaces_ethernet.py",
+"interfaces_geneve.py",
+"interfaces_input.py",
+"interfaces_l2tpv3.py",
+"interfaces_loopback.py",
+"interfaces_macsec.py",
+"interfaces_openvpn.py",
+"interfaces_pppoe.py",
+"interfaces_pseudo-ethernet.py",
+"interfaces_sstpc.py",
+"interfaces_tunnel.py",
+"interfaces_virtual-ethernet.py",
+"interfaces_vti.py",
+"interfaces_vxlan.py",
+"interfaces_wireguard.py",
+"interfaces_wireless.py",
+"interfaces_wwan.py",
+"load-balancing_reverse-proxy.py",
+"load-balancing_wan.py",
 "nat.py",
+"nat64.py",
 "nat66.py",
 "netns.py",
-"ntp.py",
 "pki.py",
 "policy.py",
-"policy-local-route.py",
+"policy_route.py",
+"policy_local-route.py",
+"protocols_babel.py",
 "protocols_bfd.py",
 "protocols_bgp.py",
+"protocols_eigrp.py",
+"protocols_failover.py",
+"protocols_igmp-proxy.py",
 "protocols_isis.py",
 "protocols_mpls.py",
 "protocols_nhrp.py",
 "protocols_ospf.py",
 "protocols_ospfv3.py",
 "protocols_pim.py",
+"protocols_pim6.py",
 "protocols_rip.py",
 "protocols_ripng.py",
 "protocols_rpki.py",
-"protocols_segment_routing.py",
+"protocols_segment-routing.py",
 "protocols_static.py",
+"protocols_static_arp.py",
 "protocols_static_multicast.py",
+"protocols_static_neighbor-proxy.py",
 "qos.py",
-"salt-minion.py",
+"service_broadcast-relay.py",
+"service_config-sync.py",
+"service_conntrack-sync.py",
 "service_console-server.py",
-"service_ids_fastnetmon.py",
+"service_dhcp-relay.py",
+"service_dhcp-server.py",
+"service_dhcpv6-relay.py",
+"service_dhcpv6-server.py",
+"service_dns_dynamic.py",
+"service_dns_forwarding.py",
+"service_event-handler.py",
+"service_https.py",
+"service_ids_ddos-protection.py",
 "service_ipoe-server.py",
-"service_mdns-repeater.py",
+"service_lldp.py",
+"service_mdns_repeater.py",
 "service_monitoring_telegraf.py",
+"service_monitoring_zabbix-agent.py",
 "service_ndp-proxy.py",
+"service_ntp.py",
 "service_pppoe-server.py",
 "service_router-advert.py",
+"service_salt-minion.py",
+"service_ssh.py",
+"service_tftp-server.py",
 "service_upnp.py",
-"ssh.py",
-"system-ip.py",
-"system-ipv6.py",
-"system-login-banner.py",
-"system-logs.py",
-"system-option.py",
-"system-proxy.py",
-"system_sflow.py",
-"system_sysctl.py",
-"system-syslog.py",
-"system-timezone.py",
+"system_acceleration.py",
+"system_conntrack.py",
 "system_console.py",
+"system_flow-accounting.py",
+"system_frr.py",
+"system_host-name.py",
+"system_ip.py",
+"system_ipv6.py",
 "system_lcd.py",
-"task_scheduler.py",
-"tftp_server.py",
+"system_login_banner.py",
+"system_logs.py",
+"system_option.py",
+"system_proxy.py",
+"system_sflow.py",
+"system_sysctl.py",
+"system_syslog.py",
+"system_task-scheduler.py",
+"system_timezone.py",
+"system_update-check.py",
+"vpn_ipsec.py",
 "vpn_l2tp.py",
+"vpn_openconnect.py",
 "vpn_pptp.py",
 "vpn_sstp.py",
 "vrf.py",
 "vrf_vni.py"
 ]
diff --git a/data/templates/bcast-relay/udp-broadcast-relay.j2 b/data/templates/bcast-relay/udp-broadcast-relay.j2
index 75740e04c..3f5b5bbe3 100644
--- a/data/templates/bcast-relay/udp-broadcast-relay.j2
+++ b/data/templates/bcast-relay/udp-broadcast-relay.j2
@@ -1,5 +1,5 @@
-### Autogenerated by bcast_relay.py ###
+### Autogenerated by service_broadcast-relay.py ###
 
 # UDP broadcast relay configuration for instance {{ id }}
 {{ '# ' ~ description if description is vyos_defined }}
 DAEMON_ARGS="{{ '-s ' ~ address if address is vyos_defined }} {{ instance }} {{ port }} {{ interface | join(' ') }}"
diff --git a/data/templates/chrony/chrony.conf.j2 b/data/templates/chrony/chrony.conf.j2
index 0daec8fb8..d02fbf71d 100644
--- a/data/templates/chrony/chrony.conf.j2
+++ b/data/templates/chrony/chrony.conf.j2
@@ -1,58 +1,58 @@
-### Autogenerated by ntp.py ###
+### Autogenerated by service_ntp.py ###
 
 # This would step the system clock if the adjustment is larger than 0.1 seconds,
 # but only in the first three clock updates.
 makestep 1.0 3
 
 # The rtcsync directive enables a mode where the system time is periodically
 # copied to the RTC and chronyd does not try to track its drift. This directive
 # cannot be used with the rtcfile directive. On Linux, the RTC copy is performed
 # by the kernel every 11 minutes.
 rtcsync
 
 # This directive specifies the maximum amount of memory that chronyd is allowed
 # to allocate for logging of client accesses and the state that chronyd as an
 # NTP server needs to support the interleaved mode for its clients.
 clientloglimit 1048576
 
 driftfile /run/chrony/drift
 dumpdir /run/chrony
 ntsdumpdir /run/chrony
 pidfile {{ config_file | replace('.conf', '.pid') }}
 
 # Determine when will the next leap second occur and what is the current offset
 leapsectz right/UTC
 
 user {{ user }}
 
 # NTP servers to reach out to
 {% if server is vyos_defined %}
 {%     for server, config in server.items() %}
 {%         set association = 'server' %}
 {%         if config.pool is vyos_defined %}
 {%             set association = 'pool' %}
 {%         endif %}
 {{ association }} {{ server | replace('_', '-') }} iburst {{ 'nts' if config.nts is vyos_defined }} {{ 'noselect' if config.noselect is vyos_defined }} {{ 'prefer' if config.prefer is vyos_defined }}
 {%     endfor %}
 {% endif %}
 
 # Allowed clients configuration
 {% if allow_client.address is vyos_defined %}
 {%     for address in allow_client.address %}
 allow {{ address }}
 {%     endfor %}
 {% else %}
 deny all
 {% endif %}
 
 {% if listen_address is vyos_defined or interface is vyos_defined %}
 # NTP should listen on configured addresses only
 {%     if listen_address is vyos_defined %}
 {%         for address in listen_address %}
 bindaddress {{ address }}
 {%         endfor %}
 {%     endif %}
 {%     if interface is vyos_defined %}
 binddevice {{ interface }}
 {%     endif %}
 {% endif %}
diff --git a/data/templates/conntrack/sysctl.conf.j2 b/data/templates/conntrack/sysctl.conf.j2
index 3d6fc43f2..986f75c61 100644
--- a/data/templates/conntrack/sysctl.conf.j2
+++ b/data/templates/conntrack/sysctl.conf.j2
@@ -1,27 +1,27 @@
-# Autogenerated by conntrack.py
+# Autogenerated by system_conntrack.py
 {# all values have defaults - thus no checking required #}
 
 net.netfilter.nf_conntrack_expect_max = {{ expect_table_size }}
 net.netfilter.nf_conntrack_max = {{ table_size }}
 
 net.ipv4.tcp_max_syn_backlog = {{ tcp.half_open_connections }}
 
 net.netfilter.nf_conntrack_tcp_loose = {{ '1' if tcp.loose is vyos_defined('enable') else '0' }}
 net.netfilter.nf_conntrack_tcp_max_retrans = {{ tcp.max_retrans }}
 
 net.netfilter.nf_conntrack_icmp_timeout = {{ timeout.icmp }}
 net.netfilter.nf_conntrack_generic_timeout = {{ timeout.other }}
 
 net.netfilter.nf_conntrack_tcp_timeout_close_wait = {{ timeout.tcp.close_wait }}
 net.netfilter.nf_conntrack_tcp_timeout_close = {{ timeout.tcp.close }}
 net.netfilter.nf_conntrack_tcp_timeout_established = {{ timeout.tcp.established }}
 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = {{ timeout.tcp.fin_wait }}
 net.netfilter.nf_conntrack_tcp_timeout_last_ack = {{ timeout.tcp.last_ack }}
 net.netfilter.nf_conntrack_tcp_timeout_syn_recv = {{ timeout.tcp.syn_recv }}
 net.netfilter.nf_conntrack_tcp_timeout_syn_sent = {{ timeout.tcp.syn_sent }}
 net.netfilter.nf_conntrack_tcp_timeout_time_wait = {{ timeout.tcp.time_wait }}
 
 net.netfilter.nf_conntrack_udp_timeout = {{ timeout.udp.other }}
 net.netfilter.nf_conntrack_udp_timeout_stream = {{ timeout.udp.stream }}
 
 net.netfilter.nf_conntrack_acct = {{ '1' if flow_accounting is vyos_defined else '0' }}
diff --git a/data/templates/conntrack/vyos_nf_conntrack.conf.j2 b/data/templates/conntrack/vyos_nf_conntrack.conf.j2
index 197155d96..1b12fec5f 100644
--- a/data/templates/conntrack/vyos_nf_conntrack.conf.j2
+++ b/data/templates/conntrack/vyos_nf_conntrack.conf.j2
@@ -1,2 +1,2 @@
-# Autogenerated by conntrack.py
+# Autogenerated by system_conntrack.py
 options nf_conntrack hashsize={{ hash_size }}
diff --git a/data/templates/conntrackd/conntrackd.conf.j2 b/data/templates/conntrackd/conntrackd.conf.j2
index 808a77759..8f56c8171 100644
--- a/data/templates/conntrackd/conntrackd.conf.j2
+++ b/data/templates/conntrackd/conntrackd.conf.j2
@@ -1,114 +1,113 @@
-# autogenerated by conntrack_sync.py
+### autogenerated by service_conntrack-sync.py ###
 
 # Synchronizer settings
 Sync {
     Mode FTFW {
         DisableExternalCache {{ 'on' if disable_external_cache is vyos_defined else 'off' }}
     }
 {% for iface, iface_config in interface.items() %}
 {%     if iface_config.peer is vyos_defined %}
     UDP {
 {%         if listen_address is vyos_defined %}
 {%             for address in listen_address %}
         IPv4_address {{ address }}
 {%             endfor %}
 {%         endif %}
         IPv4_Destination_Address {{ iface_config.peer }}
         Port {{ iface_config.port if iface_config.port is vyos_defined else '3780' }}
         Interface {{ iface }}
         SndSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         RcvSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         Checksum on
     }
 {%     else %}
     Multicast {
 {%         set ip_address = iface | get_ipv4 %}
         IPv4_address {{ mcast_group }}
         Group {{ iface_config.port if iface_config.port is vyos_defined else '3780' }}
         IPv4_interface {{ ip_address[0] | ip_from_cidr }}
         Interface {{ iface }}
         SndSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         RcvSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         Checksum on
     }
 {%     endif %}
 {% endfor %}
 {% if expect_sync is vyos_defined %}
     Options {
 {%     if 'all' in expect_sync %}
         ExpectationSync on
 {%     else %}
         ExpectationSync {
 {%         for protocol in expect_sync %}
             {{ protocol }}
 {%         endfor %}
         }
 {%     endif %}
     }
 {% endif %}
 }
 Helper {
     Type rpc inet tcp {
         QueueNum 3
         Policy rpc {
             ExpectMax 1
             ExpectTimeout 300
         }
     }
     Type rpc inet udp {
         QueueNum 4
         Policy rpc {
             ExpectMax 1
             ExpectTimeout 300
         }
     }
     Type tns inet tcp {
         QueueNum 5
         Policy tns {
             ExpectMax 1
             ExpectTimeout 300
         }
     }
 }
 
 # General settings
 General {
     HashSize {{ hash_size }}
     HashLimit {{ table_size | int *2 }}
     LogFile off
     Syslog on
     LockFile /var/lock/conntrack.lock
     UNIX {
         Path /var/run/conntrackd.ctl
     }
     NetlinkBufferSize {{ 2 *1024 *1024 }}
     NetlinkBufferSizeMaxGrowth {{ event_listen_queue_size | int *1024 *1024 }}
     NetlinkOverrunResync off
     NetlinkEventsReliable on
 {% if ignore_address is vyos_defined or accept_protocol is vyos_defined %}
     Filter From Userspace {
 {%     if ignore_address is vyos_defined %}
         Address Ignore {
 {%         for address in ignore_address if address | is_ipv4 %}
             IPv4_address {{ address }}
 {%         endfor %}
 {%         for address in ignore_address if address | is_ipv6 %}
             IPv6_address {{ address }}
 {%         endfor %}
         }
 {%     endif %}
 {%     if accept_protocol is vyos_defined %}
         Protocol Accept {
 {%         for protocol in accept_protocol %}
 {%             if protocol == 'icmp6' %}
             IPv6-ICMP
 {%             else %}
             {{ protocol | upper }}
 {%             endif %}
 {%         endfor %}
         }
 {%     endif %}
     }
 {% endif %}
 }
-
diff --git a/data/templates/dhcp-relay/dhcrelay.conf.j2 b/data/templates/dhcp-relay/dhcrelay.conf.j2
index c26c263fd..71a395454 100644
--- a/data/templates/dhcp-relay/dhcrelay.conf.j2
+++ b/data/templates/dhcp-relay/dhcrelay.conf.j2
@@ -1,9 +1,9 @@
-### Autogenerated by dhcp_relay.py ###
+### Autogenerated by service_dhcp-relay.py ###
 
 {% set max_size = '-A ' ~ relay_options.max_size if relay_options.max_size is vyos_defined %}
 {# hop_count and relay_agents_packets is a default option, thus it is always present #}
 {% if interface is vyos_defined %}
 OPTIONS="-c {{ relay_options.hop_count }} -a -m {{ relay_options.relay_agents_packets }} {{ max_size }} -i {{ interface | join(' -i ') }} {{ server | join(' ') }}"
 {% else %}
 OPTIONS="-c {{ relay_options.hop_count }} -a -m {{ relay_options.relay_agents_packets }} {{ max_size }} -id {{ listen_interface | join(' -id ') }} -iu {{ upstream_interface | join(' -iu ') }} {{ server | join(' ') }}"
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/data/templates/dhcp-relay/dhcrelay6.conf.j2 b/data/templates/dhcp-relay/dhcrelay6.conf.j2
index 6365346b4..25f7671b3 100644
--- a/data/templates/dhcp-relay/dhcrelay6.conf.j2
+++ b/data/templates/dhcp-relay/dhcrelay6.conf.j2
@@ -1,21 +1,20 @@
-### Autogenerated by dhcpv6_relay.py ###
+### Autogenerated by service_dhcpv6-relay.py ###
 
 {# upstream_interface is mandatory so it's always present #}
 {% set upstream = namespace(value='')  %}
 {% for interface, config in upstream_interface.items() %}
 {%     for address in config.address %}
 {%         set upstream.value = upstream.value ~ '-u ' ~ address ~ '%' ~ interface ~ ' ' %}
 {%     endfor %}
 {% endfor %}
 {# listen_interface is mandatory so it's always present #}
 {% set listen = namespace(value='')  %}
 {% for interface, config in listen_interface.items() %}
 {%     if config.address is vyos_defined %}
 {%         set listen.value = listen.value ~ '-l ' ~ config.address ~ '%' ~ interface ~ ' ' %}
 {%     else %}
 {%         set listen.value = listen.value ~ '-l ' ~ interface ~ ' ' %}
 {%     endif %}
 {% endfor %}
 
 OPTIONS="{{ listen.value }} {{ upstream.value }} -c {{ max_hop_count }} {{ '-I' if use_interface_id_option is vyos_defined }}"
-
diff --git a/data/templates/dns-dynamic/ddclient.conf.j2 b/data/templates/dns-dynamic/ddclient.conf.j2
index 30afb9e64..6c0653a55 100644
--- a/data/templates/dns-dynamic/ddclient.conf.j2
+++ b/data/templates/dns-dynamic/ddclient.conf.j2
@@ -1,56 +1,56 @@
 {% macro render_config(host, address, web_options, ip_suffixes=['']) %}
 {# Address: use=if, if=ethX, usev6=ifv6, ifv6=ethX, usev6=webv6, webv6=https://v6.example.com #}
 {% for ipv in ip_suffixes %}
 use{{ ipv }}={{ address if address == 'web' else 'if' }}{{ ipv }}, \
 {%     if address == 'web' %}
 {%         if web_options.url is vyos_defined %}
 web{{ ipv }}={{ web_options.url }}, \
 {%         endif %}
 {%         if web_options.skip is vyos_defined %}
 web-skip{{ ipv }}='{{ web_options.skip }}', \
 {%         endif %}
 {%     else %}
 if{{ ipv }}={{ address }}, \
 {%     endif %}
 {% endfor %}
 {# Other service options with special treatment for password #}
 {% for k,v in kwargs.items() if v is vyos_defined %}
 {{ k | replace('_', '-') }}={{ "'%s'" % (v) if k == 'password' else v }}{{ ',' if not loop.last }} \
 {% endfor %}
 {# Actual hostname for the service #}
 {{ host }}
 {% endmacro %}
-### Autogenerated by dns_dynamic.py ###
+### Autogenerated by service_dns_dynamic.py ###
 daemon={{ interval }}
 syslog=yes
 ssl=yes
 pid={{ config_file | replace('.conf', '.pid') }}
 cache={{ config_file | replace('.conf', '.cache') }}
 {# ddclient default (web=dyndns) doesn't support ssl and results in process lockup #}
 web=googledomains
 {# ddclient default (use=ip) results in confusing warning message in log #}
 use=no
 
 {% if name is vyos_defined %}
 {%     for service, config in name.items() %}
 {%         if config.description is vyos_defined %}
 
 # {{ config.description }}
 {%         endif %}
 {%         for host in config.host_name if config.host_name is vyos_defined %}
 {#             ip_suffixes can be either of ['v4'], ['v6'], ['v4', 'v6'] for all protocols except 'nsupdate'
                ip_suffixes must be [''] for nsupdate since it doesn't support usevX/wantipvX yet #}
 {%             set ip_suffixes = ['v4', 'v6'] if config.ip_version == 'both'
                                  else ([config.ip_version[2:]] if config.protocol != 'nsupdate'
                                        else ['']) %}
 {%             set password = config.key if config.protocol == 'nsupdate'
                               else config.password %}
 
 # Web service dynamic DNS configuration for {{ service }}: [{{ config.protocol }}, {{ host }}]
 {{ render_config(host, config.address, config.web_options, ip_suffixes,
                  protocol=config.protocol, server=config.server, zone=config.zone,
                  login=config.username, password=password, ttl=config.ttl,
                  min_interval=config.wait_time, max_interval=config.expiry_time) }}
 {%         endfor %}
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/dns-forwarding/recursor.conf.j2 b/data/templates/dns-forwarding/recursor.conf.j2
index e02e6c13d..ea700406c 100644
--- a/data/templates/dns-forwarding/recursor.conf.j2
+++ b/data/templates/dns-forwarding/recursor.conf.j2
@@ -1,50 +1,49 @@
 {# j2lint: disable=single-statement-per-line #}
-### Autogenerated by dns_forwarding.py ###
+### Autogenerated by service_dns_forwarding.py ###
 
 # XXX: pdns recursor doesn't like whitespace near entry separators,
 # especially in the semicolon-separated lists of name servers.
 # Please be careful if you edit the template.
 
 # Non-configurable defaults
 daemon=yes
 threads=1
 allow-from={{ allow_from | join(',') }}
 log-common-errors=yes
 non-local-bind=yes
 query-local-address={{ source_address | join(',') }}
 lua-config-file=recursor.conf.lua
 
 # cache-size
 max-cache-entries={{ cache_size }}
 
 # negative TTL for NXDOMAIN
 max-negative-ttl={{ negative_ttl }}
 
 # timeout
 network-timeout={{ timeout }}
 
 # ignore-hosts-file
 export-etc-hosts={{ 'no' if ignore_hosts_file is vyos_defined else 'yes' }}
 
 # listen-address
 local-address={{ listen_address | join(',') }}
 
 # listen-port
 local-port={{ port }}
 
 # dnssec
 dnssec={{ dnssec }}
 
 {% if dns64_prefix is vyos_defined %}
 # dns64-prefix
 dns64-prefix={{ dns64_prefix }}
 {% endif %}
 
 # serve rfc1918 records
 serve-rfc1918={{ 'no' if no_serve_rfc1918 is vyos_defined else 'yes' }}
 
 # zones
 auth-zones={% for z in authoritative_zones %}{{ z.name }}={{ z.file }}{{- "," if not loop.last -}}{% endfor %}
 
 forward-zones-file=recursor.forward-zones.conf
-
diff --git a/data/templates/dns-forwarding/recursor.conf.lua.j2 b/data/templates/dns-forwarding/recursor.conf.lua.j2
index e2506238d..816f69160 100644
--- a/data/templates/dns-forwarding/recursor.conf.lua.j2
+++ b/data/templates/dns-forwarding/recursor.conf.lua.j2
@@ -1,9 +1,8 @@
--- Autogenerated by VyOS (dns_forwarding.py) --
+-- Autogenerated by VyOS (service_dns_forwarding.py) --
 -- Do not edit, your changes will get overwritten --
 
 -- Load DNSSEC root keys from dns-root-data package.
 dofile("/usr/share/pdns-recursor/lua-config/rootkeys.lua")
 
 -- Load lua from vyos-hostsd --
 dofile("recursor.vyos-hostsd.conf.lua")
-
diff --git a/data/templates/dns-forwarding/recursor.zone.conf.j2 b/data/templates/dns-forwarding/recursor.zone.conf.j2
index 25193c2ec..797068c49 100644
--- a/data/templates/dns-forwarding/recursor.zone.conf.j2
+++ b/data/templates/dns-forwarding/recursor.zone.conf.j2
@@ -1,6 +1,6 @@
 ;
-; Autogenerated by dns_forwarding.py
+; Autogenerated by service_dns_forwarding.py
 ;
 {% for r in records %}
 {{ r.name }}    {{ r.ttl }}    {{ r.type }}    {{ r.value }}
 {% endfor %}
diff --git a/data/templates/ethernet/wpa_supplicant.conf.j2 b/data/templates/ethernet/wpa_supplicant.conf.j2
index cd35d6d1e..6da2fa5e0 100644
--- a/data/templates/ethernet/wpa_supplicant.conf.j2
+++ b/data/templates/ethernet/wpa_supplicant.conf.j2
@@ -1,77 +1,76 @@
-### Autogenerated by interfaces-ethernet.py ###
+### Autogenerated by interfaces_ethernet.py ###
 
 # see full documentation:
 # https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf
 
 # For UNIX domain sockets (default on Linux and BSD): This is a directory that
 # will be created for UNIX domain sockets for listening to requests from
 # external programs (CLI/GUI, etc.) for status information and configuration.
 # The socket file will be named based on the interface name, so multiple
 # wpa_supplicant processes can be run at the same time if more than one
 # interface is used.
 # /var/run/wpa_supplicant is the recommended directory for sockets and by
 # default, wpa_cli will use it when trying to connect with wpa_supplicant.
 ctrl_interface=/run/wpa_supplicant
 
 # IEEE 802.1X/EAPOL version
 # wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines
 # EAPOL version 2. However, there are many APs that do not handle the new
 # version number correctly (they seem to drop the frames completely). In order
 # to make wpa_supplicant interoperate with these APs, the version number is set
 # to 1 by default. This configuration value can be used to set it to the new
 # version (2).
 # Note: When using MACsec, eapol_version shall be set to 3, which is
 # defined in IEEE Std 802.1X-2010.
 eapol_version=2
 
 # No need to scan for access points in EAPoL mode
 ap_scan=0
 
 # EAP fast re-authentication
 fast_reauth=1
 
 network={
 {% if eapol is vyos_defined %}
 {%     if eapol.ca_certificate is vyos_defined %}
     ca_cert="/run/wpa_supplicant/{{ ifname }}_ca.pem"
 {%     endif %}
     client_cert="/run/wpa_supplicant/{{ ifname }}_cert.pem"
     private_key="/run/wpa_supplicant/{{ ifname }}_cert.key"
 {% endif %}
 
     # list of accepted authenticated key management protocols
     key_mgmt=IEEE8021X
     eap=TLS
 
 {% if mac is vyos_defined %}
     identity="{{ mac }}"
 {% else %}
     identity="{{ hw_id }}"
 {% endif %}
 
     # eapol_flags: IEEE 802.1X/EAPOL options (bit field)
     # Dynamic WEP key required for non-WPA mode
     # bit0 (1): require dynamically generated unicast WEP key
     # bit1 (2): require dynamically generated broadcast WEP key
     #      (3) = require both keys; default)
     # Note: When using wired authentication (including MACsec drivers),
     # eapol_flags must be set to 0 for the authentication to be completed
     # successfully.
     eapol_flags=0
 
     # For wired IEEE 802.1X authentication, "allow_canned_success=1" can be
     # used to configure a mode that allows EAP-Success (and EAP-Failure) without
     # going through authentication step. Some switches use such sequence when
     # forcing the port to be authorized/unauthorized or as a fallback option if
     # the authentication server is unreachable. By default, wpa_supplicant
     # discards such frames to protect against potential attacks by rogue
     # devices, but this option can be used to disable that protection for cases
     # where the server/authenticator does not need to be authenticated.
     #
     # "tls_disable_tlsv1_0=0" is used to allow TLSv1 for compatibility with
     # legacy networks. This follows the behavior of Debian's wpa_supplicant,
     # which includes a custom patch for allowing TLSv1, but the patch currently
     # does not work for VyOS' git builds of wpa_supplicant.
     phase1="allow_canned_success=1 tls_disable_tlsv1_0=0"
 }
-
diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2
index dde839e9f..80239ea56 100644
--- a/data/templates/https/nginx.default.j2
+++ b/data/templates/https/nginx.default.j2
@@ -1,60 +1,60 @@
-### Autogenerated by https.py ###
+### Autogenerated by service_https.py ###
 # Default server configuration
 
 {% for server in server_block_list %}
 server {
         # SSL configuration
         #
 {%     if server.address == '*' %}
         listen {{ server.port }} ssl;
         listen [::]:{{ server.port }} ssl;
 {%     else %}
         listen {{ server.address | bracketize_ipv6 }}:{{ server.port }} ssl;
 {%     endif %}
 
 {%     for name in server.name %}
         server_name {{ name }};
 {%     endfor %}
 
         root /srv/localui;
 
 {%     if server.certbot %}
         ssl_certificate {{ server.certbot_dir }}/live/{{ server.certbot_domain_dir }}/fullchain.pem;
         ssl_certificate_key {{ server.certbot_dir }}/live/{{ server.certbot_domain_dir }}/privkey.pem;
         include {{ server.certbot_dir }}/options-ssl-nginx.conf;
         ssl_dhparam {{ server.certbot_dir }}/ssl-dhparams.pem;
 {%     elif server.vyos_cert %}
         ssl_certificate {{ server.vyos_cert.crt }};
         ssl_certificate_key {{ server.vyos_cert.key }};
 {%     else %}
         #
         # Self signed certs generated by the ssl-cert package
         # Don't use them in a production server!
         #
         include snippets/snakeoil.conf;
 {%     endif %}
         ssl_protocols TLSv1.2 TLSv1.3;
 
         # proxy settings for HTTP API, if enabled; 503, if not
         location ~ ^/(retrieve|configure|config-file|image|container-image|generate|show|reboot|reset|poweroff|docs|openapi.json|redoc|graphql) {
 {%     if server.api %}
                 proxy_pass http://unix:/run/api.sock;
                 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                 proxy_set_header X-Forwarded-Proto $scheme;
                 proxy_read_timeout 600;
                 proxy_buffering off;
 {%     else %}
                 return 503;
 {%     endif %}
 {%     if server.allow_client %}
 {%         for client in server.allow_client %}
                 allow {{ client }};
 {%         endfor %}
                 deny all;
 {%     endif %}
         }
 
         error_page 497 =301 https://$host:{{ server.port }}$request_uri;
 }
 
 {% endfor %}
diff --git a/data/templates/igmp-proxy/igmpproxy.conf.j2 b/data/templates/igmp-proxy/igmpproxy.conf.j2
index ab3c9fd31..85a04de7d 100644
--- a/data/templates/igmp-proxy/igmpproxy.conf.j2
+++ b/data/templates/igmp-proxy/igmpproxy.conf.j2
@@ -1,40 +1,40 @@
 ########################################################
 #
-# autogenerated by igmp_proxy.py
+# autogenerated by protocols_igmp-proxy.py
 #
 # The configuration file must define one upstream interface, and one or more
 # downstream interfaces.
 #
 # If multicast traffic originates outside the upstream subnet, the "altnet"
 # option can be used in order to define legal multicast sources.
 #
 # The "quickleave" should be used to avoid saturation of the upstream link. The
 # option should only be used if it's absolutely nessecary to accurately imitate
 # just one Client.
 #
 ########################################################
 
 {% if disable_quickleave is not vyos_defined %}
 quickleave
 {% endif %}
 {% if interface is vyos_defined %}
 {%     for iface, config in interface.items() %}
 
 # Configuration for {{ iface }} ({{ config.role }} interface)
 {%         if config.role is vyos_defined('disabled') %}
 phyint {{ iface }} disabled
 {%         else %}
 phyint {{ iface }} {{ config.role }} ratelimit 0 threshold {{ config.threshold }}
 {%         endif %}
 {%         if config.alt_subnet is vyos_defined %}
 {%             for subnet in config.alt_subnet %}
         altnet {{ subnet }}
 {%             endfor %}
 {%         endif %}
 {%         if config.whitelist is vyos_defined %}
 {%             for subnet in config.whitelist %}
         whitelist {{ subnet }}
 {%             endfor %}
 {%         endif %}
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/lldp/lldpd.j2 b/data/templates/lldp/lldpd.j2
index 6ae063c4b..2238fe1c4 100644
--- a/data/templates/lldp/lldpd.j2
+++ b/data/templates/lldp/lldpd.j2
@@ -1,2 +1,2 @@
-### Autogenerated by lldp.py ###
+### Autogenerated by service_lldp.py ###
 DAEMON_ARGS="-M 4 {{ '-x' if snmp is vyos_defined }} {{ '-c' if legacy_protocols.cdp is vyos_defined }} {{ '-e' if legacy_protocols.edp is vyos_defined }} {{ '-f' if legacy_protocols.fdp is vyos_defined }} {{ '-s' if legacy_protocols.sonmp is vyos_defined }}"
diff --git a/data/templates/lldp/vyos.conf.j2 b/data/templates/lldp/vyos.conf.j2
index dfa422ab8..4b4228cea 100644
--- a/data/templates/lldp/vyos.conf.j2
+++ b/data/templates/lldp/vyos.conf.j2
@@ -1,25 +1,25 @@
-### Autogenerated by lldp.py ###
+### Autogenerated by service_lldp.py ###
 
 configure system platform VyOS
 configure system description "VyOS {{ version }}"
 {% if interface is vyos_defined %}
 {%     set tmp = [] %}
 {%     for iface, iface_options in interface.items() if iface_options.disable is not vyos_defined %}
 {%         if iface == 'all' %}
 {%             set iface = '*' %}
 {%         endif %}
 {%         set _ = tmp.append(iface) %}
 {%         if iface_options.location is vyos_defined %}
 {%             if iface_options.location.elin is vyos_defined %}
 configure ports {{ iface }} med location elin "{{ iface_options.location.elin }}"
 {%             endif %}
 {%             if iface_options.location.coordinate_based is vyos_defined %}
 configure ports {{ iface }} med location coordinate latitude "{{ iface_options.location.coordinate_based.latitude }}" longitude "{{ iface_options.location.coordinate_based.longitude }}" altitude "{{ iface_options.location.coordinate_based.altitude }}m" datum "{{ iface_options.location.coordinate_based.datum }}"
 {%             endif %}
 {%         endif %}
 {%     endfor %}
 configure system interface pattern "{{ tmp | join(",") }}"
 {% endif %}
 {% if management_address is vyos_defined %}
 configure system ip management pattern {{ management_address | join(",") }}
 {% endif %}
diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2
index defb76fba..849cef74d 100644
--- a/data/templates/load-balancing/haproxy.cfg.j2
+++ b/data/templates/load-balancing/haproxy.cfg.j2
@@ -1,169 +1,169 @@
-# Generated by ${vyos_conf_scripts_dir}/load-balancing-haproxy.py
+### Autogenerated by load-balancing_reverse-proxy.py ###
 
 global
     log /dev/log local0
     log /dev/log local1 notice
     chroot /var/lib/haproxy
     stats socket /run/haproxy/admin.sock mode 660 level admin
     stats timeout 30s
     user haproxy
     group haproxy
     daemon
 
 {% if global_parameters is vyos_defined %}
 {%     if global_parameters.max_connections is vyos_defined %}
     maxconn {{ global_parameters.max_connections }}
 {%     endif %}
 
     # Default SSL material locations
     ca-base /etc/ssl/certs
     crt-base /etc/ssl/private
 
 {%     if global_parameters.ssl_bind_ciphers is vyos_defined %}
     # https://ssl-config.mozilla.org/#server=haproxy&version=2.6.12-1&config=intermediate&openssl=3.0.8-1&guideline=5.6
     ssl-default-bind-ciphers {{ global_parameters.ssl_bind_ciphers | join(':') | upper }}
 {%     endif %}
     ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
 {%     if global_parameters.tls_version_min is vyos_defined('1.3') %}
     ssl-default-bind-options force-tlsv13
 {%     else %}
     ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
 {%     endif %}
 {% endif %}
 
 defaults
     log     global
     mode    http
     option  dontlognull
     timeout connect 10s
     timeout client  50s
     timeout server  50s
     errorfile 400 /etc/haproxy/errors/400.http
     errorfile 403 /etc/haproxy/errors/403.http
     errorfile 408 /etc/haproxy/errors/408.http
     errorfile 500 /etc/haproxy/errors/500.http
     errorfile 502 /etc/haproxy/errors/502.http
     errorfile 503 /etc/haproxy/errors/503.http
     errorfile 504 /etc/haproxy/errors/504.http
 
 # Frontend
 {% if service is vyos_defined %}
 {%     for front, front_config in service.items() %}
 frontend {{ front }}
 {%         set ssl_front = [] %}
 {%         if front_config.ssl.certificate is vyos_defined and front_config.ssl.certificate is iterable %}
 {%             for cert in front_config.ssl.certificate %}
 {%                 set _ = ssl_front.append('crt /run/haproxy/' ~ cert ~ '.pem') %}
 {%             endfor %}
 {%         endif %}
 {%         set ssl_directive = 'ssl' if ssl_front else '' %}
 {%         if front_config.listen_address is vyos_defined %}
 {%             for address in front_config.listen_address %}
     bind {{ address | bracketize_ipv6 }}:{{ front_config.port }} {{ ssl_directive }} {{ ssl_front | join(' ') }}
 {%             endfor %}
 {%         else %}
     bind :::{{ front_config.port }} v4v6 {{ ssl_directive }} {{ ssl_front | join(' ') }}
 {%         endif %}
 {%         if front_config.redirect_http_to_https is vyos_defined %}
     http-request redirect scheme https unless { ssl_fc }
 {%         endif %}
 {%         if front_config.mode is vyos_defined %}
     mode {{ front_config.mode }}
 {%         endif %}
 {%         if front_config.rule is vyos_defined %}
 {%             for rule, rule_config in front_config.rule.items() %}
     # rule {{ rule }}
 {%                 if rule_config.domain_name is vyos_defined and rule_config.set.backend is vyos_defined %}
 {%                     set rule_options = 'hdr(host)' %}
 {%                     if rule_config.ssl is vyos_defined %}
 {%                         set ssl_rule_translate = {'req-ssl-sni': 'req_ssl_sni', 'ssl-fc-sni': 'ssl_fc_sni', 'ssl-fc-sni-end': 'ssl_fc_sni_end'} %}
 {%                         set rule_options = ssl_rule_translate[rule_config.ssl] %}
 {%                     endif %}
 {%                     for domain in rule_config.domain_name %}
     acl {{ rule }} {{ rule_options }} -i {{ domain }}
 {%                     endfor %}
     use_backend {{ rule_config.set.backend }} if {{ rule }}
 {%                 endif %}
 {# path url #}
 {%                 if rule_config.url_path is vyos_defined and rule_config.set.redirect_location is vyos_defined %}
 {%                     set path_mod_translate = {'begin': '-i -m beg', 'end': '-i -m end', 'exact': ''} %}
 {%                     for path, path_config in rule_config.url_path.items() %}
 {%                         for url in path_config %}
     acl {{ rule }} path {{ path_mod_translate[path] }} {{ url }}
 {%                         endfor %}
 {%                     endfor %}
     http-request redirect location {{ rule_config.set.redirect_location }} code 301 if {{ rule }}
 {%                 endif %}
 {# endpath #}
 {%             endfor %}
 {%         endif %}
 {%         if front_config.backend is vyos_defined %}
 {%             for backend in front_config.backend %}
     default_backend {{ backend }}
 {%             endfor %}
 {%         endif %}
 
 {%     endfor %}
 {% endif %}
 
 # Backend
 {% if backend is vyos_defined %}
 {%     for back, back_config in backend.items() %}
 backend {{ back }}
 {%         if back_config.balance is vyos_defined %}
 {%             set balance_translate = {'least-connection': 'leastconn', 'round-robin': 'roundrobin', 'source-address': 'source'} %}
     balance {{ balance_translate[back_config.balance] }}
 {%         endif %}
 {# If mode is not TCP skip Forwarded #}
 {%         if back_config.mode is not vyos_defined('tcp') %}
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
 {%         endif %}
 {%         if back_config.mode is vyos_defined %}
     mode {{ back_config.mode }}
 {%         endif %}
 {%         if back_config.rule is vyos_defined %}
 {%             for rule, rule_config in back_config.rule.items() %}
 {%                 if rule_config.domain_name is vyos_defined and rule_config.set.server is vyos_defined %}
 {%                     set rule_options = 'hdr(host)' %}
 {%                     if rule_config.ssl is vyos_defined %}
 {%                         set ssl_rule_translate = {'req-ssl-sni': 'req_ssl_sni', 'ssl-fc-sni': 'ssl_fc_sni', 'ssl-fc-sni-end': 'ssl_fc_sni_end'} %}
 {%                         set rule_options = ssl_rule_translate[rule_config.ssl] %}
 {%                     endif %}
 {%                     for domain in rule_config.domain_name %}
     acl {{ rule }} {{ rule_options }} -i {{ domain }}
 {%                     endfor %}
     use-server {{ rule_config.set.server }} if {{ rule }}
 {%                 endif %}
 {# path url #}
 {%                 if rule_config.url_path is vyos_defined and rule_config.set.redirect_location is vyos_defined %}
 {%                     set path_mod_translate = {'begin': '-i -m beg', 'end': '-i -m end', 'exact': ''} %}
 {%                     for path, path_config in rule_config.url_path.items() %}
 {%                         for url in path_config %}
     acl {{ rule }} path {{ path_mod_translate[path] }} {{ url }}
 {%                         endfor %}
 {%                     endfor %}
     http-request redirect location {{ rule_config.set.redirect_location }} code 301 if {{ rule }}
 {%                 endif %}
 {# endpath #}
 {%             endfor %}
 {%         endif %}
 {%         if back_config.server is vyos_defined %}
 {%             set ssl_back =  'ssl ca-file /run/haproxy/' ~ back_config.ssl.ca_certificate ~ '.pem' if back_config.ssl.ca_certificate is vyos_defined else '' %}
 {%             for server, server_config in back_config.server.items() %}
     server {{ server }} {{ server_config.address }}:{{ server_config.port }}{{ ' check' if server_config.check is vyos_defined }}{{ ' backup' if server_config.backup is vyos_defined }}{{ ' send-proxy' if server_config.send_proxy is vyos_defined }}{{ ' send-proxy-v2' if server_config.send_proxy_v2 is vyos_defined }} {{ ssl_back }}
 {%             endfor %}
 {%         endif %}
 {%         if back_config.timeout.check is vyos_defined %}
     timeout check {{ back_config.timeout.check }}s
 {%         endif %}
 {%         if back_config.timeout.connect is vyos_defined %}
     timeout connect {{ back_config.timeout.connect }}s
 {%         endif %}
 {%         if back_config.timeout.server is vyos_defined %}
     timeout server {{ back_config.timeout.server }}s
 {%         endif %}
 
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/load-balancing/wlb.conf.j2 b/data/templates/load-balancing/wlb.conf.j2
index d3326b6b8..6557b6f4c 100644
--- a/data/templates/load-balancing/wlb.conf.j2
+++ b/data/templates/load-balancing/wlb.conf.j2
@@ -1,130 +1,130 @@
-# Generated by /usr/libexec/vyos/conf_mode/load-balancing-wan.py
+### Autogenerated by load-balancing_wan.py ###
 
 {% if disable_source_nat is vyos_defined %}
 disable-source-nat
 {% endif %}
 {% if enable_local_traffic is vyos_defined %}
 enable-local-traffic
 {% endif %}
 {% if sticky_connections is vyos_defined %}
 sticky-connections inbound
 {% endif %}
 {% if flush_connections is vyos_defined %}
 flush-conntrack
 {% endif %}
 {% if hook is vyos_defined %}
 hook "{{ hook }}"
 {% endif %}
 {% if interface_health is vyos_defined %}
 health {
 {%     for interface, interface_config in interface_health.items() %}
     interface {{ interface }} {
 {%         if interface_config.failure_count is vyos_defined %}
         failure-ct  {{ interface_config.failure_count }}
 {%         endif %}
 {%         if interface_config.success_count is vyos_defined %}
         success-ct  {{ interface_config.success_count }}
 {%         endif %}
 {%         if interface_config.nexthop is vyos_defined %}
         nexthop {{ interface_config.nexthop }}
 {%         endif %}
 {%         if interface_config.test is vyos_defined %}
 {%             for test_rule, test_config in interface_config.test.items() %}
         rule {{ test_rule }} {
 {%                 if test_config.type is vyos_defined %}
 {%                     set type_translate = {'ping': 'ping', 'ttl': 'udp', 'user-defined': 'user-defined'} %}
             type {{ type_translate[test_config.type] }} {
 {%                     if test_config.ttl_limit is vyos_defined and test_config.type == 'ttl' %}
                 ttl {{ test_config.ttl_limit }}
 {%                     endif %}
 {%                     if test_config.test_script is vyos_defined and test_config.type == 'user-defined' %}
                 test-script {{ test_config.test_script }}
 {%                     endif %}
 {%                     if test_config.target is vyos_defined %}
-                target {{ test_config.target }} 
+                target {{ test_config.target }}
 {%                     endif %}
                 resp-time {{ test_config.resp_time | int * 1000 }}
             }
 {%                 endif %}
         }
 {%             endfor %}
 {%         endif %}
     }
 {%     endfor %}
 }
 {% endif %}
 
 {% if rule is vyos_defined %}
 {%     for rule, rule_config in rule.items() %}
 rule {{ rule }} {
 {%         if rule_config.exclude is vyos_defined  %}
     exclude
 {%         endif %}
 {%         if rule_config.failover is vyos_defined  %}
     failover
 {%         endif %}
 {%         if rule_config.limit is vyos_defined %}
     limit {
 {%             if rule_config.limit.burst is vyos_defined %}
         burst {{ rule_config.limit.burst }}
 {%             endif %}
 {%             if rule_config.limit.rate is vyos_defined %}
         rate {{ rule_config.limit.rate }}
 {%             endif %}
 {%             if rule_config.limit.period is vyos_defined %}
         period {{ rule_config.limit.period }}
 {%             endif %}
 {%             if rule_config.limit.threshold is vyos_defined %}
         thresh {{ rule_config.limit.threshold }}
 {%             endif %}
         }
 {%         endif %}
 {%         if rule_config.per_packet_balancing is vyos_defined  %}
     per-packet-balancing
 {%         endif %}
 {%         if rule_config.protocol is vyos_defined  %}
     protocol {{ rule_config.protocol }}
 {%         endif %}
 {%         if rule_config.destination is vyos_defined %}
     destination {
 {%             if rule_config.destination.address is vyos_defined  %}
         address "{{ rule_config.destination.address }}"
 {%             endif %}
 {%             if rule_config.destination.port is vyos_defined  %}
 {%                 if '-' in rule_config.destination.port %}
         port-ipt "-m multiport  --dports {{ rule_config.destination.port | replace('-', ':') }}"
 {%                 else %}
         port-ipt " --dport {{ rule_config.destination.port }}"
 {%                 endif %}
 {%             endif %}
     }
 {%         endif %}
 {%         if rule_config.source is vyos_defined %}
     source {
 {%             if rule_config.source.address is vyos_defined  %}
         address "{{ rule_config.source.address }}"
 {%             endif %}
 {%             if rule_config.source.port is vyos_defined  %}
 {%                 if '-' in rule_config.source.port %}
         port-ipt "-m multiport  --sports {{ rule_config.source.port | replace('-', ':') }}"
 {%                 else %}
         port.ipt " --sport {{ rule_config.source.port }}"
 {%                 endif %}
 {%             endif %}
     }
 {%         endif %}
 {%         if rule_config.inbound_interface is vyos_defined  %}
     inbound-interface {{ rule_config.inbound_interface }}
 {%         endif %}
 {%         if rule_config.interface is vyos_defined  %}
 {%             for interface, interface_config in rule_config.interface.items() %}
     interface {{ interface }} {
 {%                 if interface_config.weight is vyos_defined %}
         weight {{ interface_config.weight }}
 {%                 endif %}
     }
 {%             endfor %}
 {%         endif %}
 }
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/login/authorized_keys.j2 b/data/templates/login/authorized_keys.j2
index aabca47cf..695b66abe 100644
--- a/data/templates/login/authorized_keys.j2
+++ b/data/templates/login/authorized_keys.j2
@@ -1,9 +1,8 @@
-### Automatically generated by system-login.py ###
+### Automatically generated by system_login.py ###
 
 {% if authentication.public_keys is vyos_defined %}
 {%     for key, key_options in authentication.public_keys.items() %}
 {# The whitespace after options is wisely chosen #}
 {{ key_options.options ~ ' ' if key_options.options is vyos_defined }}{{ key_options.type }} {{ key_options.key }} {{ key }}
 {%     endfor %}
 {% endif %}
-
diff --git a/data/templates/login/limits.j2 b/data/templates/login/limits.j2
index 5e2c11f35..31abc85dd 100644
--- a/data/templates/login/limits.j2
+++ b/data/templates/login/limits.j2
@@ -1,5 +1,5 @@
-# Generated by /usr/libexec/vyos/conf_mode/system-login.py
+# Generated by system_login.py
 
 {% if max_login_session is vyos_defined %}
 * - maxsyslogins {{ max_login_session }}
 {% endif %}
diff --git a/data/templates/login/nsswitch.conf.j2 b/data/templates/login/nsswitch.conf.j2
index 65dc88291..0adfb491c 100644
--- a/data/templates/login/nsswitch.conf.j2
+++ b/data/templates/login/nsswitch.conf.j2
@@ -1,21 +1,20 @@
-# Automatically generated by system-login.py
+# automatically generated by system_login.py ###
 # /etc/nsswitch.conf
 #
 # Example configuration of GNU Name Service Switch functionality.
 
 passwd:         {{ 'mapuid ' if radius is vyos_defined }}{{ 'tacplus ' if tacacs is vyos_defined }}files{{ ' mapname' if radius is vyos_defined }}
 group:          {{ 'mapname ' if radius is vyos_defined }}{{ 'tacplus ' if tacacs is vyos_defined }}files
 shadow:         files
 gshadow:        files
 
 # Per T2678, commenting out myhostname
 hosts:          files dns #myhostname
 networks:       files
 
 protocols:      db files
 services:       db files
 ethers:         db files
 rpc:            db files
 
 netgroup:       nis
-
diff --git a/data/templates/login/pam_radius_auth.conf.j2 b/data/templates/login/pam_radius_auth.conf.j2
index c61154753..75437ca71 100644
--- a/data/templates/login/pam_radius_auth.conf.j2
+++ b/data/templates/login/pam_radius_auth.conf.j2
@@ -1,35 +1,35 @@
-# Automatically generated by system-login.py
+### Automatically generated by system_login.py ###
 # RADIUS configuration file
 
 {% if radius is vyos_defined %}
 {#     RADIUS IPv6 source address must be specified in [] notation #}
 {%     set source_address = namespace()  %}
 {%     if radius.source_address is vyos_defined %}
 {%         for address in radius.source_address %}
 {%             if address | is_ipv4 %}
 {%                 set source_address.ipv4 = address %}
 {%             elif address | is_ipv6 %}
 {%                 set source_address.ipv6 = "[" + address + "]" %}
 {%             endif %}
 {%         endfor %}
 {%     endif %}
 {%     if radius.server is vyos_defined %}
 # server[:port]        shared_secret             timeout    source_ip
 {# .items() returns a tuple of two elements: key and value. 1 relates to the 2nd element i.e. the value and .priority relates to the key from the internal dict #}
 {%         for server, options in radius.server.items() | sort(attribute='1.priority') if not 'disable' in options %}
 {#         RADIUS IPv6 servers must be specified in [] notation #}
 {%             if server | is_ipv4 %}
 {{ server }}:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv4 if source_address.ipv4 is vyos_defined }}
 {%             else %}
 [{{ server }}]:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv6 if source_address.ipv6 is vyos_defined }}
 {%             endif %}
 {%         endfor %}
 {%     endif %}
 
 priv-lvl 15
 mapped_priv_user radius_priv_user
 
 {%     if radius.vrf is vyos_defined %}
 vrf-name {{ radius.vrf }}
 {%     endif %}
 {% endif %}
diff --git a/data/templates/login/tacplus_servers.j2 b/data/templates/login/tacplus_servers.j2
index 5a65d6e68..23e8e495e 100644
--- a/data/templates/login/tacplus_servers.j2
+++ b/data/templates/login/tacplus_servers.j2
@@ -1,59 +1,58 @@
-# Automatically generated by system-login.py
+# Automatically generated by system_login.py
 # TACACS+ configuration file
 
 # This is a common file used by audisp-tacplus, libpam_tacplus, and
 # libtacplus_map config files as shipped.
 #
 # Any tac_plus client config can go here that is common to all users of this
 # file, but typically it's just the TACACS+ server IP address(es) and shared
 # secret(s)
 #
 # This file should normally be mode 600, if you care about the security of your
 # secret key. When set to mode 600 NSS lookups for TACACS users will only work
 # for tacacs users that are logged in, via the local mapping. For root, lookups
 # will work for any tacacs users, logged in or not.
 
 # Set a per-connection timeout of 10 seconds, and enable the use of poll() when
 # trying to read from tacacs servers. Otherwise standard TCP timeouts apply.
 # Not set or set to a negative value disables use of poll(). There are usually
 # multiple connection attempts per login.
 timeout={{ tacacs.timeout }}
 
 {% if tacacs.server is vyos_defined %}
 {%     for server, server_config in tacacs.server.items() %}
 secret={{ server_config.key }}
 server={{ server }}:{{ server_config.port }}
 {%     endfor %}
 {% endif %}
 
 # If set, login/logout accounting records are sent to all servers in
 # the list, otherwise only to the first responding server
 # Also used by audisp-tacplus per-command accounting, if it sources this file.
 acct_all=1
 
 {% if tacacs.vrf is vyos_defined %}
 # If the management network is in a vrf, set this variable to the vrf name.
 # This would usually be "mgmt". When this variable is set, the connection to the
 # TACACS+ accounting servers will be made through the named vrf.
 vrf={{ tacacs.vrf }}
 {% endif %}
 
 {% if tacacs.source_address is vyos_defined %}
 # Sets the IPv4 address used as the source IP address when communicating with
 # the TACACS+ server. IPv6 addresses are not supported, nor are hostnames.
 # The address must work when passsed to the bind() system call, that is, it must
 # be valid for the interface being used.
 source_ip={{ tacacs.source_address }}
 {% endif %}
 
 # If user_homedir=1, then tacacs users will be set to have a home directory
 # based on their login name, rather than the mapped tacacsN home directory.
 # mkhomedir_helper is used to create the directory if it does not exist (similar
 # to use of pam_mkhomedir.so). This flag is ignored for users with restricted
 # shells, e.g., users mapped to a tacacs privilege level that has enforced
 # per-command authorization (see the tacplus-restrict man page).
 user_homedir=1
 
 service=shell
 protocol=ssh
-
diff --git a/data/templates/macsec/wpa_supplicant.conf.j2 b/data/templates/macsec/wpa_supplicant.conf.j2
index 1f7ba16f4..4bb762935 100644
--- a/data/templates/macsec/wpa_supplicant.conf.j2
+++ b/data/templates/macsec/wpa_supplicant.conf.j2
@@ -1,97 +1,97 @@
-### Autogenerated by interfaces-macsec.py ###
+### Autogenerated by interfaces_macsec.py ###
 
 # see full documentation:
 # https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf
 
 # For UNIX domain sockets (default on Linux and BSD): This is a directory that
 # will be created for UNIX domain sockets for listening to requests from
 # external programs (CLI/GUI, etc.) for status information and configuration.
 # The socket file will be named based on the interface name, so multiple
 # wpa_supplicant processes can be run at the same time if more than one
 # interface is used.
 # /var/run/wpa_supplicant is the recommended directory for sockets and by
 # default, wpa_cli will use it when trying to connect with wpa_supplicant.
 ctrl_interface=/run/wpa_supplicant
 
 # Note: When using MACsec, eapol_version shall be set to 3, which is
 # defined in IEEE Std 802.1X-2010.
 eapol_version=3
 
 # No need to scan for access points in MACsec mode
 ap_scan=0
 
 # EAP fast re-authentication
 fast_reauth=1
 
 network={
     key_mgmt=NONE
 
     # Note: When using wired authentication (including MACsec drivers),
     # eapol_flags must be set to 0 for the authentication to be completed
     # successfully.
     eapol_flags=0
 
     # macsec_policy: IEEE 802.1X/MACsec options
     # This determines how sessions are secured with MACsec (only for MACsec
     # drivers).
     # 0: MACsec not in use (default)
     # 1: MACsec enabled - Should secure, accept key server's advice to
     #    determine whether to use a secure session or not.
     macsec_policy=1
 
     # macsec_integ_only: IEEE 802.1X/MACsec transmit mode
     # This setting applies only when MACsec is in use, i.e.,
     #  - macsec_policy is enabled
     #  - the key server has decided to enable MACsec
     # 0: Encrypt traffic (default)
     # 1: Integrity only
     macsec_integ_only={{ '0' if security.encrypt is vyos_defined else '1' }}
 
     # macsec_csindex: IEEE 802.1X/MACsec cipher suite
     # 0 = GCM-AES-128
     # 1 = GCM-AES-256
 {# security.cipher is a mandatory key #}
     macsec_csindex={{ '1' if security.cipher is vyos_defined('gcm-aes-256') else '0' }}
 
 {% if security.encrypt is vyos_defined %}
     # mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode
     # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
     # In this mode, instances of wpa_supplicant can act as MACsec peers. The peer
     # with lower priority will become the key server and start distributing SAKs.
     # mka_cak (CAK = Secure Connectivity Association Key) takes a 16-byte (128-bit)
     # hex-string (32 hex-digits) or a 32-byte (256-bit) hex-string (64 hex-digits)
     # mka_ckn (CKN = CAK Name) takes a 1..32-bytes (8..256 bit) hex-string
     # (2..64 hex-digits)
     mka_cak={{ security.mka.cak }}
     mka_ckn={{ security.mka.ckn }}
 
     # mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being
     # default priority
     mka_priority={{ security.mka.priority }}
 {% endif %}
 
 {% if security.replay_window is vyos_defined %}
     # macsec_replay_protect: IEEE 802.1X/MACsec replay protection
     # This setting applies only when MACsec is in use, i.e.,
     #  - macsec_policy is enabled
     #  - the key server has decided to enable MACsec
     # 0: Replay protection disabled (default)
     # 1: Replay protection enabled
     macsec_replay_protect=1
 
     # macsec_replay_window: IEEE 802.1X/MACsec replay protection window
     # This determines a window in which replay is tolerated, to allow receipt
     # of frames that have been misordered by the network.
     # This setting applies only when MACsec replay protection active, i.e.,
     #  - macsec_replay_protect is enabled
     #  - the key server has decided to enable MACsec
     # 0: No replay window, strict check (default)
     # 1..2^32-1: number of packets that could be misordered
     macsec_replay_window={{ security.replay_window }}
 {% endif %}
 
     # macsec_port: IEEE 802.1X/MACsec port - Port component of the SCI
     # Range: 1-65534 (default: 1)
     macsec_port=1
 }
 
diff --git a/data/templates/mdns-repeater/avahi-daemon.conf.j2 b/data/templates/mdns-repeater/avahi-daemon.conf.j2
index d562c048f..cc6495817 100644
--- a/data/templates/mdns-repeater/avahi-daemon.conf.j2
+++ b/data/templates/mdns-repeater/avahi-daemon.conf.j2
@@ -1,27 +1,27 @@
-### Autogenerated by service_mdns-repeater.py ###
+### Autogenerated by service_mdns_repeater.py ###
 [server]
 use-ipv4={{ 'yes' if ip_version in ['ipv4', 'both'] else 'no' }}
 use-ipv6={{ 'yes' if ip_version in ['ipv6', 'both'] else 'no' }}
 allow-interfaces={{ interface | join(', ') }}
 {% if browse_domain is vyos_defined and browse_domain | length %}
 browse-domains={{ browse_domain | join(', ') }}
 {% endif %}
 disallow-other-stacks=no
 
 [wide-area]
 enable-wide-area=yes
 
 [publish]
 disable-publishing=yes
 disable-user-service-publishing=yes
 publish-addresses=no
 publish-hinfo=no
 publish-workstation=no
 publish-aaaa-on-ipv4=no
 publish-a-on-ipv6=no
 
 [reflector]
 enable-reflector=yes
 {% if allow_service is vyos_defined and allow_service | length %}
 reflect-filters={{ allow_service | join(', ') }}
 {% endif %}
diff --git a/data/templates/openvpn/auth.pw.j2 b/data/templates/openvpn/auth.pw.j2
index 218121062..9f9b31e7a 100644
--- a/data/templates/openvpn/auth.pw.j2
+++ b/data/templates/openvpn/auth.pw.j2
@@ -1,5 +1,5 @@
-{# Autogenerated by interfaces-openvpn.py #}
+{# Autogenerated by interfaces_openvpn.py #}
 {% if authentication is vyos_defined %}
 {{ authentication.username }}
 {{ authentication.password }}
 {% endif %}
diff --git a/data/templates/openvpn/client.conf.j2 b/data/templates/openvpn/client.conf.j2
index 2e327e4d3..9edcdc8ae 100644
--- a/data/templates/openvpn/client.conf.j2
+++ b/data/templates/openvpn/client.conf.j2
@@ -1,31 +1,31 @@
-### Autogenerated by interfaces-openvpn.py ###
+### Autogenerated by interfaces_openvpn.py ###
 
 {% if ip is vyos_defined %}
 ifconfig-push {{ ip[0] }} {{ server_subnet[0] | netmask_from_cidr }}
 {% endif %}
 {% if push_route is vyos_defined %}
 {%     for route in push_route %}
 push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }}"
 {%     endfor %}
 {% endif %}
 {% if subnet is vyos_defined %}
 {%     for network in subnet %}
 iroute {{ network | address_from_cidr }} {{ network | netmask_from_cidr }}
 {%     endfor %}
 {% endif %}
 {# ipv6_remote is only set when IPv6 server is enabled #}
 {% if ipv6_remote is vyos_defined %}
 # IPv6
 {%     if ipv6_ip is vyos_defined %}
 ifconfig-ipv6-push {{ ipv6_ip[0] }} {{ ipv6_remote }}
 {%     endif %}
 {%     for route6 in ipv6_push_route %}
 push "route-ipv6 {{ route6 }}"
 {%     endfor %}
 {%     for net6 in ipv6_subnet %}
 iroute-ipv6 {{ net6 }}
 {%     endfor %}
 {% endif %}
 {% if disable is vyos_defined %}
 disable
 {% endif %}
diff --git a/data/templates/openvpn/server.conf.j2 b/data/templates/openvpn/server.conf.j2
index c02411904..6ac525443 100644
--- a/data/templates/openvpn/server.conf.j2
+++ b/data/templates/openvpn/server.conf.j2
@@ -1,222 +1,222 @@
-### Autogenerated by interfaces-openvpn.py ###
+### Autogenerated by interfaces_openvpn.py ###
 #
 # See https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
 # for individual keyword definition
 #
 # {{ description if description is vyos_defined }}
 #
 
 verb 3
 dev-type {{ device_type }}
 dev {{ ifname }}
 persist-key
 {% if protocol is vyos_defined('tcp-active') %}
 proto tcp-client
 {% elif protocol is vyos_defined('tcp-passive') %}
 proto tcp-server
 {% else %}
 proto udp
 {% endif %}
 {% if local_host is vyos_defined %}
 local {{ local_host }}
 {% endif %}
 {% if mode is vyos_defined('server') and protocol is vyos_defined('udp') and local_host is not vyos_defined %}
 multihome
 {% endif %}
 {% if local_port is vyos_defined %}
 lport {{ local_port }}
 {% endif %}
 {% if remote_port is vyos_defined %}
 rport {{ remote_port }}
 {% endif %}
 {% if remote_host is vyos_defined %}
 {%     for remote in remote_host %}
 remote {{ remote }}
 {%     endfor %}
 {% endif %}
 {% if shared_secret_key is vyos_defined %}
 secret /run/openvpn/{{ ifname }}_shared.key
 {% endif %}
 {% if persistent_tunnel is vyos_defined %}
 persist-tun
 {% endif %}
 {% if replace_default_route.local is vyos_defined %}
 push "redirect-gateway local def1"
 {% elif replace_default_route is vyos_defined %}
 push "redirect-gateway def1"
 {% endif %}
 {% if use_lzo_compression is vyos_defined %}
 compress lzo
 {% endif %}
 {% if offload.dco is not vyos_defined %}
 disable-dco
 {% endif %}
 
 {% if mode is vyos_defined('client') %}
 #
 # OpenVPN Client mode
 #
 client
 nobind
 
 {% elif mode is vyos_defined('server') %}
 #
 # OpenVPN Server mode
 #
 mode server
 tls-server
 {%     if server is vyos_defined %}
 {%         if server.subnet is vyos_defined %}
 {%             if server.topology is vyos_defined('point-to-point') %}
 topology p2p
 {%             elif server.topology is vyos_defined %}
 topology {{ server.topology }}
 {%             endif %}
 {%             for subnet in server.subnet %}
 {%                 if subnet | is_ipv4 %}
 server {{ subnet | address_from_cidr }} {{ subnet | netmask_from_cidr }} {{ 'nopool' if server.client_ip_pool is vyos_defined and server.client_ip_pool.disable is not vyos_defined else '' }}
 {# First ip address is used as gateway. It's allows to use metrics #}
 {%                     if server.push_route is vyos_defined %}
 {%                         for route, route_config in server.push_route.items() %}
 {%                             if route | is_ipv4 %}
 push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }} {{ 'vpn_gateway' ~ ' ' ~ route_config.metric if route_config.metric is vyos_defined }}"
 {%                             elif route | is_ipv6 %}
 push "route-ipv6 {{ route }}"
 {%                             endif %}
 {%                         endfor %}
 {%                     endif %}
 {%                 elif subnet | is_ipv6 %}
 server-ipv6 {{ subnet }}
 {%                 endif %}
 {%             endfor %}
 {%         endif %}
 
 {%         if server.client_ip_pool is vyos_defined and server.client_ip_pool.disable is not vyos_defined %}
 ifconfig-pool {{ server.client_ip_pool.start }} {{ server.client_ip_pool.stop }} {{ server.client_ip_pool.subnet_mask if server.client_ip_pool.subnet_mask is vyos_defined }}
 {%         endif %}
 {%         if server.max_connections is vyos_defined %}
 max-clients {{ server.max_connections }}
 {%         endif %}
 {%         if server.client is vyos_defined %}
 client-config-dir /run/openvpn/ccd/{{ ifname }}
 {%         endif %}
 {%     endif %}
 keepalive {{ keep_alive.interval }} {{ keep_alive.interval | int * keep_alive.failure_count | int }}
 management /run/openvpn/openvpn-mgmt-intf unix
 {%     if server is vyos_defined %}
 {%         if server.reject_unconfigured_clients is vyos_defined %}
 ccd-exclusive
 {%         endif %}
 
 {%         if server.name_server is vyos_defined %}
 {%             for nameserver in server.name_server %}
 {%                 if nameserver | is_ipv4 %}
 push "dhcp-option DNS {{ nameserver }}"
 {%                 elif nameserver | is_ipv6 %}
 push "dhcp-option DNS6 {{ nameserver }}"
 {%                 endif %}
 {%             endfor %}
 {%         endif %}
 {%         if server.domain_name is vyos_defined %}
 push "dhcp-option DOMAIN {{ server.domain_name }}"
 {%         endif %}
 {%         if server.mfa.totp is vyos_defined %}
 {%             set totp_config = server.mfa.totp %}
 plugin "{{ plugin_dir }}/openvpn-otp.so" "otp_secrets=/config/auth/openvpn/{{ ifname }}-otp-secrets otp_slop={{ totp_config.slop }} totp_t0={{ totp_config.drift }} totp_step={{ totp_config.step }} totp_digits={{ totp_config.digits }} password_is_cr={{ '1' if totp_config.challenge == 'enable' else '0' }}"
 {%         endif %}
 {%     endif %}
 {% else %}
 #
 # OpenVPN site-2-site mode
 #
 ping {{ keep_alive.interval }}
 ping-restart {{ keep_alive.failure_count }}
 
 {%     if device_type == 'tap' %}
 {%         if local_address is vyos_defined %}
 {%             for laddr, laddr_conf in local_address.items() if laddr | is_ipv4 %}
 {%                 if laddr_conf.subnet_mask is vyos_defined %}
 ifconfig {{ laddr }} {{ laddr_conf.subnet_mask }}
 {%                 endif %}
 {%             endfor %}
 {%         endif %}
 {%     else %}
 {%         for laddr in local_address if laddr | is_ipv4 %}
 {%             for raddr in remote_address if raddr | is_ipv4 %}
 ifconfig {{ laddr }} {{ raddr }}
 {%             endfor %}
 {%         endfor %}
 {%         for laddr in local_address if laddr | is_ipv6 %}
 {%             for raddr in remote_address if raddr | is_ipv6 %}
 ifconfig-ipv6 {{ laddr }} {{ raddr }}
 {%             endfor %}
 {%         endfor %}
 {%     endif %}
 {% endif %}
 
 {% if tls is vyos_defined %}
 # TLS options
 {%     if tls.ca_certificate is vyos_defined %}
 ca /run/openvpn/{{ ifname }}_ca.pem
 {%     endif %}
 {%     if tls.certificate is vyos_defined %}
 cert /run/openvpn/{{ ifname }}_cert.pem
 {%     endif %}
 {%     if tls.private_key is vyos_defined %}
 key /run/openvpn/{{ ifname }}_cert.key
 {%     endif %}
 {%     if tls.crypt_key is vyos_defined %}
 tls-crypt /run/openvpn/{{ ifname }}_crypt.key
 {%     endif %}
 {%     if tls.crl is vyos_defined %}
 crl-verify /run/openvpn/{{ ifname }}_crl.pem
 {%     endif %}
 {%     if tls.tls_version_min is vyos_defined %}
 tls-version-min {{ tls.tls_version_min }}
 {%     endif %}
 {%     if tls.dh_params is vyos_defined %}
 dh /run/openvpn/{{ ifname }}_dh.pem
 {%     else %}
 dh none
 {%     endif %}
 {%     if tls.auth_key is vyos_defined %}
 {%         if mode == 'client' %}
 tls-auth /run/openvpn/{{ ifname }}_auth.key 1
 {%         elif mode == 'server' %}
 tls-auth /run/openvpn/{{ ifname }}_auth.key 0
 {%         endif %}
 {%     endif %}
 {%     if tls.role is vyos_defined('active') %}
 tls-client
 {%     elif tls.role is vyos_defined('passive') %}
 tls-server
 {%     endif %}
 
 {%     if tls.peer_fingerprint is vyos_defined %}
 <peer-fingerprint>
 {%         for fp in tls.peer_fingerprint %}
 {{ fp }}
 {%         endfor %}
 </peer-fingerprint>
 {%     endif %}
 {% endif %}
 
 # Encryption options
 {% if encryption is vyos_defined %}
 {%     if encryption.cipher is vyos_defined %}
 cipher {{ encryption.cipher | openvpn_cipher }}
 {%     endif %}
 {%     if encryption.ncp_ciphers is vyos_defined %}
 data-ciphers {{ encryption.ncp_ciphers | openvpn_ncp_ciphers }}
 {%     endif %}
 {% endif %}
 providers default
 
 {% if hash is vyos_defined %}
 auth {{ hash }}
 {% endif %}
 
 {% if authentication is vyos_defined %}
 auth-user-pass {{ auth_user_pass_file }}
 auth-retry nointeract
 {% endif %}
diff --git a/data/templates/pppoe/peer.j2 b/data/templates/pppoe/peer.j2
index 2a99fcb2a..efe47f369 100644
--- a/data/templates/pppoe/peer.j2
+++ b/data/templates/pppoe/peer.j2
@@ -1,89 +1,89 @@
-### Autogenerated by interfaces-pppoe.py ###
+### Autogenerated by interfaces_pppoe.py ###
 {{ '# ' ~ description if description is vyos_defined else '' }}
 
 # Require peer to provide the local IP address if it is not
 # specified explicitly in the config file.
 noipdefault
 
 # Don't show the password in logfiles:
 hide-password
 
 # Standard Link Control Protocol (LCP) parameters:
 lcp-echo-interval 20
 lcp-echo-failure 3
 
 # RFC 2516, paragraph 7 mandates that the following options MUST NOT be
 # requested and MUST be rejected if requested by the peer:
 # Address-and-Control-Field-Compression (ACFC)
 noaccomp
 
 # Asynchronous-Control-Character-Map (ACCM)
 default-asyncmap
 
 # Override any connect script that may have been set in /etc/ppp/options.
 connect /bin/true
 
 # Don't try to authenticate the remote node
 noauth
 
 # Don't try to proxy ARP for the remote endpoint. User can set proxy
 # arp entries up manually if they wish. More importantly, having
 # the "proxyarp" parameter set disables the "defaultroute" option.
 noproxyarp
 
 # Unlimited connection attempts
 maxfail 0
 
 plugin rp-pppoe.so {{ source_interface }}
 {% if access_concentrator is vyos_defined %}
 pppoe-ac "{{ access_concentrator }}"
 {% endif %}
 {% if service_name is vyos_defined %}
 pppoe-service "{{ service_name }}"
 {% endif %}
 {% if host_uniq is vyos_defined %}
 pppoe-host-uniq "{{ host_uniq }}"
 {% endif %}
 
 persist
 ifname {{ ifname }}
 ipparam {{ ifname }}
 debug
 mtu {{ mtu }}
 mru {{ mru }}
 
 {% if authentication is vyos_defined %}
 {{ 'user "' + authentication.username + '"' if authentication.username is vyos_defined }}
 {{ 'password "' + authentication.password + '"' if authentication.password is vyos_defined }}
 {% endif %}
 
 {{ "usepeerdns" if no_peer_dns is not vyos_defined }}
 
 {% if ipv6 is vyos_defined %}
 +ipv6 {{ 'ipv6cp-use-ipaddr' if ipv6.address.autoconf is vyos_defined }}
 {% else %}
 noipv6
 {% endif %}
 
 {% if holdoff is vyos_defined %}
 holdoff {{ holdoff }}
 {% endif %}
 
 {% if connect_on_demand is vyos_defined %}
 demand
 # See T2249. PPP default route options should only be set when in on-demand
 # mode. As soon as we are not in on-demand mode the default-route handling is
 # passed to the ip-up.d/ip-down.s scripts which is required for VRF support.
 {%     if 'auto' in default_route %}
 defaultroute
 {{ 'defaultroute6' if ipv6 is vyos_defined }}
 {%     elif 'force' in default_route %}
 defaultroute
 replacedefaultroute
 {{ 'defaultroute6' if ipv6 is vyos_defined }}
 {%     endif %}
 {% else %}
 nodefaultroute
 noreplacedefaultroute
 {{ 'nodefaultroute6' if ipv6 is vyos_defined }}
 {% endif %}
diff --git a/data/templates/rsyslog/logrotate.j2 b/data/templates/rsyslog/logrotate.j2
index cc535c48f..ea33fea4f 100644
--- a/data/templates/rsyslog/logrotate.j2
+++ b/data/templates/rsyslog/logrotate.j2
@@ -1,27 +1,27 @@
-### Autogenerated by system-syslog.py ###
+### Autogenerated by system_syslog.py ###
 /var/log/messages {
   missingok
   notifempty
   create
   rotate 5
   size=256k
   postrotate
     invoke-rc.d rsyslog rotate > /dev/null
   endscript
 }
 
 {% if file is vyos_defined %}
 {%     for file_name, file_options in file.items() %}
 /var/log/user/{{ file_name }} {
   missingok
   notifempty
   create
   rotate {{ file_options.archive.file }}
   size={{ file_options.archive.size | int // 1024 }}k
   postrotate
     invoke-rc.d rsyslog rotate > /dev/null
   endscript
 }
 
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/rsyslog/rsyslog.conf.j2 b/data/templates/rsyslog/rsyslog.conf.j2
index 8ca167803..97e0ee0b7 100644
--- a/data/templates/rsyslog/rsyslog.conf.j2
+++ b/data/templates/rsyslog/rsyslog.conf.j2
@@ -1,78 +1,78 @@
-### Autogenerated by system-syslog.py ###
+### Autogenerated by system_syslog.py ###
 
 {% if global.marker is vyos_defined %}
 $ModLoad immark
 {%     if global.marker.interval is vyos_defined %}
 $MarkMessagePeriod {{ global.marker.interval }}
 {%     endif %}
 {% endif %}
 {% if global.preserve_fqdn is vyos_defined %}
 $PreserveFQDN on
 {% endif %}
 
 # We always log to /var/log/messages
 $outchannel global,/var/log/messages,262144,/usr/sbin/logrotate {{ logrotate }}
 {% if global.facility is vyos_defined %}
 {%     set tmp = [] %}
 {%     for facility, facility_options in global.facility.items() %}
 {%         set _ = tmp.append(facility.replace('all', '*') + '.' + facility_options.level.replace('all', '*')) %}
 {%     endfor %}
 {{ tmp | join(';') }} :omfile:$global
 {% endif %}
 
 {% if file is vyos_defined %}
 # File based configuration section
 {%     for file_name, file_options in file.items() %}
 {%         set tmp = [] %}
 $outchannel {{ file_name }},/var/log/user/{{ file_name }},{{ file_options.archive.size }},/usr/sbin/logrotate {{ logrotate }}
 {%         if file_options.facility is vyos_defined %}
 {%             for facility, facility_options in file_options.facility.items() %}
 {%                 set _ = tmp.append(facility.replace('all', '*') + '.' + facility_options.level.replace('all', '*')) %}
 {%             endfor %}
 {%         endif %}
 {{ tmp | join(';') }} :omfile:${{ file }}
 {%     endfor %}
 {% endif %}
 
 {% if console.facility is vyos_defined %}
 # Console logging
 {%     set tmp = [] %}
 {%     for facility, facility_options in console.facility.items() %}
 {%         set _ = tmp.append(facility.replace('all', '*') + '.' + facility_options.level.replace('all', '*')) %}
 {%     endfor %}
 {{ tmp | join(';') }} /dev/console
 {% endif %}
 
 {% if host is vyos_defined %}
 # Remote logging
 {%     for host_name, host_options in host.items() %}
 {%         set tmp = [] %}
 {%         if host_options.facility is vyos_defined %}
 {%             for facility, facility_options in host_options.facility.items() %}
 {%                 set _ = tmp.append(facility.replace('all', '*') + '.' + facility_options.level.replace('all', '*')) %}
 {%             endfor %}
 {%         endif %}
 {%         if host_options.protocol is vyos_defined('tcp') %}
 {%             if host_options.format.octet_counted is vyos_defined %}
 {{ tmp | join(';') }} @@(o){{ host_name | bracketize_ipv6 }}:{{ host_options.port }};RSYSLOG_SyslogProtocol23Format
 {%             else %}
 {{ tmp | join(';') }} @@{{ host_name | bracketize_ipv6 }}:{{ host_options.port }}
 {%             endif %}
 {%         else %}
 {{ tmp | join(';') }} @{{ host_name | bracketize_ipv6 }}:{{ host_options.port }}{{ ';RSYSLOG_SyslogProtocol23Format' if host_options.format.octet_counted is vyos_defined }}
 {%         endif %}
 {%     endfor %}
 {% endif %}
 
 {% if user is defined and user is not none %}
 # Log to user terminal
 {%     for username, user_options in user.items() %}
 {%         set tmp = [] %}
 {%         if user_options.facility is vyos_defined %}
 {%             for facility, facility_options in user_options.facility.items() %}
 {%                 set _ = tmp.append(facility.replace('all', '*') + '.' + facility_options.level.replace('all', '*')) %}
 {%             endfor %}
 {%         endif %}
 {{ tmp | join(';') }} :omusrmsg:{{ username }}
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/salt-minion/minion.j2 b/data/templates/salt-minion/minion.j2
index f4001db64..a69438f0b 100644
--- a/data/templates/salt-minion/minion.j2
+++ b/data/templates/salt-minion/minion.j2
@@ -1,67 +1,67 @@
-### Autogenerated by salt-minion.py ###
+### Autogenerated by service_salt-minion.py ###
 
 ##### Primary configuration settings #####
 ##########################################
 
 # The hash_type is the hash to use when discovering the hash of a file on
 # the master server. The default is sha256, but md5, sha1, sha224, sha384 and
 # sha512 are also supported.
 #
 # WARNING: While md5 and sha1 are also supported, do not use them due to the
 # high chance of possible collisions and thus security breach.
 #
 # Prior to changing this value, the master should be stopped and all Salt
 # caches should be cleared.
 hash_type: {{ hash }}
 
 #####         Logging settings       #####
 ##########################################
 # The location of the minion log file
 # The minion log can be sent to a regular file, local path name, or network
 # location. Remote logging works best when configured to use rsyslogd(8) (e.g.:
 # ``file:///dev/log``), with rsyslogd(8) configured for network logging. The URI
 # format is: <file|udp|tcp>://<host|socketpath>:<port-if-required>/<log-facility>
 # log_file: file:///dev/log
 #
 log_file: /var/log/salt/minion
 
 # The level of messages to send to the console.
 # One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
 #
 # The following log levels are considered INSECURE and may log sensitive data:
 # ['garbage', 'trace', 'debug']
 #
 # Default: 'warning'
 log_level: warning
 
 # Set the location of the salt master server, if the master server cannot be
 # resolved, then the minion will fail to start.
 master:
 {% for host in master %}
   - {{ host | bracketize_ipv6 }}
 {% endfor %}
 
 # The user to run salt
 user: minion
 
 # The directory to store the pki information in
 pki_dir: /config/salt/pki/minion
 
 # Explicitly declare the id for this minion to use, if left commented the id
 # will be the hostname as returned by the python call: socket.getfqdn()
 # Since salt uses detached ids it is possible to run multiple minions on the
 # same machine but with different ids, this can be useful for salt compute
 # clusters.
 id: {{ id }}
 
 # The number of minutes between mine updates.
 mine_interval: {{ interval }}
 
 {% if source_interface is vyos_defined %}
 # The name of the interface to use when establishing the connection to the Master.
 source_interface_name: {{ source_interface }}
 {% endif %}
 
 # Enables verification of the master-public-signature returned by the master
 # in auth-replies.
 verify_master_pubkey_sign: {{ 'True' if master_key is vyos_defined else 'False' }}
diff --git a/data/templates/snmp/etc.snmp.conf.j2 b/data/templates/snmp/etc.snmp.conf.j2
index 8012cf6bb..c214b2266 100644
--- a/data/templates/snmp/etc.snmp.conf.j2
+++ b/data/templates/snmp/etc.snmp.conf.j2
@@ -1,4 +1,4 @@
-### Autogenerated by snmp.py ###
+### Autogenerated by service_snmp.py ###
 {% if trap_source is vyos_defined %}
 clientaddr {{ trap_source }}
 {% endif %}
diff --git a/data/templates/snmp/etc.snmpd.conf.j2 b/data/templates/snmp/etc.snmpd.conf.j2
index 3db8c4d7b..b1ceb0451 100644
--- a/data/templates/snmp/etc.snmpd.conf.j2
+++ b/data/templates/snmp/etc.snmpd.conf.j2
@@ -1,211 +1,211 @@
-### Autogenerated by snmp.py ###
+### Autogenerated by service_snmp.py ###
 
 # non configurable defaults
 sysObjectID 1.3.6.1.4.1.44641
 sysServices 14
 master agentx
 agentXPerms 0777 0777
 pass .1.3.6.1.2.1.31.1.1.1.18 /opt/vyatta/sbin/if-mib-alias
 smuxpeer .1.3.6.1.2.1.83
 smuxpeer .1.3.6.1.2.1.157
 smuxsocket localhost
 
 # linkUp/Down configure the Event MIB tables to monitor
 # the ifTable for network interfaces being taken up or down
 # for making internal queries to retrieve any necessary information
 iquerySecName {{ vyos_user }}
 
 # Modified from the default linkUpDownNotification
 # to include more OIDs and poll more frequently
 notificationEvent  linkUpTrap    linkUp   ifIndex ifDescr ifType ifAdminStatus ifOperStatus
 notificationEvent  linkDownTrap  linkDown ifIndex ifDescr ifType ifAdminStatus ifOperStatus
 monitor  -r 10 -e linkUpTrap   "Generate linkUp" ifOperStatus != 2
 monitor  -r 10 -e linkDownTrap "Generate linkDown" ifOperStatus == 2
 
 # Remove all old ifTable entries with the same ifName as newly appeared
 # interface (with different ifIndex) - this is the case on e.g. ppp interfaces
 interface_replace_old yes
 
 # T4902: exclude container storage from monitoring
 ignoreDisk /usr/lib/live/mount/persistence/container
 
 ########################
 # configurable section #
 ########################
 
 # Default system description is VyOS version
 sysDescr VyOS {{ version }}
 
 {% if description is vyos_defined %}
 # Description
 SysDescr {{ description }}
 {% endif %}
 
 # Listen
 {% set options = [] %}
 {% if listen_address is vyos_defined %}
 {%     for address, address_options in listen_address.items() %}
 {%         if address | is_ipv6 %}
 {%             set protocol = protocol ~ '6' %}
 {%         endif %}
 {%         set _ = options.append(protocol ~ ':' ~ address | bracketize_ipv6 ~ ':' ~ address_options.port) %}
 {%     endfor %}
 {% else %}
 {%     set _ = options.append(protocol ~ ':161') %}
 {%     set _ = options.append(protocol ~ '6:161') %}
 {% endif %}
 agentaddress unix:/run/snmpd.socket{{ ',' ~ options | join(',') if options is vyos_defined }}
 
 {% if mib is vyos_defined %}
 # Interface MIB limits
 {%     if mib.interface_max is vyos_defined %}
 ifmib_max_num_ifaces {{ mib.interface_max }}
 {%     endif %}
 {%     if mib.interface is vyos_defined %}
 include_ifmib_iface_prefix {{ mib.interface | join(' ') }}
 {%     endif %}
 {% endif %}
 
 # SNMP communities
 {% if community is vyos_defined %}
 {%     for comm, comm_config in community.items() %}
 {%         if comm_config.client is vyos_defined %}
 {%             for client in comm_config.client %}
 {%                 if client | is_ipv4 %}
 {{ comm_config.authorization }}community {{ comm }} {{ client }} -V RESTRICTED
 {%                 elif client | is_ipv6 %}
 {{ comm_config.authorization }}community6 {{ comm }} {{ client }} -V RESTRICTED
 {%                 endif %}
 {%             endfor %}
 {%         endif %}
 {%         if comm_config.network is vyos_defined %}
 {%             for network in comm_config.network %}
 {%                 if network | is_ipv4 %}
 {{ comm_config.authorization }}community {{ comm }} {{ network }} -V RESTRICTED
 {%                 elif network | is_ipv6 %}
 {{ comm_config.authorization }}community6 {{ comm }} {{ network }} -V RESTRICTED
 {%                 endif %}
 {%             endfor %}
 {%         endif %}
 {%     endfor %}
 {% endif %}
 
 # Default RESTRICTED view
 view RESTRICTED    included .1 80
 {% if 'ip-route-table' not in oid_enable %}
 # ipRouteTable oid: excluded
 view RESTRICTED    excluded  .1.3.6.1.2.1.4.21
 {% endif %}
 {% if 'ip-net-to-media-table' not in oid_enable %}
 # ipNetToMediaTable oid: excluded
 view RESTRICTED    excluded  .1.3.6.1.2.1.4.22
 {% endif %}
 {% if 'ip-net-to-physical-phys-address' not in oid_enable %}
 # ipNetToPhysicalPhysAddress oid: excluded
 view RESTRICTED    excluded  .1.3.6.1.2.1.4.35
 {% endif %}
 {% if 'ip-forward' not in oid_enable %}
 # ipForward oid: excluded
 view RESTRICTED    excluded  .1.3.6.1.2.1.4.24
 {% endif %}
 
 {% if contact is vyos_defined %}
 # system contact information
 SysContact {{ contact }}
 {% endif %}
 
 {% if location is vyos_defined %}
 # system location information
 SysLocation {{ location }}
 {% endif %}
 
 {% if smux_peer is vyos_defined %}
 # additional smux peers
 {%     for peer in smux_peer %}
 smuxpeer {{ peer }}
 {%     endfor %}
 {% endif %}
 
 {% if trap_target is vyos_defined %}
 # if there is a problem - tell someone!
 {%     for trap, trap_config in trap_target.items() %}
 trap2sink {{ trap }}:{{ trap_config.port }} {{ trap_config.community }}
 {%     endfor %}
 {% endif %}
 
 {% if v3 is vyos_defined %}
 #
 # SNMPv3 stuff goes here
 #
 {%     if v3.view is vyos_defined %}
 # views
 {%         for view, view_config in v3.view.items() %}
 {%             if view_config.oid is vyos_defined %}
 {%                 for oid in view_config.oid %}
 view {{ view }} included .{{ oid }}
 {%                 endfor %}
 {%             endif %}
 {%         endfor %}
 {%     endif %}
 
 # access
 {%     if v3.group is vyos_defined %}
 #             context sec.model sec.level match  read    write  notif
 {%         for group, group_config in v3.group.items() %}
 access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view }} {{ 'none' if group_config.mode == 'ro' else group_config.view }} none
 {%         endfor %}
 {%     endif %}
 
 # trap-target
 {%     if v3.trap_target is vyos_defined %}
 {%         for trap, trap_config in v3.trap_target.items() %}
 {%             set options = '' %}
 {%             if trap_config.type == 'inform' %}
 {%                 set options = options ~ ' -Ci' %}
 {%             endif %}
 {%             if v3.engineid is vyos_defined %}
 {%                 set options = options ~ ' -e "' ~ v3.engineid ~ '"' %}
 {%             endif %}
 {%             if trap_config.user is vyos_defined %}
 {%                 set options = options ~ ' -u ' ~ trap_config.user %}
 {%             endif %}
 {%             if trap_config.auth.plaintext_password is vyos_defined or trap_config.auth.encrypted_password is vyos_defined %}
 {%                 set options = options ~ ' -a ' ~ trap_config.auth.type %}
 {%                 if trap_config.auth.plaintext_password is vyos_defined %}
 {%                     set options = options ~ ' -A ' ~ trap_config.auth.plaintext_password %}
 {%                 elif trap_config.auth.encrypted_password is vyos_defined %}
 {%                     set options = options ~ ' -3m ' ~ trap_config.auth.encrypted_password %}
 {%                 endif %}
 {%                 if trap_config.privacy.plaintext_password is vyos_defined or trap_config.privacy.encrypted_password is vyos_defined %}
 {%                     set options = options ~ ' -x ' ~ trap_config.privacy.type %}
 {%                     if trap_config.privacy.plaintext_password is vyos_defined %}
 {%                         set options = options ~ ' -X ' ~ trap_config.privacy.plaintext_password %}
 {%                     elif trap_config.privacy.encrypted_password is vyos_defined %}
 {%                         set options = options ~ ' -3M ' ~ trap_config.privacy.encrypted_password %}
 {%                     endif %}
 {%                     set options = options ~ ' -l authPriv' %}
 {%                 else %}
 {%                     set options = options ~ ' -l authNoPriv' %}
 {%                 endif %}
 {%             else %}
 {%                 set options = options ~ ' -l noAuthNoPriv' %}
 {%             endif %}
 trapsess -v 3 {{ options }} {{ trap }}:{{ trap_config.protocol }}:{{ trap_config.port }}
 {%         endfor %}
 {%     endif %}
 
 # group
 {%     if v3.user is vyos_defined %}
 {%         for user, user_config in v3.user.items() %}
 group {{ user_config.group }} usm {{ user }}
 {%         endfor %}
 {%     endif %}
 {# SNMPv3 end #}
 {% endif %}
 
 {% if script_extensions.extension_name is vyos_defined %}
 # extension scripts
 {%     for script, script_config in script_extensions.extension_name.items() | sort(attribute=script) %}
 extend {{ script }} {{ script_config.script }}
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/snmp/override.conf.j2 b/data/templates/snmp/override.conf.j2
index 443ee64db..42dc7a9d2 100644
--- a/data/templates/snmp/override.conf.j2
+++ b/data/templates/snmp/override.conf.j2
@@ -1,13 +1,12 @@
 {% set vrf_command = 'ip vrf exec ' ~ vrf ~ ' ' if vrf is vyos_defined else '' %}
 [Unit]
 StartLimitIntervalSec=0
 After=vyos-router.service
 
 [Service]
 Environment=
 Environment="MIBDIRS=/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf:/usr/share/vyos/mibs"
 ExecStart=
 ExecStart={{ vrf_command }}/usr/sbin/snmpd -LS0-5d -Lf /dev/null -u Debian-snmp -g Debian-snmp -f -p /run/snmpd.pid
 Restart=always
 RestartSec=10
-
diff --git a/data/templates/snmp/usr.snmpd.conf.j2 b/data/templates/snmp/usr.snmpd.conf.j2
index a713c1cec..189032bb0 100644
--- a/data/templates/snmp/usr.snmpd.conf.j2
+++ b/data/templates/snmp/usr.snmpd.conf.j2
@@ -1,8 +1,8 @@
-### Autogenerated by snmp.py ###
+### Autogenerated by service_snmp.py ###
 {% if v3.user is vyos_defined %}
 {%     for user, user_config in v3.user.items() %}
 {{ user_config.mode }}user {{ user }}
 {%     endfor %}
 {% endif %}
 
 rwuser {{ vyos_user }}
diff --git a/data/templates/snmp/var.snmpd.conf.j2 b/data/templates/snmp/var.snmpd.conf.j2
index 012f33aeb..afab88abc 100644
--- a/data/templates/snmp/var.snmpd.conf.j2
+++ b/data/templates/snmp/var.snmpd.conf.j2
@@ -1,16 +1,16 @@
-### Autogenerated by snmp.py ###
+### Autogenerated by service_snmp.py ###
 # user
 {% if v3 is vyos_defined %}
 {%     if v3.user is vyos_defined %}
 {%         for user, user_config in v3.user.items() %}
 usmUser 1 3 0x{{ v3.engineid }} "{{ user }}" "{{ user }}" NULL {{ user_config.auth.type | snmp_auth_oid }} 0x{{ user_config.auth.encrypted_password }} {{ user_config.privacy.type | snmp_auth_oid }} 0x{{ user_config.privacy.encrypted_password }} 0x
 {%         endfor %}
 {%     endif %}
 
 # VyOS default user
 createUser {{ vyos_user }} MD5 "{{ vyos_user_pass }}" DES
 
 {%     if v3.engineid is vyos_defined %}
 oldEngineID 0x{{ v3.engineid }}
 {%     endif %}
 {% endif %}
diff --git a/data/templates/ssh/sshd_config.j2 b/data/templates/ssh/sshd_config.j2
index 422969ed8..650fd25e6 100644
--- a/data/templates/ssh/sshd_config.j2
+++ b/data/templates/ssh/sshd_config.j2
@@ -1,107 +1,107 @@
-### Autogenerated by ssh.py ###
+### Autogenerated by service_ssh.py ###
 
 # https://linux.die.net/man/5/sshd_config
 
 #
 # Non-configurable defaults
 #
 Protocol 2
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_dsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key
 SyslogFacility AUTH
 LoginGraceTime 120
 StrictModes yes
 PubkeyAuthentication yes
 IgnoreRhosts yes
 HostbasedAuthentication no
 PermitEmptyPasswords no
 X11Forwarding yes
 X11DisplayOffset 10
 PrintMotd no
 PrintLastLog yes
 TCPKeepAlive yes
 Banner /etc/issue.net
 Subsystem sftp /usr/lib/openssh/sftp-server
 UsePAM yes
 PermitRootLogin no
 PidFile /run/sshd/sshd.pid
 AddressFamily any
 DebianBanner no
 KbdInteractiveAuthentication no
 
 #
 # User configurable section
 #
 
 # Look up remote host name and check that the resolved host name for the remote IP
 # address maps back to the very same IP address.
 UseDNS {{ "no" if disable_host_validation is vyos_defined else "yes" }}
 
 # Specifies the port number that sshd(8) listens on
 {% for value in port %}
 Port {{ value }}
 {% endfor %}
 
 # Gives the verbosity level that is used when logging messages from sshd
 LogLevel {{ loglevel | upper }}
 
 # Specifies whether password authentication is allowed
 PasswordAuthentication {{ "no" if disable_password_authentication is vyos_defined else "yes" }}
 
 {% if listen_address is vyos_defined %}
 # Specifies the local addresses sshd should listen on
 {%     for address in listen_address %}
 ListenAddress {{ address }}
 {%     endfor %}
 {% endif %}
 
 {% if ciphers is vyos_defined %}
 # Specifies the ciphers allowed for protocol version 2
 Ciphers {{ ciphers | join(',') }}
 {% endif %}
 
 {% if hostkey_algorithm is vyos_defined %}
 # Specifies the available Host Key signature algorithms
 HostKeyAlgorithms {{ hostkey_algorithm | join(',') }}
 {% endif %}
 
 {% if mac is vyos_defined %}
 # Specifies the available MAC (message authentication code) algorithms
 MACs {{ mac | join(',') }}
 {% endif %}
 
 {% if key_exchange is vyos_defined %}
 # Specifies the available Key Exchange algorithms
 KexAlgorithms {{ key_exchange | join(',') }}
 {% endif %}
 
 {% if access_control is vyos_defined %}
 {%     if access_control.allow.user is vyos_defined %}
 # If specified, login is allowed only for user names that match
 AllowUsers {{ access_control.allow.user | join(' ') }}
 {%     endif %}
 {%     if access_control.allow.group is vyos_defined %}
 # If specified, login is allowed only for users whose primary group or supplementary group list matches
 AllowGroups {{ access_control.allow.group | join(' ') }}
 {%     endif %}
 {%     if access_control.deny.user is vyos_defined %}
 # Login is disallowed for user names that match
 DenyUsers {{ access_control.deny.user | join(' ') }}
 {%     endif %}
 {%     if access_control.deny.group is vyos_defined %}
 # Login is disallowed for users whose primary group or supplementary group list matches
 DenyGroups {{ access_control.deny.group | join(' ') }}
 {%     endif %}
 {% endif %}
 
 {% if client_keepalive_interval is vyos_defined %}
 # Sets a timeout interval in seconds after which if no data has been received from the client,
 # sshd(8) will send a message through the encrypted channel to request a response from the client
 ClientAliveInterval {{ client_keepalive_interval }}
 {% endif %}
 
 {% if rekey.data is vyos_defined  %}
 RekeyLimit {{ rekey.data }}M {{ rekey.time + 'M' if rekey.time is vyos_defined }}
 {% endif %}
diff --git a/data/templates/ssh/sshguard_config.j2 b/data/templates/ssh/sshguard_config.j2
index 58c6ad48d..2e7507416 100644
--- a/data/templates/ssh/sshguard_config.j2
+++ b/data/templates/ssh/sshguard_config.j2
@@ -1,27 +1,27 @@
-### Autogenerated by ssh.py ###
+### Autogenerated by service_ssh.py ###
 
 {% if dynamic_protection is vyos_defined %}
 # Full path to backend executable (required, no default)
 BACKEND="/usr/libexec/sshguard/sshg-fw-nft-sets"
 
 # Shell command that provides logs on standard output. (optional, no default)
 # Example 1: ssh and sendmail from systemd journal:
 LOGREADER="LANG=C journalctl -afb -p info -n1 -t sshd -o cat"
 
 #### OPTIONS ####
 # Block attackers when their cumulative attack score exceeds THRESHOLD.
 # Most attacks have a score of 10. (optional, default 30)
 THRESHOLD={{ dynamic_protection.threshold }}
 
 # Block attackers for initially BLOCK_TIME seconds after exceeding THRESHOLD.
 # Subsequent blocks increase by a factor of 1.5. (optional, default 120)
 BLOCK_TIME={{ dynamic_protection.block_time }}
 
 # Remember potential attackers for up to DETECTION_TIME seconds before
 # resetting their score. (optional, default 1800)
 DETECTION_TIME={{ dynamic_protection.detect_time }}
 
 # IP addresses listed in the WHITELIST_FILE are considered to be
 # friendlies and will never be blocked.
 WHITELIST_FILE=/etc/sshguard/whitelist
 {% endif %}
diff --git a/data/templates/ssh/sshguard_whitelist.j2 b/data/templates/ssh/sshguard_whitelist.j2
index 47a950a2b..194fa29df 100644
--- a/data/templates/ssh/sshguard_whitelist.j2
+++ b/data/templates/ssh/sshguard_whitelist.j2
@@ -1,7 +1,7 @@
-### Autogenerated by ssh.py ###
+### Autogenerated by service_ssh.py ###
 
 {% if dynamic_protection.allow_from is vyos_defined %}
 {%     for address in dynamic_protection.allow_from %}
 {{ address }}
 {%     endfor %}
 {% endif %}
diff --git a/data/templates/sstp-client/peer.j2 b/data/templates/sstp-client/peer.j2
index 745a09e14..d38e53f15 100644
--- a/data/templates/sstp-client/peer.j2
+++ b/data/templates/sstp-client/peer.j2
@@ -1,53 +1,53 @@
-### Autogenerated by interfaces-sstpc.py ###
+### Autogenerated by interfaces_sstpc.py ###
 {{ '# ' ~ description if description is vyos_defined else '' }}
 
 # Require peer to provide the local IP address if it is not
 # specified explicitly in the config file.
 noipdefault
 
 # Don't show the password in logfiles:
 hide-password
 
 remotename {{ ifname }}
 linkname   {{ ifname }}
 ipparam    {{ ifname }}
 ifname     {{ ifname }}
 pty "sstpc --ipparam {{ ifname }} --nolaunchpppd {{ server }}:{{ port }} --ca-cert {{ ca_file_path }}"
 
 # Override any connect script that may have been set in /etc/ppp/options.
 connect /bin/true
 
 # We don't need the server to auth itself
 noauth
 
 # We won't want EAP
 refuse-eap
 
 # Don't try to proxy ARP for the remote endpoint. User can set proxy
 # arp entries up manually if they wish. More importantly, having
 # the "proxyarp" parameter set disables the "defaultroute" option.
 noproxyarp
 
 # Unlimited connection attempts
 maxfail 0
 
 plugin sstp-pppd-plugin.so
 sstp-sock /var/run/sstpc/sstpc-{{ ifname }}
 
 persist
 debug
 
 # pppd should create a UUCP-style lock file for the serial device to ensure
 # exclusive access to the device. By default, pppd will not create a lock file.
 lock
 
 # Disables Deflate compression
 nodeflate
 
 {% if authentication is vyos_defined %}
 {{ 'user "' + authentication.username + '"' if authentication.username is vyos_defined }}
 {{ 'password "' + authentication.password + '"' if authentication.password is vyos_defined }}
 {% endif %}
 
 {{ "usepeerdns" if no_peer_dns is not vyos_defined }}
 
diff --git a/data/templates/system/proxy.j2 b/data/templates/system/proxy.j2
index 215c4c5c2..0737cd3f8 100644
--- a/data/templates/system/proxy.j2
+++ b/data/templates/system/proxy.j2
@@ -1,7 +1,7 @@
-# generated by system-proxy.py
+### autogenerated by system_proxy.py ###
 {% if url is vyos_defined and port is vyos_defined %}
 {# remove http:// prefix so we can inject a username/password if present #}
 export http_proxy=http://{{ username ~ ':' ~ password ~ '@' if username is vyos_defined and password is vyos_defined }}{{ url | replace('http://', '') }}:{{ port }}
 export https_proxy=$http_proxy
 export ftp_proxy=$http_proxy
 {% endif %}
diff --git a/data/templates/tftp-server/default.j2 b/data/templates/tftp-server/default.j2
index b2676e0aa..d9ce847de 100644
--- a/data/templates/tftp-server/default.j2
+++ b/data/templates/tftp-server/default.j2
@@ -1,8 +1,8 @@
 {# j2lint: disable=jinja-variable-format #}
-### Autogenerated by tftp_server.py ###
+### Autogenerated by service_tftp-server.py ###
 DAEMON_ARGS="--listen --user tftp --address {{ listen_address }} {{ "--create --umask 000" if allow_upload is vyos_defined }} --secure {{ directory }}"
 {% if vrf is vyos_defined %}
 VRF_ARGS="ip vrf exec {{ vrf }}"
 {% else %}
 VRF_ARGS=""
 {% endif %}
diff --git a/data/templates/wifi/hostapd.conf.j2 b/data/templates/wifi/hostapd.conf.j2
index c3f32da72..83009242b 100644
--- a/data/templates/wifi/hostapd.conf.j2
+++ b/data/templates/wifi/hostapd.conf.j2
@@ -1,742 +1,742 @@
 {# j2lint: disable=operator-enclosed-by-spaces #}
-### Autogenerated by interfaces-wireless.py ###
+### Autogenerated by interfaces_wireless.py ###
 {% if description is vyos_defined %}
 # Description: {{ description }}
 # User-friendly description of device; up to 32 octets encoded in UTF-8
 device_name={{ description | truncate(32, True) }}
 {% endif %}
 
 # AP netdevice name (without 'ap' postfix, i.e., wlan0 uses wlan0ap for
 # management frames with the Host AP driver); wlan0 with many nl80211 drivers
 # Note: This attribute can be overridden by the values supplied with the '-i'
 # command line parameter.
 interface={{ ifname }}
 
 {% if is_bridge_member is vyos_defined %}
 # In case of atheros and nl80211 driver interfaces, an additional
 # configuration parameter, bridge, may be used to notify hostapd if the
 # interface is included in a bridge. This parameter is not used with Host AP
 # driver. If the bridge parameter is not set, the drivers will automatically
 # figure out the bridge interface (assuming sysfs is enabled and mounted to
 # /sys) and this parameter may not be needed.
 #
 # For nl80211, this parameter can be used to request the AP interface to be
 # added to the bridge automatically (brctl may refuse to do this before hostapd
 # has been started to change the interface mode). If needed, the bridge
 # interface is also created.
 {# as there can only be one bridge interface it is save to loop #}
 {%     for bridge in is_bridge_member %}
 bridge={{ bridge }}
 {%     endfor %}
 {% endif %}
 
 # Driver interface type (hostap/wired/none/nl80211/bsd);
 # default: hostap). nl80211 is used with all Linux mac80211 drivers.
 # Use driver=none if building hostapd as a standalone RADIUS server that does
 # not control any wireless/wired driver.
 driver=nl80211
 
 # Levels (minimum value for logged events):
 #  0 = verbose debugging
 #  1 = debugging
 #  2 = informational messages
 #  3 = notification
 #  4 = warning
 logger_syslog=-1
 logger_syslog_level=0
 logger_stdout=-1
 logger_stdout_level=0
 
 {% if country_code %}
 # Country code (ISO/IEC 3166-1). Used to set regulatory domain.
 # Set as needed to indicate country in which device is operating.
 # This can limit available channels and transmit power.
 country_code={{ country_code | upper }}
 
 # Enable IEEE 802.11d. This advertises the country_code and the set of allowed
 # channels and transmit power levels based on the regulatory limits. The
 # country_code setting must be configured with the correct country for
 # IEEE 802.11d functions.
 ieee80211d=1
 {% endif %}
 
 {% if ssid %}
 # SSID to be used in IEEE 802.11 management frames
 ssid={{ ssid }}
 {% endif %}
 
 {% if channel %}
 # Channel number (IEEE 802.11)
 # (default: 0, i.e., not set)
 # Please note that some drivers do not use this value from hostapd and the
 # channel will need to be configured separately with iwconfig.
 channel={{ channel }}
 {% endif %}
 
 {% if mode is vyos_defined %}
 # Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz),
 # g = IEEE 802.11g (2.4 GHz), ad = IEEE 802.11ad (60 GHz); a/g options are used
 # with IEEE 802.11n (HT), too, to specify band). For IEEE 802.11ac (VHT), this
 # needs to be set to hw_mode a. For IEEE 802.11ax (HE) on 6 GHz this needs
 # to be set to hw_mode a. When using ACS (see channel parameter), a
 # special value "any" can be used to indicate that any support band can be used.
 # This special case is currently supported only with drivers with which
 # offloaded ACS is used.
 {%     if mode is vyos_defined('n') %}
 hw_mode=g
 {%     elif mode is vyos_defined('ac') %}
 hw_mode=a
 ieee80211h=1
 ieee80211ac=1
 {%     else %}
 hw_mode={{ mode }}
 {%     endif %}
 {% endif %}
 
 # ieee80211w: Whether management frame protection (MFP) is enabled
 # 0 = disabled (default)
 # 1 = optional
 # 2 = required
 {% if 'disabled' in mgmt_frame_protection %}
 ieee80211w=0
 {% elif 'optional' in mgmt_frame_protection %}
 ieee80211w=1
 {% elif 'required' in mgmt_frame_protection %}
 ieee80211w=2
 {% endif %}
 
 {% if capabilities is vyos_defined %}
 # ht_capab: HT capabilities (list of flags)
 # LDPC coding capability: [LDPC] = supported
 # Supported channel width set: [HT40-] = both 20 MHz and 40 MHz with secondary
 #	channel below the primary channel; [HT40+] = both 20 MHz and 40 MHz
 #	with secondary channel above the primary channel
 #	(20 MHz only if neither is set)
 #	Note: There are limits on which channels can be used with HT40- and
 #	HT40+. Following table shows the channels that may be available for
 #	HT40- and HT40+ use per IEEE 802.11n Annex J:
 #	freq		HT40-		HT40+
 #	2.4 GHz		5-13		1-7 (1-9 in Europe/Japan)
 #	5 GHz		40,48,56,64	36,44,52,60
 #	(depending on the location, not all of these channels may be available
 #	for use)
 #	Please note that 40 MHz channels may switch their primary and secondary
 #	channels if needed or creation of 40 MHz channel maybe rejected based
 #	on overlapping BSSes. These changes are done automatically when hostapd
 #	is setting up the 40 MHz channel.
 # Spatial Multiplexing (SM) Power Save: [SMPS-STATIC] or [SMPS-DYNAMIC]
 #	(SMPS disabled if neither is set)
 # HT-greenfield: [GF] (disabled if not set)
 # Short GI for 20 MHz: [SHORT-GI-20] (disabled if not set)
 # Short GI for 40 MHz: [SHORT-GI-40] (disabled if not set)
 # Tx STBC: [TX-STBC] (disabled if not set)
 # Rx STBC: [RX-STBC1] (one spatial stream), [RX-STBC12] (one or two spatial
 #	streams), or [RX-STBC123] (one, two, or three spatial streams); Rx STBC
 #	disabled if none of these set
 # HT-delayed Block Ack: [DELAYED-BA] (disabled if not set)
 # Maximum A-MSDU length: [MAX-AMSDU-7935] for 7935 octets (3839 octets if not
 #	set)
 # DSSS/CCK Mode in 40 MHz: [DSSS_CCK-40] = allowed (not allowed if not set)
 # 40 MHz intolerant [40-INTOLERANT] (not advertised if not set)
 # L-SIG TXOP protection support: [LSIG-TXOP-PROT] (disabled if not set)
 {%     set output = namespace(value='')  %}
 
 {%     if capabilities.ht.fourtymhz_incapable is vyos_defined %}
 {%         set output.value = output.value ~ '[40-INTOLERANT]' %}
 {%     endif %}
 {%     if capabilities.ht.delayed_block_ack is vyos_defined %}
 {%         set output.value = output.value ~ '[DELAYED-BA]' %}
 {%     endif %}
 {%     if capabilities.ht.dsss_cck_40 is vyos_defined %}
 {%         set output.value = output.value ~ '[DSSS_CCK-40]' %}
 {%     endif %}
 {%     if capabilities.ht.greenfield is vyos_defined %}
 {%         set output.value = output.value ~ '[GF]' %}
 {%     endif %}
 {%     if capabilities.ht.ldpc is vyos_defined %}
 {%         set output.value = output.value ~ '[LDPC]' %}
 {%     endif %}
 {%     if capabilities.ht.lsig_protection is vyos_defined %}
 {%         set output.value = output.value ~ '[LSIG-TXOP-PROT]' %}
 {%     endif %}
 {%     if capabilities.ht.stbc.tx is vyos_defined %}
 {%         set output.value = output.value ~ '[TX-STBC]' %}
 {%     endif %}
 {%     if capabilities.ht.stbc.rx is vyos_defined %}
 {%         set output.value = output.value ~ '[RX-STBC-' ~ capabilities.ht.stbc.rx | upper ~ ']' %}
 {%     endif %}
 {%     if capabilities.ht.max_amsdu is vyos_defined %}
 {%         set output.value = output.value ~ '[MAX-AMSDU-' ~ capabilities.ht.max_amsdu ~ ']' %}
 {%     endif %}
 {%     if capabilities.ht.smps is vyos_defined %}
 {%         set output.value = output.value ~ '[SMPS-' ~ capabilities.ht.smps | upper ~ ']' %}
 {%     endif %}
 
 {%     if capabilities.ht.channel_set_width is vyos_defined %}
 {%         for csw in capabilities.ht.channel_set_width %}
 {%             set output.value = output.value ~ '[' ~ csw | upper ~ ']'  %}
 {%         endfor %}
 {%     endif %}
 
 {%     if capabilities.ht.short_gi is vyos_defined %}
 {%         for short_gi in capabilities.ht.short_gi %}
 {%             set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
 {%         endfor %}
 {%     endif %}
 
 ht_capab={{ output.value }}
 
 {%     if capabilities.ht.auto_powersave is vyos_defined %}
 # WMM-PS Unscheduled Automatic Power Save Delivery [U-APSD]
 # Enable this flag if U-APSD supported outside hostapd (eg., Firmware/driver)
 uapsd_advertisement_enabled=1
 {%     endif %}
 {% endif %}
 
 # Required for full HT and VHT functionality
 wme_enabled=1
 
 
 {% if capabilities.require_ht is vyos_defined %}
 # Require stations to support HT PHY (reject association if they do not)
 require_ht=1
 {% endif %}
 
 {% if capabilities.vht is vyos_defined %}
 # vht_capab: VHT capabilities (list of flags)
 #
 # vht_max_mpdu_len: [MAX-MPDU-7991] [MAX-MPDU-11454]
 # Indicates maximum MPDU length
 # 0 = 3895 octets (default)
 # 1 = 7991 octets
 # 2 = 11454 octets
 # 3 = reserved
 #
 # supported_chan_width: [VHT160] [VHT160-80PLUS80]
 # Indicates supported Channel widths
 # 0 = 160 MHz & 80+80 channel widths are not supported (default)
 # 1 = 160 MHz channel width is supported
 # 2 = 160 MHz & 80+80 channel widths are supported
 # 3 = reserved
 #
 # Rx LDPC coding capability: [RXLDPC]
 # Indicates support for receiving LDPC coded pkts
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # Short GI for 80 MHz: [SHORT-GI-80]
 # Indicates short GI support for reception of packets transmitted with TXVECTOR
 # params format equal to VHT and CBW = 80Mhz
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # Short GI for 160 MHz: [SHORT-GI-160]
 # Indicates short GI support for reception of packets transmitted with TXVECTOR
 # params format equal to VHT and CBW = 160Mhz
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # Tx STBC: [TX-STBC-2BY1]
 # Indicates support for the transmission of at least 2x1 STBC
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # Rx STBC: [RX-STBC-1] [RX-STBC-12] [RX-STBC-123] [RX-STBC-1234]
 # Indicates support for the reception of PPDUs using STBC
 # 0 = Not supported (default)
 # 1 = support of one spatial stream
 # 2 = support of one and two spatial streams
 # 3 = support of one, two and three spatial streams
 # 4 = support of one, two, three and four spatial streams
 # 5,6,7 = reserved
 #
 # SU Beamformer Capable: [SU-BEAMFORMER]
 # Indicates support for operation as a single user beamformer
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # SU Beamformee Capable: [SU-BEAMFORMEE]
 # Indicates support for operation as a single user beamformee
 # 0 = Not supported (default)
 # 1 = Supported
 #
 # Compressed Steering Number of Beamformer Antennas Supported:
 # [BF-ANTENNA-2] [BF-ANTENNA-3] [BF-ANTENNA-4]
 #   Beamformee's capability indicating the maximum number of beamformer
 #   antennas the beamformee can support when sending compressed beamforming
 #   feedback
 # If SU beamformer capable, set to maximum value minus 1
 # else reserved (default)
 #
 # Number of Sounding Dimensions:
 # [SOUNDING-DIMENSION-2] [SOUNDING-DIMENSION-3] [SOUNDING-DIMENSION-4]
 # Beamformer's capability indicating the maximum value of the NUM_STS parameter
 # in the TXVECTOR of a VHT NDP
 # If SU beamformer capable, set to maximum value minus 1
 # else reserved (default)
 #
 # MU Beamformer Capable: [MU-BEAMFORMER]
 # Indicates support for operation as an MU beamformer
 # 0 = Not supported or sent by Non-AP STA (default)
 # 1 = Supported
 #
 # VHT TXOP PS: [VHT-TXOP-PS]
 # Indicates whether or not the AP supports VHT TXOP Power Save Mode
 #  or whether or not the STA is in VHT TXOP Power Save mode
 # 0 = VHT AP doesn't support VHT TXOP PS mode (OR) VHT STA not in VHT TXOP PS
 #  mode
 # 1 = VHT AP supports VHT TXOP PS mode (OR) VHT STA is in VHT TXOP power save
 #  mode
 #
 # +HTC-VHT Capable: [HTC-VHT]
 # Indicates whether or not the STA supports receiving a VHT variant HT Control
 # field.
 # 0 = Not supported (default)
 # 1 = supported
 #
 # Maximum A-MPDU Length Exponent: [MAX-A-MPDU-LEN-EXP0]..[MAX-A-MPDU-LEN-EXP7]
 # Indicates the maximum length of A-MPDU pre-EOF padding that the STA can recv
 # This field is an integer in the range of 0 to 7.
 # The length defined by this field is equal to
 # 2 pow(13 ~ Maximum A-MPDU Length Exponent) -1 octets
 #
 # VHT Link Adaptation Capable: [VHT-LINK-ADAPT2] [VHT-LINK-ADAPT3]
 # Indicates whether or not the STA supports link adaptation using VHT variant
 # HT Control field
 # If +HTC-VHTcapable is 1
 #  0 = (no feedback) if the STA does not provide VHT MFB (default)
 #  1 = reserved
 #  2 = (Unsolicited) if the STA provides only unsolicited VHT MFB
 #  3 = (Both) if the STA can provide VHT MFB in response to VHT MRQ and if the
 #      STA provides unsolicited VHT MFB
 # Reserved if +HTC-VHTcapable is 0
 #
 # Rx Antenna Pattern Consistency: [RX-ANTENNA-PATTERN]
 # Indicates the possibility of Rx antenna pattern change
 # 0 = Rx antenna pattern might change during the lifetime of an association
 # 1 = Rx antenna pattern does not change during the lifetime of an association
 #
 # Tx Antenna Pattern Consistency: [TX-ANTENNA-PATTERN]
 # Indicates the possibility of Tx antenna pattern change
 # 0 = Tx antenna pattern might change during the lifetime of an association
 # 1 = Tx antenna pattern does not change during the lifetime of an
 
 {%     if capabilities.vht.center_channel_freq.freq_1 is vyos_defined %}
 # center freq = 5 GHz ~ (5 * index)
 # So index 42 gives center freq 5.210 GHz
 # which is channel 42 in 5G band
 vht_oper_centr_freq_seg0_idx={{ capabilities.vht.center_channel_freq.freq_1 }}
 {%     endif %}
 
 {%     if capabilities.vht.center_channel_freq.freq_2 is vyos_defined %}
 # center freq = 5 GHz ~ (5 * index)
 # So index 159 gives center freq 5.795 GHz
 # which is channel 159 in 5G band
 vht_oper_centr_freq_seg1_idx={{ capabilities.vht.center_channel_freq.freq_2 }}
 {%     endif %}
 
 {%     if capabilities.vht.channel_set_width is vyos_defined %}
 vht_oper_chwidth={{ capabilities.vht.channel_set_width }}
 {%     endif %}
 
 {%     set output = namespace(value='')  %}
 {%     if capabilities.vht.channel_set_width is vyos_defined('2') %}
 {%         set output.value = output.value ~ '[VHT160]' %}
 {%     elif capabilities.vht.channel_set_width is vyos_defined('3') %}
 {%         set output.value = output.value ~ '[VHT160-80PLUS80]' %}
 {%     endif %}
 {%     if capabilities.vht.stbc.tx is vyos_defined %}
 {%         set output.value = output.value ~ '[TX-STBC-2BY1]' %}
 {%     endif %}
 {%     if capabilities.vht.stbc.rx is vyos_defined %}
 {%         set output.value = output.value ~ '[RX-STBC-' ~ capabilities.vht.stbc.rx ~ ']' %}
 {%     endif %}
 {%     if capabilities.vht.ldpc is vyos_defined %}
 {%         set output.value = output.value ~ '[RXLDPC]' %}
 {%     endif %}
 {%     if capabilities.vht.tx_powersave is vyos_defined %}
 {%         set output.value = output.value ~ '[VHT-TXOP-PS]' %}
 {%     endif %}
 {%     if capabilities.vht.vht_cf is vyos_defined %}
 {%         set output.value = output.value ~ '[HTC-VHT]' %}
 {%     endif %}
 {%     if capabilities.vht.antenna_pattern_fixed is vyos_defined %}
 {%         set output.value = output.value ~ '[RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN]' %}
 {%     endif %}
 {%     if capabilities.vht.max_mpdu is vyos_defined %}
 {%         set output.value = output.value ~ '[MAX-MPDU-' ~ capabilities.vht.max_mpdu ~ ']' %}
 {%     endif %}
 {%     if capabilities.vht.max_mpdu_exp is vyos_defined %}
 {%         set output.value = output.value ~ '[MAX-A-MPDU-LEN-EXP-' ~ capabilities.vht.max_mpdu_exp ~ ']' %}
 {%     endif %}
 {%     if capabilities.vht.link_adaptation is vyos_defined('unsolicited') %}
 {%         set output.value = output.value ~ '[VHT-LINK-ADAPT2]' %}
 {%     elif capabilities.vht.link_adaptation is vyos_defined('both') %}
 {%         set output.value = output.value ~ '[VHT-LINK-ADAPT3]' %}
 {%     endif %}
 {%     for short_gi in capabilities.vht.short_gi if capabilities.vht.short_gi is vyos_defined %}
 {%         set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
 {%     endfor %}
 {%     for beamform in capabilities.vht.beamform if capabilities.vht.beamform is vyos_defined %}
 {%         set output.value = output.value ~ '[SU-BEAMFORMER]' if beamform is vyos_defined('single-user-beamformer') else '' %}
 {%         set output.value = output.value ~ '[SU-BEAMFORMEE]' if beamform is vyos_defined('single-user-beamformee') else '' %}
 {%         set output.value = output.value ~ '[MU-BEAMFORMER]' if beamform is vyos_defined('multi-user-beamformer')  else '' %}
 {%         set output.value = output.value ~ '[MU-BEAMFORMEE]' if beamform is vyos_defined('multi-user-beamformee')  else '' %}
 {%     endfor %}
 {%     if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1  %}
 {%         if capabilities.vht.beamform is vyos_defined %}
 {%             if capabilities.vht.beamform == 'single-user-beamformer' %}
 {%                 if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 6  %}
 {%                     set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
 {%                     set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
 {%                 endif %}
 {%             endif %}
 {%             if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 5  %}
 {%                 set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count ~ ']' %}
 {%                 set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count ~ ']' %}
 {%             endif %}
 {%         endif %}
 {%     endif %}
 
 vht_capab={{ output.value }}
 {% endif %}
 
 # ieee80211n: Whether IEEE 802.11n (HT) is enabled
 # 0 = disabled (default)
 # 1 = enabled
 # Note: You will also need to enable WMM for full HT functionality.
 # Note: hw_mode=g (2.4 GHz) and hw_mode=a (5 GHz) is used to specify the band.
 {% if capabilities.require_vht is vyos_defined %}
 ieee80211n=0
 # Require stations to support VHT PHY (reject association if they do not)
 require_vht=1
 {% else %}
 ieee80211n={{ '1' if 'n' in mode or 'ac' in mode else '0' }}
 {% endif %}
 
 {% if disable_broadcast_ssid is vyos_defined %}
 # Send empty SSID in beacons and ignore probe request frames that do not
 # specify full SSID, i.e., require stations to know SSID.
 # default: disabled (0)
 # 1 = send empty (length=0) SSID in beacon and ignore probe request for
 #     broadcast SSID
 # 2 = clear SSID (ASCII 0), but keep the original length (this may be required
 #     with some clients that do not support empty SSID) and ignore probe
 #     requests for broadcast SSID
 ignore_broadcast_ssid=1
 {% endif %}
 
 {% if type is vyos_defined('access-point') %}
 # Station MAC address-based authentication
 # Please note that this kind of access control requires a driver that uses
 # hostapd to take care of management frame processing and as such, this can be
 # used with driver=hostap or driver=nl80211, but not with driver=atheros.
 # 0 = accept unless in deny list
 # 1 = deny unless in accept list
 # 2 = use external RADIUS server (accept/deny lists are searched first)
 macaddr_acl={{ '0' if security.station_address.mode is vyos_defined('accept') else '1' }}
 
 # Accept/deny lists are read from separate files (containing list of
 # MAC addresses, one per line). Use absolute path name to make sure that the
 # files can be read on SIGHUP configuration reloads.
 accept_mac_file={{ hostapd_accept_station_conf }}
 deny_mac_file={{ hostapd_deny_station_conf }}
 {% endif %}
 
 {% if max_stations is vyos_defined %}
 # Maximum number of stations allowed in station table. New stations will be
 # rejected after the station table is full. IEEE 802.11 has a limit of 2007
 # different association IDs, so this number should not be larger than that.
 # (default: 2007)
 max_num_sta={{ max_stations }}
 {% endif %}
 
 {% if isolate_stations is vyos_defined %}
 # Client isolation can be used to prevent low-level bridging of frames between
 # associated stations in the BSS. By default, this bridging is allowed.
 ap_isolate=1
 {% endif %}
 
 {% if reduce_transmit_power is vyos_defined %}
 # Add Power Constraint element to Beacon and Probe Response frames
 # This config option adds Power Constraint element when applicable and Country
 # element is added. Power Constraint element is required by Transmit Power
 # Control. This can be used only with ieee80211d=1.
 # Valid values are 0..255.
 local_pwr_constraint={{ reduce_transmit_power }}
 {% endif %}
 
 {% if expunge_failing_stations is vyos_defined %}
 # Disassociate stations based on excessive transmission failures or other
 # indications of connection loss. This depends on the driver capabilities and
 # may not be available with all drivers.
 disassoc_low_ack=1
 {% endif %}
 
 
 {% if security.wep is vyos_defined %}
 # IEEE 802.11 specifies two authentication algorithms. hostapd can be
 # configured to allow both of these or only one. Open system authentication
 # should be used with IEEE 802.1X.
 # Bit fields of allowed authentication algorithms:
 # bit 0 = Open System Authentication
 # bit 1 = Shared Key Authentication (requires WEP)
 auth_algs=2
 
 # WEP rekeying (disabled if key lengths are not set or are set to 0)
 # Key lengths for default/broadcast and individual/unicast keys:
 # 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
 # 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
 wep_key_len_broadcast=5
 wep_key_len_unicast=5
 
 # Static WEP key configuration
 #
 # The key number to use when transmitting.
 # It must be between 0 and 3, and the corresponding key must be set.
 # default: not set
 wep_default_key=0
 
 # The WEP keys to use.
 # A key may be a quoted string or unquoted hexadecimal digits.
 # The key length should be 5, 13, or 16 characters, or 10, 26, or 32
 # digits, depending on whether 40-bit (64-bit), 104-bit (128-bit), or
 # 128-bit (152-bit) WEP is used.
 # Only the default key must be supplied; the others are optional.
 {%     if security.wep.key is vyos_defined %}
 {%         for key in sec_wep_key %}
 wep_key{{ loop.index -1 }}={{ security.wep.key }}
 {%         endfor %}
 {%     endif %}
 
 
 {% elif security.wpa is vyos_defined %}
 ##### WPA/IEEE 802.11i configuration ##########################################
 
 # Enable WPA. Setting this variable configures the AP to require WPA (either
 # WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, either
 # wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include WPA-PSK.
 # Instead of wpa_psk / wpa_passphrase, wpa_psk_radius might suffice.
 # For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
 # RADIUS authentication server must be configured, and WPA-EAP must be included
 # in wpa_key_mgmt.
 # This field is a bit field that can be used to enable WPA (IEEE 802.11i/D3.0)
 # and/or WPA2 (full IEEE 802.11i/RSN):
 # bit0 = WPA
 # bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
 # Note that WPA3 is also configured with bit1 since it uses RSN just like WPA2.
 # In other words, for WPA3, wpa 2 is used the configuration (and
 # wpa_key_mgmt=SAE for WPA3-Personal instead of wpa_key_mgmt=WPA-PSK).
 {%     if security.wpa.mode is vyos_defined('wpa+wpa2') %}
 wpa=3
 {%     elif security.wpa.mode is vyos_defined('wpa2') or security.wpa.mode is vyos_defined('wpa3') %}
 wpa=2
 {%     elif security.wpa.mode is vyos_defined('wpa') %}
 wpa=1
 {%     endif %}
 
 {%     if security.wpa.cipher is vyos_defined %}
 # Set of accepted cipher suites (encryption algorithms) for pairwise keys
 # (unicast packets). This is a space separated list of algorithms:
 # CCMP = AES in Counter mode with CBC-MAC (CCMP-128)
 # TKIP = Temporal Key Integrity Protocol
 # CCMP-256 = AES in Counter mode with CBC-MAC with 256-bit key
 # GCMP = Galois/counter mode protocol (GCMP-128)
 # GCMP-256 = Galois/counter mode protocol with 256-bit key
 # Group cipher suite (encryption algorithm for broadcast and multicast frames)
 # is automatically selected based on this configuration. If only CCMP is
 # allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
 # TKIP will be used as the group cipher. The optional group_cipher parameter can
 # be used to override this automatic selection.
 
 {%         if security.wpa.mode is vyos_defined('wpa2') %}
 # Pairwise cipher for RSN/WPA2 (default: use wpa_pairwise value)
 rsn_pairwise={{ security.wpa.cipher | join(" ") }}
 {%         else %}
 # Pairwise cipher for WPA (v1) (default: TKIP)
 wpa_pairwise={{ security.wpa.cipher | join(" ") }}
 {%         endif %}
 {%     endif %}
 
 {%     if security.wpa.group_cipher is vyos_defined %}
 # Optional override for automatic group cipher selection
 # This can be used to select a specific group cipher regardless of which
 # pairwise ciphers were enabled for WPA and RSN. It should be noted that
 # overriding the group cipher with an unexpected value can result in
 # interoperability issues and in general, this parameter is mainly used for
 # testing purposes.
 group_cipher={{ security.wpa.group_cipher | join(" ") }}
 {%     endif %}
 
 {%     if security.wpa.passphrase is vyos_defined %}
 # IEEE 802.11 specifies two authentication algorithms. hostapd can be
 # configured to allow both of these or only one. Open system authentication
 # should be used with IEEE 802.1X.
 # Bit fields of allowed authentication algorithms:
 # bit 0 = Open System Authentication
 # bit 1 = Shared Key Authentication (requires WEP)
 auth_algs=1
 
 # WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
 # secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
 # (8..63 characters) that will be converted to PSK. This conversion uses SSID
 # so the PSK changes when ASCII passphrase is used and the SSID is changed.
 wpa_passphrase={{ security.wpa.passphrase }}
 
 # Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
 # entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
 # added to enable SHA256-based stronger algorithms.
 # WPA-PSK = WPA-Personal / WPA2-Personal
 # WPA-PSK-SHA256 = WPA2-Personal using SHA256
 # WPA-EAP = WPA-Enterprise / WPA2-Enterprise
 # WPA-EAP-SHA256 = WPA2-Enterprise using SHA256
 # SAE = SAE (WPA3-Personal)
 # WPA-EAP-SUITE-B-192 = WPA3-Enterprise with 192-bit security/CNSA suite
 {%         if security.wpa.mode is vyos_defined('wpa3') %}
 wpa_key_mgmt=SAE
 {%         else %}
 wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256
 {%         endif %}
 
 {%     elif security.wpa.radius is vyos_defined %}
 ##### IEEE 802.1X-2004 related configuration ##################################
 # Require IEEE 802.1X authorization
 ieee8021x=1
 
 # Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
 # entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
 # added to enable SHA256-based stronger algorithms.
 # WPA-PSK = WPA-Personal / WPA2-Personal
 # WPA-PSK-SHA256 = WPA2-Personal using SHA256
 # WPA-EAP = WPA-Enterprise / WPA2-Enterprise
 # WPA-EAP-SHA256 = WPA2-Enterprise using SHA256
 # SAE = SAE (WPA3-Personal)
 # WPA-EAP-SUITE-B-192 = WPA3-Enterprise with 192-bit security/CNSA suite
 {%         if security.wpa.mode is vyos_defined('wpa3') %}
 wpa_key_mgmt=WPA-EAP-SUITE-B-192
 {%         else %}
 wpa_key_mgmt=WPA-EAP WPA-EAP-SHA256
 {%         endif %}
 
 {%         if security.wpa.radius.server is vyos_defined %}
 # RADIUS client forced local IP address for the access point
 # Normally the local IP address is determined automatically based on configured
 # IP addresses, but this field can be used to force a specific address to be
 # used, e.g., when the device has multiple IP addresses.
 # The own IP address of the access point (used as NAS-IP-Address)
 {%             if security.wpa.radius.source_address is vyos_defined %}
 radius_client_addr={{ security.wpa.radius.source_address }}
 own_ip_addr={{ security.wpa.radius.source_address }}
 {%             else %}
 own_ip_addr=127.0.0.1
 {%             endif %}
 
 {%             for radius in security.wpa.radius.server if not radius.disabled %}
 # RADIUS authentication server
 auth_server_addr={{ radius.server }}
 auth_server_port={{ radius.port }}
 auth_server_shared_secret={{ radius.key }}
 
 {%                 if radius.acc_port %}
 # RADIUS accounting server
 acct_server_addr={{ radius.server }}
 acct_server_port={{ radius.acc_port }}
 acct_server_shared_secret={{ radius.key }}
 {%                 endif %}
 {%             endfor %}
 {%         else %}
 # Open system
 auth_algs=1
 {%         endif %}
 {%     endif %}
 {% endif %}
 
 # TX queue parameters (EDCF / bursting)
 # tx_queue_<queue name>_<param>
 # queues: data0, data1, data2, data3
 #		(data0 is the highest priority queue)
 # parameters:
 #   aifs: AIFS (default 2)
 #   cwmin: cwMin (1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191,
 #	   16383, 32767)
 #   cwmax: cwMax (same values as cwMin, cwMax >= cwMin)
 #   burst: maximum length (in milliseconds with precision of up to 0.1 ms) for
 #          bursting
 #
 # Default WMM parameters (IEEE 802.11 draft; 11-03-0504-03-000e):
 # These parameters are used by the access point when transmitting frames
 # to the clients.
 #
 # Low priority / AC_BK = background
 tx_queue_data3_aifs=7
 tx_queue_data3_cwmin=15
 tx_queue_data3_cwmax=1023
 tx_queue_data3_burst=0
 # Note: for IEEE 802.11b mode: cWmin=31 cWmax=1023 burst=0
 #
 # Normal priority / AC_BE = best effort
 tx_queue_data2_aifs=3
 tx_queue_data2_cwmin=15
 tx_queue_data2_cwmax=63
 tx_queue_data2_burst=0
 # Note: for IEEE 802.11b mode: cWmin=31 cWmax=127 burst=0
 #
 # High priority / AC_VI = video
 tx_queue_data1_aifs=1
 tx_queue_data1_cwmin=7
 tx_queue_data1_cwmax=15
 tx_queue_data1_burst=3.0
 # Note: for IEEE 802.11b mode: cWmin=15 cWmax=31 burst=6.0
 #
 # Highest priority / AC_VO = voice
 tx_queue_data0_aifs=1
 tx_queue_data0_cwmin=3
 tx_queue_data0_cwmax=7
 tx_queue_data0_burst=1.5
 
 # Default WMM parameters (IEEE 802.11 draft; 11-03-0504-03-000e):
 # for 802.11a or 802.11g networks
 # These parameters are sent to WMM clients when they associate.
 # The parameters will be used by WMM clients for frames transmitted to the
 # access point.
 #
 # note - txop_limit is in units of 32microseconds
 # note - acm is admission control mandatory flag. 0 = admission control not
 # required, 1 = mandatory
 # note - Here cwMin and cmMax are in exponent form. The actual cw value used
 # will be (2^n)-1 where n is the value given here. The allowed range for these
 # wmm_ac_??_{cwmin,cwmax} is 0..15 with cwmax >= cwmin.
 #
 wmm_enabled=1
 
 # Low priority / AC_BK = background
 wmm_ac_bk_cwmin=4
 wmm_ac_bk_cwmax=10
 wmm_ac_bk_aifs=7
 wmm_ac_bk_txop_limit=0
 wmm_ac_bk_acm=0
 # Note: for IEEE 802.11b mode: cWmin=5 cWmax=10
 #
 # Normal priority / AC_BE = best effort
 wmm_ac_be_aifs=3
 wmm_ac_be_cwmin=4
 wmm_ac_be_cwmax=10
 wmm_ac_be_txop_limit=0
 wmm_ac_be_acm=0
 # Note: for IEEE 802.11b mode: cWmin=5 cWmax=7
 #
 # High priority / AC_VI = video
 wmm_ac_vi_aifs=2
 wmm_ac_vi_cwmin=3
 wmm_ac_vi_cwmax=4
 wmm_ac_vi_txop_limit=94
 wmm_ac_vi_acm=0
 # Note: for IEEE 802.11b mode: cWmin=4 cWmax=5 txop_limit=188
 #
 # Highest priority / AC_VO = voice
 wmm_ac_vo_aifs=2
 wmm_ac_vo_cwmin=2
 wmm_ac_vo_cwmax=3
 wmm_ac_vo_txop_limit=47
 wmm_ac_vo_acm=0
 
diff --git a/data/templates/wifi/wpa_supplicant.conf.j2 b/data/templates/wifi/wpa_supplicant.conf.j2
index 01e0d632f..ac857a04a 100644
--- a/data/templates/wifi/wpa_supplicant.conf.j2
+++ b/data/templates/wifi/wpa_supplicant.conf.j2
@@ -1,83 +1,83 @@
-### Autogenerated by interfaces-macsec.py ###
+### Autogenerated by interfaces_wireless.py ###
 
 # see full documentation:
 # https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf
 
 network={
     # ssid: SSID (mandatory); network name in one of the optional formats:
     #   - an ASCII string with double quotation
     #   - a hex string (two characters per octet of SSID)
     #   - a printf-escaped ASCII string P"<escaped string>"
     #
     ssid="{{ ssid }}"
 
     # scan_ssid:
     #   0 = do not scan this SSID with specific Probe Request frames (default)
     #   1 = scan with SSID-specific Probe Request frames (this can be used to
     #       find APs that do not accept broadcast SSID or use multiple SSIDs;
     #       this will add latency to scanning, so enable this only when needed)
     scan_ssid=1
 
 {% if security.wpa.passphrase is vyos_defined %}
     # ieee80211w: whether management frame protection is enabled
     # 0 = disabled (default unless changed with the global pmf parameter)
     # 1 = optional
     # 2 = required
     # The most common configuration options for this based on the PMF (protected
     # management frames) certification program are:
     # PMF enabled: ieee80211w=1 and key_mgmt=WPA-EAP WPA-EAP-SHA256
     # PMF required: ieee80211w=2 and key_mgmt=WPA-EAP-SHA256
     # (and similarly for WPA-PSK and WPA-PSK-SHA256 if WPA2-Personal is used)
     # WPA3-Personal-only mode: ieee80211w=2 and key_mgmt=SAE
     ieee80211w=1
 
     # key_mgmt: list of accepted authenticated key management protocols
     # WPA-PSK = WPA pre-shared key (this requires 'psk' field)
     # WPA-EAP = WPA using EAP authentication
     # IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
     #	generated WEP keys
     # NONE = WPA is not used; plaintext or static WEP could be used
     # WPA-NONE = WPA-None for IBSS (deprecated; use proto=RSN key_mgmt=WPA-PSK
     #	instead)
     # FT-PSK = Fast BSS Transition (IEEE 802.11r) with pre-shared key
     # FT-EAP = Fast BSS Transition (IEEE 802.11r) with EAP authentication
     # FT-EAP-SHA384 = Fast BSS Transition (IEEE 802.11r) with EAP authentication
     #	and using SHA384
     # WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms
     # WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms
     # SAE = Simultaneous authentication of equals; pre-shared key/password -based
     #	authentication with stronger security than WPA-PSK especially when using
     #	not that strong password; a.k.a. WPA3-Personal
     # FT-SAE = SAE with FT
     # WPA-EAP-SUITE-B = Suite B 128-bit level
     # WPA-EAP-SUITE-B-192 = Suite B 192-bit level
     # OSEN = Hotspot 2.0 Rel 2 online signup connection
     # FILS-SHA256 = Fast Initial Link Setup with SHA256
     # FILS-SHA384 = Fast Initial Link Setup with SHA384
     # FT-FILS-SHA256 = FT and Fast Initial Link Setup with SHA256
     # FT-FILS-SHA384 = FT and Fast Initial Link Setup with SHA384
     # OWE = Opportunistic Wireless Encryption (a.k.a. Enhanced Open)
     # DPP = Device Provisioning Protocol
     # If not set, this defaults to: WPA-PSK WPA-EAP
 {%     if security.wpa.mode is vyos_defined('wpa3') %}
     key_mgmt=SAE
 {%     else %}
     key_mgmt=WPA-PSK WPA-PSK-SHA256
 {%     endif %}
 
     # psk: WPA preshared key; 256-bit pre-shared key
     # The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
     # 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
     # generated using the passphrase and SSID). ASCII passphrase must be between
     # 8 and 63 characters (inclusive). ext:<name of external PSK field> format can
     # be used to indicate that the PSK/passphrase is stored in external storage.
     # This field is not needed, if WPA-EAP is used.
     # Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
     # from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
     # startup and reconfiguration time can be optimized by generating the PSK only
     # only when the passphrase or SSID has actually changed.
     psk="{{ security.wpa.passphrase }}"
 {% else %}
     key_mgmt=NONE
 {% endif %}
 }
diff --git a/interface-definitions/dns-domain-name.xml.in b/interface-definitions/dns-domain-name.xml.in
deleted file mode 100644
index b5b3692b1..000000000
--- a/interface-definitions/dns-domain-name.xml.in
+++ /dev/null
@@ -1,107 +0,0 @@
-<?xml version="1.0"?>
-<interfaceDefinition>
-  <node name="system">
-    <children>
-      <leafNode name="name-server" owner="${vyos_conf_scripts_dir}/host_name.py">
-        <properties>
-          <help>System Domain Name Servers (DNS)</help>
-          <priority>400</priority>
-          <completionHelp>
-            <script>${vyos_completion_dir}/list_interfaces</script>
-          </completionHelp>
-          <valueHelp>
-            <format>ipv4</format>
-            <description>Domain Name Server IPv4 address</description>
-          </valueHelp>
-          <valueHelp>
-            <format>ipv6</format>
-            <description>Domain Name Server IPv6 address</description>
-          </valueHelp>
-          <valueHelp>
-            <format>txt</format>
-            <description>Use Domain Name Server from DHCP interface</description>
-          </valueHelp>
-          <multi/>
-          <constraint>
-            <validator name="ip-address"/>
-            #include <include/constraint/interface-name.xml.i>
-          </constraint>
-        </properties>
-      </leafNode>
-      <!-- script does not use XML defaults so far -->
-      <leafNode name="host-name" owner="${vyos_conf_scripts_dir}/host_name.py">
-        <properties>
-          <help>System host name (default: vyos)</help>
-          <constraint>
-            #include <include/constraint/host-name.xml.i>
-          </constraint>
-        </properties>
-      </leafNode>
-      <leafNode name="domain-name" owner="${vyos_conf_scripts_dir}/host_name.py">
-        <properties>
-          <help>System domain name</help>
-          <constraint>
-            <validator name="fqdn"/>
-          </constraint>
-        </properties>
-      </leafNode>
-      <leafNode name="domain-search" owner="${vyos_conf_scripts_dir}/host_name.py">
-        <properties>
-          <help>Domain Name Server (DNS) domain completion order</help>
-          <priority>400</priority>
-          <constraint>
-            <validator name="fqdn"/>
-          </constraint>
-          <constraintErrorMessage>Invalid domain name (RFC 1123 section 2).\nMay only contain letters, numbers and period.</constraintErrorMessage>
-          <multi/>
-        </properties>
-      </leafNode>
-      <node name="static-host-mapping" owner="${vyos_conf_scripts_dir}/host_name.py">
-        <properties>
-          <help>Map host names to addresses</help>
-          <priority>400</priority>
-        </properties>
-        <children>
-          <tagNode name="host-name">
-            <properties>
-              <help>Host name for static address mapping</help>
-              <constraint>
-                #include <include/constraint/host-name.xml.i>
-              </constraint>
-              <constraintErrorMessage>Host-name must be alphanumeric and can contain hyphens</constraintErrorMessage>
-            </properties>
-            <children>
-              <leafNode name="alias">
-                <properties>
-                  <help>Alias for this address</help>
-                  <constraint>
-                    <regex>.{1,63}</regex>
-                  </constraint>
-                  <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 charactes</constraintErrorMessage>
-                  <multi />
-                </properties>
-              </leafNode>
-              <leafNode name="inet">
-                <properties>
-                  <help>IP Address</help>
-                  <valueHelp>
-                    <format>ipv4</format>
-                    <description>IPv4 address</description>
-                  </valueHelp>
-                  <valueHelp>
-                    <format>ipv6</format>
-                    <description>IPv6 address</description>
-                  </valueHelp>
-                  <constraint>
-                    <validator name="ip-address"/>
-                  </constraint>
-                  <multi/>
-                </properties>
-              </leafNode>
-            </children>
-          </tagNode>
-        </children>
-      </node>
-    </children>
-  </node>
-</interfaceDefinition>
diff --git a/interface-definitions/interfaces-bonding.xml.in b/interface-definitions/interfaces_bonding.xml.in
similarity index 99%
rename from interface-definitions/interfaces-bonding.xml.in
rename to interface-definitions/interfaces_bonding.xml.in
index 86c4776b6..62ee0bdc7 100644
--- a/interface-definitions/interfaces-bonding.xml.in
+++ b/interface-definitions/interfaces_bonding.xml.in
@@ -1,286 +1,286 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="bonding" owner="${vyos_conf_scripts_dir}/interfaces-bonding.py">
+      <tagNode name="bonding" owner="${vyos_conf_scripts_dir}/interfaces_bonding.py">
         <properties>
           <help>Bonding Interface/Link Aggregation</help>
           <priority>320</priority>
           <constraint>
             <regex>bond[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Bonding interface must be named bondN</constraintErrorMessage>
           <valueHelp>
             <format>bondN</format>
             <description>Bonding interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           <node name="arp-monitor">
             <properties>
               <help>ARP link monitoring parameters</help>
             </properties>
             <children>
               <leafNode name="interval">
                 <properties>
                   <help>ARP link monitoring interval</help>
                   <valueHelp>
                     <format>u32</format>
                     <description>Specifies the ARP link monitoring frequency in milliseconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-4294967295"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="target">
                 <properties>
                   <help>IP address used for ARP monitoring</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>Specify IPv4 address of ARP requests when interval is enabled</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/vrf.xml.i>
           #include <include/interface/mirror.xml.i>
           <node name="evpn">
             <properties>
               <help>EVPN Multihoming</help>
             </properties>
             <children>
               <leafNode name="es-df-pref">
                 <properties>
                   <help>Preference value used for designated forwarder (DF) election</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>DF Preference value</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="es-id">
                 <properties>
                   <help>Ethernet segment identifier</help>
                   <valueHelp>
                     <format>u32:1-16777215</format>
                     <description>Local discriminator</description>
                   </valueHelp>
                   <valueHelp>
                     <format>txt</format>
                     <description>10-byte ID - 00:11:22:33:44:55:AA:BB:CC:DD</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                     <regex>([0-9A-Fa-f][0-9A-Fa-f]:){9}[0-9A-Fa-f][0-9A-Fa-f]</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="es-sys-mac">
                 <properties>
                   <help>Ethernet segment system MAC</help>
                   <valueHelp>
                     <format>macaddr</format>
                     <description>MAC address</description>
                   </valueHelp>
                   <constraint>
                     <validator name="mac-address"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="uplink">
                 <properties>
                   <help>Uplink to the VXLAN core</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="hash-policy">
             <properties>
               <help>Bonding transmit hash policy</help>
               <completionHelp>
                 <list>layer2 layer2+3 layer3+4 encap2+3 encap3+4</list>
               </completionHelp>
               <valueHelp>
                 <format>layer2</format>
                 <description>use MAC addresses to generate the hash</description>
               </valueHelp>
               <valueHelp>
                 <format>layer2+3</format>
                 <description>combine MAC address and IP address to make hash</description>
               </valueHelp>
               <valueHelp>
                 <format>layer3+4</format>
                 <description>combine IP address and port to make hash</description>
               </valueHelp>
               <valueHelp>
                 <format>encap2+3</format>
                 <description>combine encapsulated MAC address and IP address to make hash</description>
               </valueHelp>
               <valueHelp>
                 <format>encap3+4</format>
                 <description>combine encapsulated IP address and port to make hash</description>
               </valueHelp>
               <constraint>
                 <regex>(layer2\+3|layer3\+4|layer2|encap2\+3|encap3\+4)</regex>
               </constraint>
               <constraintErrorMessage>hash-policy must be layer2 layer2+3 layer3+4 encap2+3 or encap3+4</constraintErrorMessage>
             </properties>
             <defaultValue>layer2</defaultValue>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mac.xml.i>
           <leafNode name="mii-mon-interval">
             <properties>
               <help>Specifies the MII link monitoring frequency in milliseconds</help>
               <valueHelp>
                 <format>u32:0</format>
                 <description>Disable MII link monitoring</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:50-1000</format>
                 <description>MII link monitoring frequency in milliseconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-0 --range 50-1000"/>
               </constraint>
             </properties>
             <defaultValue>100</defaultValue>
           </leafNode>
           <leafNode name="min-links">
             <properties>
               <help>Minimum number of member interfaces required up before enabling bond</help>
               <valueHelp>
                 <format>u32:0-16</format>
                 <description>Minimum number of member interfaces required up before enabling bond</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-16"/>
               </constraint>
             </properties>
             <defaultValue>0</defaultValue>
           </leafNode>
           <leafNode name="lacp-rate">
             <properties>
               <help>Rate in which we will ask our link partner to transmit LACPDU packets</help>
               <completionHelp>
                 <list>slow fast</list>
               </completionHelp>
               <valueHelp>
                 <format>slow</format>
                 <description>Request partner to transmit LACPDUs every 30 seconds</description>
               </valueHelp>
               <valueHelp>
                 <format>fast</format>
                 <description>Request partner to transmit LACPDUs every 1 second</description>
               </valueHelp>
               <constraint>
                 <regex>(slow|fast)</regex>
               </constraint>
             </properties>
             <defaultValue>slow</defaultValue>
           </leafNode>
           <leafNode name="mode">
             <properties>
               <help>Bonding mode</help>
               <completionHelp>
                 <list>802.3ad active-backup broadcast round-robin transmit-load-balance adaptive-load-balance xor-hash</list>
               </completionHelp>
               <valueHelp>
                 <format>802.3ad</format>
                 <description>IEEE 802.3ad Dynamic link aggregation</description>
               </valueHelp>
               <valueHelp>
                 <format>active-backup</format>
                 <description>Fault tolerant: only one slave in the bond is active</description>
               </valueHelp>
               <valueHelp>
                 <format>broadcast</format>
                 <description>Fault tolerant: transmits everything on all slave interfaces</description>
               </valueHelp>
               <valueHelp>
                 <format>round-robin</format>
                 <description>Load balance: transmit packets in sequential order</description>
               </valueHelp>
               <valueHelp>
                 <format>transmit-load-balance</format>
                 <description>Load balance: adapts based on transmit load and speed</description>
               </valueHelp>
               <valueHelp>
                 <format>adaptive-load-balance</format>
                 <description>Load balance: adapts based on transmit and receive plus ARP</description>
               </valueHelp>
               <valueHelp>
                 <format>xor-hash</format>
                 <description>Distribute based on MAC address</description>
               </valueHelp>
               <constraint>
                 <regex>(802.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex>
               </constraint>
               <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, transmit-load-balance, adaptive-load-balance, or xor</constraintErrorMessage>
             </properties>
             <defaultValue>802.3ad</defaultValue>
           </leafNode>
           <node name="member">
             <properties>
               <help>Bridge member interfaces</help>
             </properties>
             <children>
               <leafNode name="interface">
                 <properties>
                   <help>Member interface name</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces --bondable</script>
                   </completionHelp>
                   <valueHelp>
                     <format>txt</format>
                     <description>Interface name</description>
                   </valueHelp>
                   <constraint>
                     #include <include/constraint/interface-name.xml.i>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/interface/mtu-68-16000.xml.i>
           <leafNode name="primary">
             <properties>
               <help>Primary device interface</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces --bondable</script>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Interface name</description>
               </valueHelp>
               <constraint>
                 #include <include/constraint/interface-name.xml.i>
               </constraint>
             </properties>
           </leafNode>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vif-s.xml.i>
           #include <include/interface/vif.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-bridge.xml.in b/interface-definitions/interfaces_bridge.xml.in
similarity index 99%
rename from interface-definitions/interfaces-bridge.xml.in
rename to interface-definitions/interfaces_bridge.xml.in
index db3762065..d4d277cfc 100644
--- a/interface-definitions/interfaces-bridge.xml.in
+++ b/interface-definitions/interfaces_bridge.xml.in
@@ -1,226 +1,226 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/interfaces-bridge.py">
+      <tagNode name="bridge" owner="${vyos_conf_scripts_dir}/interfaces_bridge.py">
         <properties>
           <help>Bridge Interface</help>
           <priority>310</priority>
           <constraint>
             <regex>br[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Bridge interface must be named brN</constraintErrorMessage>
           <valueHelp>
             <format>brN</format>
             <description>Bridge interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           <leafNode name="aging">
             <properties>
               <help>MAC address aging interval</help>
               <valueHelp>
                 <format>u32:0</format>
                 <description>Disable MAC address learning (always flood)</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:10-1000000</format>
                 <description>MAC address aging time in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-0 --range 10-1000000"/>
               </constraint>
             </properties>
             <defaultValue>300</defaultValue>
           </leafNode>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/vrf.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           <leafNode name="forwarding-delay">
             <properties>
               <help>Forwarding delay</help>
               <valueHelp>
                 <format>u32:0-200</format>
                 <description>Spanning Tree Protocol forwarding delay in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-200"/>
               </constraint>
               <constraintErrorMessage>Forwarding delay must be between 0 and 200 seconds</constraintErrorMessage>
             </properties>
             <defaultValue>14</defaultValue>
           </leafNode>
           <leafNode name="hello-time">
             <properties>
               <help>Hello packet advertisement interval</help>
               <valueHelp>
                 <format>u32:1-10</format>
                 <description>Spanning Tree Protocol hello advertisement interval in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-10"/>
               </constraint>
               <constraintErrorMessage>Bridge Hello interval must be between 1 and 10 seconds</constraintErrorMessage>
             </properties>
             <defaultValue>2</defaultValue>
           </leafNode>
           <node name="igmp">
             <properties>
               <help>Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) settings</help>
             </properties>
             <children>
               <leafNode name="querier">
                 <properties>
                   <help>Enable IGMP/MLD querier</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="snooping">
                 <properties>
                   <help>Enable IGMP/MLD snooping</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mac.xml.i>
           #include <include/interface/mirror.xml.i>
           <leafNode name="enable-vlan">
             <properties>
               <help>Enable VLAN aware bridge</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="max-age">
             <properties>
               <help>Interval at which neighbor bridges are removed</help>
               <valueHelp>
                 <format>u32:1-40</format>
                 <description>Bridge maximum aging time in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-40"/>
               </constraint>
               <constraintErrorMessage>Bridge max aging value must be between 1 and 40 seconds</constraintErrorMessage>
             </properties>
             <defaultValue>20</defaultValue>
           </leafNode>
           <node name="member">
             <properties>
               <help>Bridge member interfaces</help>
             </properties>
             <children>
               <tagNode name="interface">
                 <properties>
                   <help>Member interface name</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces --bridgeable</script>
                   </completionHelp>
                   <constraint>
                     #include <include/constraint/interface-name.xml.i>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="native-vlan">
                     <properties>
                       <help>Specify VLAN id which should natively be present on the link</help>
                       <valueHelp>
                         <format>u32:1-4094</format>
                         <description>Virtual Local Area Network (VLAN) ID</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-4094"/>
                       </constraint>
                       <constraintErrorMessage>VLAN ID must be between 1 and 4094</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="allowed-vlan">
                     <properties>
                       <help>Specify VLAN id which is allowed in this trunk interface</help>
                       <valueHelp>
                         <format>&lt;id&gt;</format>
                         <description>VLAN id allowed to pass this interface</description>
                       </valueHelp>
                       <valueHelp>
                         <format>&lt;idN&gt;-&lt;idM&gt;</format>
                         <description>VLAN id range allowed on this interface (use '-' as delimiter)</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--allow-range --range 1-4094"/>
                       </constraint>
                       <constraintErrorMessage>not a valid VLAN ID value or range</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="cost">
                     <properties>
                       <help>Bridge port cost</help>
                       <valueHelp>
                         <format>u32:1-65535</format>
                         <description>Path cost value for Spanning Tree Protocol</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-65535"/>
                       </constraint>
                       <constraintErrorMessage>Path cost value must be between 1 and 65535</constraintErrorMessage>
                     </properties>
                     <defaultValue>100</defaultValue>
                   </leafNode>
                   <leafNode name="priority">
                     <properties>
                       <help>Bridge port priority</help>
                       <valueHelp>
                         <format>u32:0-63</format>
                         <description>Bridge port priority</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-63"/>
                       </constraint>
                       <constraintErrorMessage>Port priority value must be between 0 and 63</constraintErrorMessage>
                     </properties>
                     <defaultValue>32</defaultValue>
                   </leafNode>
                   <leafNode name="isolated">
                     <properties>
                       <help>Port is isolated (also known as Private-VLAN)</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </node>
           <leafNode name="priority">
             <properties>
               <help>Priority for this bridge</help>
               <valueHelp>
                 <format>u32:0-65535</format>
                 <description>Bridge priority</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-65535"/>
               </constraint>
               <constraintErrorMessage>Bridge priority must be between 0 and 65535 (multiples of 4096)</constraintErrorMessage>
             </properties>
             <defaultValue>32768</defaultValue>
           </leafNode>
           <leafNode name="stp">
             <properties>
               <help>Enable spanning tree protocol</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vif.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-dummy.xml.in b/interface-definitions/interfaces_dummy.xml.in
similarity index 99%
rename from interface-definitions/interfaces-dummy.xml.in
rename to interface-definitions/interfaces_dummy.xml.in
index 00784fcdf..ef8ee78e7 100644
--- a/interface-definitions/interfaces-dummy.xml.in
+++ b/interface-definitions/interfaces_dummy.xml.in
@@ -1,57 +1,57 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="dummy" owner="${vyos_conf_scripts_dir}/interfaces-dummy.py">
+      <tagNode name="dummy" owner="${vyos_conf_scripts_dir}/interfaces_dummy.py">
         <properties>
           <help>Dummy Interface</help>
           <priority>300</priority>
           <constraint>
             <regex>dum[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Dummy interface must be named dumN</constraintErrorMessage>
           <valueHelp>
             <format>dumN</format>
             <description>Dummy interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           <node name="ip">
             <properties>
               <help>IPv4 routing parameters</help>
             </properties>
             <children>
               #include <include/interface/source-validation.xml.i>
               #include <include/interface/disable-forwarding.xml.i>
             </children>
           </node>
           <node name="ipv6">
             <properties>
               <help>IPv6 routing parameters</help>
             </properties>
             <children>
               #include <include/interface/disable-forwarding.xml.i>
               <node name="address">
                 <properties>
                   <help>IPv6 address configuration modes</help>
                 </properties>
                 <children>
                   #include <include/interface/ipv6-address-eui64.xml.i>
                   #include <include/interface/ipv6-address-no-default-link-local.xml.i>
                 </children>
               </node>
             </children>
           </node>
           #include <include/interface/mtu-68-16000.xml.i>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/netns.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-ethernet.xml.in b/interface-definitions/interfaces_ethernet.xml.in
similarity index 99%
rename from interface-definitions/interfaces-ethernet.xml.in
rename to interface-definitions/interfaces_ethernet.xml.in
index 5aaa7095c..4e55bac7c 100644
--- a/interface-definitions/interfaces-ethernet.xml.in
+++ b/interface-definitions/interfaces_ethernet.xml.in
@@ -1,217 +1,217 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <properties>
       <help>Network interfaces</help>
     </properties>
     <children>
-      <tagNode name="ethernet" owner="${vyos_conf_scripts_dir}/interfaces-ethernet.py">
+      <tagNode name="ethernet" owner="${vyos_conf_scripts_dir}/interfaces_ethernet.py">
         <properties>
           <help>Ethernet Interface</help>
           <priority>318</priority>
           <valueHelp>
             <format>ethN</format>
             <description>Ethernet interface name</description>
           </valueHelp>
           <constraint>
             <regex>((eth|lan)[0-9]+|(eno|ens|enp|enx).+)</regex>
           </constraint>
           <constraintErrorMessage>Invalid Ethernet interface name</constraintErrorMessage>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           <leafNode name="disable-flow-control">
             <properties>
               <help>Disable Ethernet flow control (pause frames)</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/disable.xml.i>
           <leafNode name="duplex">
             <properties>
               <help>Duplex mode</help>
               <completionHelp>
                 <list>auto half full</list>
               </completionHelp>
               <valueHelp>
                 <format>auto</format>
                 <description>Auto negotiation</description>
               </valueHelp>
               <valueHelp>
                 <format>half</format>
                 <description>Half duplex</description>
               </valueHelp>
               <valueHelp>
                 <format>full</format>
                 <description>Full duplex</description>
               </valueHelp>
               <constraint>
                 <regex>(auto|half|full)</regex>
               </constraint>
               <constraintErrorMessage>duplex must be auto, half or full</constraintErrorMessage>
             </properties>
             <defaultValue>auto</defaultValue>
           </leafNode>
           #include <include/interface/eapol.xml.i>
           #include <include/interface/hw-id.xml.i>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mac.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           #include <include/interface/mirror.xml.i>
           <node name="offload">
             <properties>
               <help>Configurable offload options</help>
             </properties>
             <children>
               <leafNode name="gro">
                 <properties>
                   <help>Enable Generic Receive Offload</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="gso">
                 <properties>
                   <help>Enable Generic Segmentation Offload</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="hw-tc-offload">
                 <properties>
                   <help>Enable Hardware Flow Offload</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="lro">
                 <properties>
                   <help>Enable Large Receive Offload</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="rps">
                 <properties>
                   <help>Enable Receive Packet Steering</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="rfs">
                 <properties>
                   <help>Enable Receive Flow Steering</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="sg">
                 <properties>
                   <help>Enable Scatter-Gather</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="tso">
                 <properties>
                   <help>Enable TCP Segmentation Offloading</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="speed">
             <properties>
               <help>Link speed</help>
               <completionHelp>
                 <list>auto 10 100 1000 2500 5000 10000 25000 40000 50000 100000</list>
               </completionHelp>
               <valueHelp>
                 <format>auto</format>
                 <description>Auto negotiation</description>
               </valueHelp>
               <valueHelp>
                 <format>10</format>
                 <description>10 Mbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>100</format>
                 <description>100 Mbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>1000</format>
                 <description>1 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>2500</format>
                 <description>2.5 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>5000</format>
                 <description>5 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>10000</format>
                 <description>10 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>25000</format>
                 <description>25 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>40000</format>
                 <description>40 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>50000</format>
                 <description>50 Gbit/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>100000</format>
                 <description>100 Gbit/sec</description>
               </valueHelp>
               <constraint>
                 <regex>(auto|10|100|1000|2500|5000|10000|25000|40000|50000|100000)</regex>
               </constraint>
               <constraintErrorMessage>Speed must be auto, 10, 100, 1000, 2500, 5000, 10000, 25000, 40000, 50000 or 100000</constraintErrorMessage>
             </properties>
             <defaultValue>auto</defaultValue>
           </leafNode>
           <node name="ring-buffer">
             <properties>
               <help>Shared buffer between the device driver and NIC</help>
             </properties>
             <children>
               <leafNode name="rx">
                 <properties>
                   <help>RX ring buffer</help>
                   <valueHelp>
                     <format>u32:80-16384</format>
                     <description>ring buffer size</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 80-16384"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="tx">
                 <properties>
                   <help>TX ring buffer</help>
                   <valueHelp>
                     <format>u32:80-16384</format>
                     <description>ring buffer size</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 80-16384"/>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vif-s.xml.i>
           #include <include/interface/vif.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-geneve.xml.in b/interface-definitions/interfaces_geneve.xml.in
similarity index 99%
rename from interface-definitions/interfaces-geneve.xml.in
rename to interface-definitions/interfaces_geneve.xml.in
index 29b563a09..c94113271 100644
--- a/interface-definitions/interfaces-geneve.xml.in
+++ b/interface-definitions/interfaces_geneve.xml.in
@@ -1,60 +1,60 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="geneve" owner="${vyos_conf_scripts_dir}/interfaces-geneve.py">
+      <tagNode name="geneve" owner="${vyos_conf_scripts_dir}/interfaces_geneve.py">
         <properties>
           <help>Generic Network Virtualization Encapsulation (GENEVE) Interface</help>
           <priority>460</priority>
           <constraint>
             <regex>gnv[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>GENEVE interface must be named gnvN</constraintErrorMessage>
           <valueHelp>
             <format>gnvN</format>
             <description>GENEVE interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mac.xml.i>
           #include <include/interface/mtu-1200-16000.xml.i>
           <node name="parameters">
             <properties>
               <help>GENEVE tunnel parameters</help>
             </properties>
             <children>
               <node name="ip">
                 <properties>
                   <help>IPv4 specific tunnel parameters</help>
                 </properties>
                 <children>
                   #include <include/interface/parameters-df.xml.i>
                   #include <include/interface/parameters-tos.xml.i>
                   #include <include/interface/parameters-ttl.xml.i>
                   #include <include/interface/parameters-innerproto.xml.i>
                 </children>
               </node>
               <node name="ipv6">
                 <properties>
                   <help>IPv6 specific tunnel parameters</help>
                 </properties>
                 <children>
                   #include <include/interface/parameters-flowlabel.xml.i>
                 </children>
               </node>
             </children>
           </node>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/tunnel-remote.xml.i>
           #include <include/vni.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-input.xml.in b/interface-definitions/interfaces_input.xml.in
similarity index 98%
rename from interface-definitions/interfaces-input.xml.in
rename to interface-definitions/interfaces_input.xml.in
index d90cf936f..771c47e42 100644
--- a/interface-definitions/interfaces-input.xml.in
+++ b/interface-definitions/interfaces_input.xml.in
@@ -1,27 +1,27 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="input" owner="${vyos_conf_scripts_dir}/interfaces-input.py">
+      <tagNode name="input" owner="${vyos_conf_scripts_dir}/interfaces_input.py">
         <properties>
           <help>Input Functional Block (IFB) interface name</help>
           <!-- before real devices that redirect -->
           <priority>310</priority>
           <constraint>
             <regex>ifb[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Input interface must be named ifbN</constraintErrorMessage>
           <valueHelp>
             <format>ifbN</format>
             <description>Input interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/redirect.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-l2tpv3.xml.in b/interface-definitions/interfaces_l2tpv3.xml.in
similarity index 99%
rename from interface-definitions/interfaces-l2tpv3.xml.in
rename to interface-definitions/interfaces_l2tpv3.xml.in
index 1f0dd3d19..5f816c956 100644
--- a/interface-definitions/interfaces-l2tpv3.xml.in
+++ b/interface-definitions/interfaces_l2tpv3.xml.in
@@ -1,131 +1,131 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="l2tpv3" owner="${vyos_conf_scripts_dir}/interfaces-l2tpv3.py">
+      <tagNode name="l2tpv3" owner="${vyos_conf_scripts_dir}/interfaces_l2tpv3.py">
         <properties>
           <help>Layer 2 Tunnel Protocol Version 3 (L2TPv3) Interface</help>
           <priority>485</priority>
           <constraint>
             <regex>l2tpeth[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>L2TPv3 interface must be named l2tpethN</constraintErrorMessage>
           <valueHelp>
             <format>l2tpethN</format>
             <description>L2TPv3 interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           <leafNode name="destination-port">
             <properties>
               <help>UDP destination port for L2TPv3 tunnel</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Numeric IP port</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
             <defaultValue>5000</defaultValue>
           </leafNode>
           #include <include/interface/disable.xml.i>
           <leafNode name="encapsulation">
             <properties>
               <help>Encapsulation type</help>
               <completionHelp>
                 <list>udp ip</list>
               </completionHelp>
               <valueHelp>
                 <format>udp</format>
                 <description>UDP encapsulation</description>
               </valueHelp>
               <valueHelp>
                 <format>ip</format>
                 <description>IP encapsulation</description>
               </valueHelp>
               <constraint>
                 <regex>(udp|ip)</regex>
               </constraint>
               <constraintErrorMessage>Encapsulation must be UDP or IP</constraintErrorMessage>
             </properties>
             <defaultValue>udp</defaultValue>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/source-address-ipv4-ipv6.xml.i>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           <leafNode name="mtu">
             <defaultValue>1488</defaultValue>
           </leafNode>
           <leafNode name="peer-session-id">
             <properties>
               <help>Peer session identifier</help>
               <valueHelp>
                 <format>u32:1-429496729</format>
                 <description>L2TPv3 peer session identifier</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-429496729"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="peer-tunnel-id">
             <properties>
               <help>Peer tunnel identifier</help>
               <valueHelp>
                 <format>u32:1-429496729</format>
                 <description>L2TPv3 peer tunnel identifier</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-429496729"/>
               </constraint>
             </properties>
           </leafNode>
           #include <include/interface/tunnel-remote.xml.i>
           <leafNode name="session-id">
             <properties>
               <help>Session identifier</help>
               <valueHelp>
                 <format>u32:1-429496729</format>
                 <description>L2TPv3 session identifier</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-429496729"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="source-port">
             <properties>
               <help>UDP source port for L2TPv3 tunnel</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Numeric IP port</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
             <defaultValue>5000</defaultValue>
           </leafNode>
           <leafNode name="tunnel-id">
             <properties>
               <help>Local tunnel identifier</help>
               <valueHelp>
                 <format>u32:1-429496729</format>
                 <description>L2TPv3 local tunnel identifier</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-429496729"/>
               </constraint>
             </properties>
           </leafNode>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-loopback.xml.in b/interface-definitions/interfaces_loopback.xml.in
similarity index 97%
rename from interface-definitions/interfaces-loopback.xml.in
rename to interface-definitions/interfaces_loopback.xml.in
index fe0944467..09b4a00cf 100644
--- a/interface-definitions/interfaces-loopback.xml.in
+++ b/interface-definitions/interfaces_loopback.xml.in
@@ -1,35 +1,35 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="loopback" owner="${vyos_conf_scripts_dir}/interfaces-loopback.py">
+      <tagNode name="loopback" owner="${vyos_conf_scripts_dir}/interfaces_loopback.py">
         <properties>
           <help>Loopback Interface</help>
           <priority>300</priority>
           <constraint>
             <regex>lo</regex>
           </constraint>
           <constraintErrorMessage>Loopback interface must be named lo</constraintErrorMessage>
           <valueHelp>
             <format>lo</format>
             <description>Loopback interface</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           <node name="ip">
             <properties>
               <help>IPv4 routing parameters</help>
             </properties>
             <children>
               #include <include/interface/source-validation.xml.i>
             </children>
           </node>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/redirect.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces_macsec.xml.in
similarity index 99%
rename from interface-definitions/interfaces-macsec.xml.in
rename to interface-definitions/interfaces_macsec.xml.in
index 766b0bede..d825f8262 100644
--- a/interface-definitions/interfaces-macsec.xml.in
+++ b/interface-definitions/interfaces_macsec.xml.in
@@ -1,153 +1,153 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="macsec" owner="${vyos_conf_scripts_dir}/interfaces-macsec.py">
+      <tagNode name="macsec" owner="${vyos_conf_scripts_dir}/interfaces_macsec.py">
         <properties>
           <help>MACsec Interface (802.1ae)</help>
           <priority>461</priority>
           <constraint>
             <regex>macsec[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>MACsec interface must be named macsecN</constraintErrorMessage>
           <valueHelp>
             <format>macsecN</format>
             <description>MACsec interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mirror.xml.i>
           <node name="security">
             <properties>
               <help>Security/Encryption Settings</help>
             </properties>
             <children>
               <leafNode name="cipher">
                 <properties>
                   <help>Cipher suite used</help>
                   <completionHelp>
                     <list>gcm-aes-128 gcm-aes-256</list>
                   </completionHelp>
                   <valueHelp>
                     <format>gcm-aes-128</format>
                     <description>Galois/Counter Mode of AES cipher with 128-bit key</description>
                   </valueHelp>
                   <valueHelp>
                     <format>gcm-aes-256</format>
                     <description>Galois/Counter Mode of AES cipher with 256-bit key</description>
                   </valueHelp>
                   <constraint>
                     <regex>(gcm-aes-128|gcm-aes-256)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="encrypt">
                 <properties>
                   <help>Enable optional MACsec encryption</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <node name="static">
                 <properties>
                   <help>Use static keys for MACsec [static Secure Authentication Key (SAK) mode]</help>
                 </properties>
                 <children>
                   #include <include/interface/macsec-key.xml.i>
                   <tagNode name="peer">
                     <properties>
                       <help>MACsec peer name</help>
                       <constraint>
                         <regex>[^ ]{1,100}</regex>
                       </constraint>
                       <constraintErrorMessage>MACsec peer name exceeds limit of 100 characters</constraintErrorMessage>
                     </properties>
                     <children>
                       #include <include/generic-disable-node.xml.i>
                       #include <include/interface/mac.xml.i>
                       #include <include/interface/macsec-key.xml.i>
                     </children>
                   </tagNode>
                 </children>
               </node>
               <node name="mka">
                 <properties>
                   <help>MACsec Key Agreement protocol (MKA)</help>
                 </properties>
                 <children>
                   <leafNode name="cak">
                     <properties>
                       <help>Secure Connectivity Association Key</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>16-byte (128-bit) hex-string (32 hex-digits) for gcm-aes-128 or 32-byte (256-bit) hex-string (64 hex-digits) for gcm-aes-256</description>
                       </valueHelp>
                       <constraint>
                         <regex>[A-Fa-f0-9]{32}</regex>
                         <regex>[A-Fa-f0-9]{64}</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="ckn">
                     <properties>
                       <help>Secure Connectivity Association Key Name</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>1..32-bytes (8..256 bit) hex-string (2..64 hex-digits)</description>
                       </valueHelp>
                       <constraint>
                         <regex>[A-Fa-f0-9]{2,64}</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="priority">
                     <properties>
                       <help>Priority of MACsec Key Agreement protocol (MKA) actor</help>
                       <valueHelp>
                         <format>u32:0-255</format>
                         <description>MACsec Key Agreement protocol (MKA) priority</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-255" />
                       </constraint>
                     </properties>
                     <defaultValue>255</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="replay-window">
                 <properties>
                   <help>IEEE 802.1X/MACsec replay protection window</help>
                   <valueHelp>
                     <format>u32:0</format>
                     <description>No replay window, strict check</description>
                   </valueHelp>
                   <valueHelp>
                     <format>u32:1-4294967295</format>
                     <description>Number of packets that could be misordered</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-4294967295" />
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           <leafNode name="mtu">
             <defaultValue>1460</defaultValue>
           </leafNode>
           #include <include/source-interface-ethernet.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-openvpn.xml.in b/interface-definitions/interfaces_openvpn.xml.in
similarity index 99%
rename from interface-definitions/interfaces-openvpn.xml.in
rename to interface-definitions/interfaces_openvpn.xml.in
index b8b04334c..addf3c1ab 100644
--- a/interface-definitions/interfaces-openvpn.xml.in
+++ b/interface-definitions/interfaces_openvpn.xml.in
@@ -1,809 +1,809 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="openvpn" owner="${vyos_conf_scripts_dir}/interfaces-openvpn.py">
+      <tagNode name="openvpn" owner="${vyos_conf_scripts_dir}/interfaces_openvpn.py">
         <properties>
           <help>OpenVPN Tunnel Interface</help>
           <priority>460</priority>
           <constraint>
             <regex>vtun[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>OpenVPN tunnel interface must be named vtunN</constraintErrorMessage>
           <valueHelp>
             <format>vtunN</format>
             <description>OpenVPN interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/authentication.xml.i>
           #include <include/generic-description.xml.i>
           <leafNode name="device-type">
             <properties>
               <help>OpenVPN interface device-type</help>
               <completionHelp>
                 <list>tun tap</list>
               </completionHelp>
               <valueHelp>
                 <format>tun</format>
                 <description>TUN device, required for OSI layer 3</description>
               </valueHelp>
               <valueHelp>
                 <format>tap</format>
                 <description>TAP device, required for OSI layer 2</description>
               </valueHelp>
               <constraint>
                 <regex>(tun|tap)</regex>
               </constraint>
             </properties>
             <defaultValue>tun</defaultValue>
           </leafNode>
           #include <include/interface/disable.xml.i>
           <node name="encryption">
             <properties>
               <help>Data Encryption settings</help>
             </properties>
             <children>
               <leafNode name="cipher">
                 <properties>
                   <help>Standard Data Encryption Algorithm</help>
                   <completionHelp>
                     <list>none 3des aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list>
                   </completionHelp>
                   <valueHelp>
                     <format>none</format>
                     <description>Disable encryption</description>
                   </valueHelp>
                   <valueHelp>
                     <format>3des</format>
                     <description>DES algorithm with triple encryption</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes128</format>
                     <description>AES algorithm with 128-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes128gcm</format>
                     <description>AES algorithm with 128-bit key GCM</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes192</format>
                     <description>AES algorithm with 192-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes192gcm</format>
                     <description>AES algorithm with 192-bit key GCM</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes256</format>
                     <description>AES algorithm with 256-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes256gcm</format>
                     <description>AES algorithm with 256-bit key GCM</description>
                   </valueHelp>
                   <constraint>
                     <regex>(none|3des|aes128|aes128gcm|aes192|aes192gcm|aes256|aes256gcm)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="ncp-ciphers">
                 <properties>
                   <help>Cipher negotiation list for use in server or client mode</help>
                   <completionHelp>
                     <list>none 3des aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list>
                   </completionHelp>
                   <valueHelp>
                     <format>none</format>
                     <description>Disable encryption</description>
                   </valueHelp>
                   <valueHelp>
                     <format>3des</format>
                     <description>DES algorithm with triple encryption</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes128</format>
                     <description>AES algorithm with 128-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes128gcm</format>
                     <description>AES algorithm with 128-bit key GCM</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes192</format>
                     <description>AES algorithm with 192-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes192gcm</format>
                     <description>AES algorithm with 192-bit key GCM</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes256</format>
                     <description>AES algorithm with 256-bit key CBC</description>
                   </valueHelp>
                   <valueHelp>
                     <format>aes256gcm</format>
                     <description>AES algorithm with 256-bit key GCM</description>
                   </valueHelp>
                   <constraint>
                     <regex>(none|3des|aes128|aes128gcm|aes192|aes192gcm|aes256|aes256gcm)</regex>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mirror.xml.i>
           <leafNode name="hash">
             <properties>
               <help>Hashing Algorithm</help>
               <completionHelp>
                 <list>md5 sha1 sha256 sha384 sha512</list>
               </completionHelp>
               <valueHelp>
                 <format>md5</format>
                 <description>MD5 algorithm</description>
               </valueHelp>
               <valueHelp>
                 <format>sha1</format>
                 <description>SHA-1 algorithm</description>
               </valueHelp>
               <valueHelp>
                 <format>sha256</format>
                 <description>SHA-256 algorithm</description>
               </valueHelp>
               <valueHelp>
                 <format>sha384</format>
                 <description>SHA-384 algorithm</description>
               </valueHelp>
               <valueHelp>
                 <format>sha512</format>
                 <description>SHA-512 algorithm</description>
               </valueHelp>
               <constraint>
                 <regex>(md5|sha1|sha256|sha384|sha512)</regex>
               </constraint>
             </properties>
           </leafNode>
           <node name="keep-alive">
             <properties>
               <help>Keepalive helper options</help>
             </properties>
             <children>
               <leafNode name="failure-count">
                 <properties>
                   <help>Maximum number of keepalive packet failures</help>
                   <valueHelp>
                     <format>u32:0-1000</format>
                     <description>Maximum number of keepalive packet failures</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-1000"/>
                   </constraint>
                 </properties>
                 <defaultValue>60</defaultValue>
               </leafNode>
               <leafNode name="interval">
                 <properties>
                   <help>Keepalive packet interval in seconds</help>
                   <valueHelp>
                     <format>u32:0-600</format>
                     <description>Keepalive packet interval (seconds)</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-600"/>
                   </constraint>
                 </properties>
                 <defaultValue>10</defaultValue>
               </leafNode>
             </children>
           </node>
           <tagNode name="local-address">
             <properties>
               <help>Local IP address of tunnel (IPv4 or IPv6)</help>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
             </properties>
             <children>
               <leafNode name="subnet-mask">
                 <properties>
                   <help>Subnet-mask for local IP address of tunnel (IPv4 only)</help>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="local-host">
             <properties>
               <help>Local IP address to accept connections (all if not set)</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Local IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>Local IPv6 address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="local-port">
             <properties>
               <help>Local port number to accept connections</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Numeric IP port</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="mode">
             <properties>
               <help>OpenVPN mode of operation</help>
               <completionHelp>
                 <list>site-to-site client server</list>
               </completionHelp>
               <valueHelp>
                 <format>site-to-site</format>
                 <description>Site-to-site mode</description>
               </valueHelp>
               <valueHelp>
                 <format>client</format>
                 <description>Client in client-server mode</description>
               </valueHelp>
               <valueHelp>
                 <format>server</format>
                 <description>Server in client-server mode</description>
               </valueHelp>
               <constraint>
                 <regex>(site-to-site|client|server)</regex>
               </constraint>
             </properties>
           </leafNode>
           <node name="offload">
             <properties>
               <help>Configurable offload options</help>
             </properties>
             <children>
               <leafNode name="dco">
                 <properties>
                   <help>Enable data channel offload on this interface</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="openvpn-option">
             <properties>
               <help>Additional OpenVPN options. You must use the syntax of openvpn.conf in this text-field. Using this without proper knowledge may result in a crashed OpenVPN server. Check system log to look for errors.</help>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="persistent-tunnel">
             <properties>
               <help>Do not close and reopen interface (TUN/TAP device) on client restarts</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="protocol">
             <properties>
               <help>OpenVPN communication protocol</help>
               <completionHelp>
                 <list>udp tcp-passive tcp-active</list>
               </completionHelp>
               <valueHelp>
                 <format>udp</format>
                 <description>UDP</description>
               </valueHelp>
               <valueHelp>
                 <format>tcp-passive</format>
                 <description>TCP and accepts connections passively</description>
               </valueHelp>
               <valueHelp>
                 <format>tcp-active</format>
                 <description>TCP and initiates connections actively</description>
               </valueHelp>
               <constraint>
                 <regex>(udp|tcp-passive|tcp-active)</regex>
               </constraint>
             </properties>
             <defaultValue>udp</defaultValue>
           </leafNode>
           <leafNode name="remote-address">
             <properties>
               <help>IP address of remote end of tunnel</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Remote end IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>Remote end IPv6 address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="remote-host">
             <properties>
               <help>Remote host to connect to (dynamic if not set)</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 address of remote host</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address of remote host</description>
               </valueHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Hostname of remote host</description>
               </valueHelp>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="remote-port">
             <properties>
               <help>Remote port number to connect to</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Numeric IP port</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
           </leafNode>
           <node name="replace-default-route">
             <properties>
               <help>OpenVPN tunnel to be used as the default route</help>
             </properties>
             <children>
               <leafNode name="local">
                 <properties>
                   <help>Tunnel endpoints are on the same subnet</help>
                 </properties>
               </leafNode>
             </children>
           </node>
           <node name="server">
             <properties>
               <help>Server-mode options</help>
             </properties>
             <children>
               <tagNode name="client">
                 <properties>
                   <help>Client-specific settings</help>
                   <valueHelp>
                     <format>name</format>
                     <description>Client common-name in the certificate</description>
                   </valueHelp>
                 </properties>
                 <children>
                   #include <include/generic-disable-node.xml.i>
                   <leafNode name="ip">
                     <properties>
                       <help>IP address of the client</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>Client IPv4 address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>Client IPv6 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ip-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="push-route">
                     <properties>
                       <help>Route to be pushed to the client</help>
                       <valueHelp>
                         <format>ipv4net</format>
                         <description>IPv4 network and prefix length</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ipv6net</format>
                         <description>IPv6 network and prefix length</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ip-prefix"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="subnet">
                     <properties>
                       <help>Subnet belonging to the client (iroute)</help>
                       <valueHelp>
                         <format>ipv4net</format>
                         <description>IPv4 network and prefix length belonging to the client</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ipv6net</format>
                         <description>IPv6 network and prefix length belonging to the client</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ip-prefix"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <node name="client-ip-pool">
                 <properties>
                   <help>Pool of client IPv4 addresses</help>
                 </properties>
                 <children>
                   #include <include/generic-disable-node.xml.i>
                   <leafNode name="start">
                     <properties>
                       <help>First IP address in the pool</help>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 address</description>
                       </valueHelp>
                     </properties>
                   </leafNode>
                   <leafNode name="stop">
                     <properties>
                       <help>Last IP address in the pool</help>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 address</description>
                       </valueHelp>
                     </properties>
                   </leafNode>
                   <leafNode name="subnet-mask">
                     <properties>
                       <help>Subnet mask pushed to dynamic clients. If not set the server subnet mask will be used. Only used with topology subnet or device type tap. Not used with bridged interfaces.</help>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 subnet mask</description>
                       </valueHelp>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               <node name="client-ipv6-pool">
                 <properties>
                   <help>Pool of client IPv6 addresses</help>
                 </properties>
                 <children>
                   <leafNode name="base">
                     <properties>
                       <help>Client IPv6 pool base address with optional prefix length</help>
                       <valueHelp>
                         <format>ipv6net</format>
                         <description>Client IPv6 pool base address with optional prefix length (defaults: base = server subnet + 0x1000, prefix length = server prefix length)</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv6"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/generic-disable-node.xml.i>
                 </children>
               </node>
               <leafNode name="domain-name">
                 <properties>
                   <help>DNS suffix to be pushed to all clients</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Domain Name Server suffix</description>
                   </valueHelp>
                 </properties>
               </leafNode>
               <leafNode name="max-connections">
                 <properties>
                   <help>Number of maximum client connections</help>
                   <valueHelp>
                     <format>u32:1-4096</format>
                     <description>Number of concurrent clients</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-4096"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/name-server-ipv4-ipv6.xml.i>
               <tagNode name="push-route">
                 <properties>
                   <help>Route to be pushed to all clients</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 network and prefix length</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 network and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-prefix"/>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="metric">
                     <properties>
                       <help>Set metric for this route</help>
                       <valueHelp>
                         <format>u32:0-4294967295</format>
                         <description>Metric for this route</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
                       </constraint>
                     </properties>
                     <defaultValue>0</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               <leafNode name="reject-unconfigured-clients">
                 <properties>
                   <help>Reject connections from clients that are not explicitly configured</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="subnet">
                 <properties>
                   <help>Server-mode subnet (from which client IPs are allocated)</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 network and prefix length</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 network and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="topology">
                 <properties>
                   <help>Topology for clients</help>
                   <completionHelp>
                     <list>net30 point-to-point subnet</list>
                   </completionHelp>
                   <valueHelp>
                     <format>net30</format>
                     <description>net30 topology</description>
                   </valueHelp>
                   <valueHelp>
                     <format>point-to-point</format>
                     <description>Point-to-point topology</description>
                   </valueHelp>
                   <valueHelp>
                     <format>subnet</format>
                     <description>Subnet topology</description>
                   </valueHelp>
                   <constraint>
                     <regex>(subnet|point-to-point|net30)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>net30</defaultValue>
               </leafNode>
               <node name="mfa">
                 <properties>
                   <help>multi-factor authentication</help>
                 </properties>
                 <children>
                   <node name="totp">
                     <properties>
                       <help>Time-based one-time passwords</help>
                     </properties>
                     <children>
                       <leafNode name="slop">
                         <properties>
                           <help>Maximum allowed clock slop in seconds</help>
                           <valueHelp>
                             <format>1-65535</format>
                             <description>Seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-65535"/>
                           </constraint>
                         </properties>
                         <defaultValue>180</defaultValue>
                       </leafNode>
                       <leafNode name="drift">
                         <properties>
                           <help>Time drift in seconds</help>
                           <valueHelp>
                             <format>1-65535</format>
                             <description>Seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-65535"/>
                           </constraint>
                         </properties>
                         <defaultValue>0</defaultValue>
                       </leafNode>
                       <leafNode name="step">
                         <properties>
                           <help>Step value for totp in seconds</help>
                           <valueHelp>
                             <format>1-65535</format>
                             <description>Seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-65535"/>
                           </constraint>
                         </properties>
                         <defaultValue>30</defaultValue>
                       </leafNode>
                       <leafNode name="digits">
                         <properties>
                           <help>Number of digits to use for totp hash</help>
                           <valueHelp>
                             <format>1-65535</format>
                             <description>Seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-65535"/>
                           </constraint>
                         </properties>
                         <defaultValue>6</defaultValue>
                       </leafNode>
                       <leafNode name="challenge">
                         <properties>
                           <help>Expect password as result of a challenge response protocol</help>
                           <completionHelp>
                             <list>disable enable</list>
                           </completionHelp>
                           <valueHelp>
                             <format>disable</format>
                             <description>Disable challenge-response</description>
                           </valueHelp>
                           <valueHelp>
                             <format>enable</format>
                             <description>Enable chalenge-response</description>
                           </valueHelp>
                           <constraint>
                             <regex>(disable|enable)</regex>
                           </constraint>
                         </properties>
                         <defaultValue>enable</defaultValue>
                       </leafNode>
                    </children>
                   </node>
                </children>
               </node>
             </children>
           </node>
           <leafNode name="shared-secret-key">
             <properties>
               <help>Secret key shared with remote end of tunnel</help>
               <completionHelp>
                 <path>pki openvpn shared-secret</path>
               </completionHelp>
             </properties>
           </leafNode>
           <node name="tls">
             <properties>
               <help>Transport Layer Security (TLS) options</help>
             </properties>
             <children>
               <leafNode name="auth-key">
                 <properties>
                   <help>TLS shared secret key for tls-auth</help>
                   <completionHelp>
                     <path>pki openvpn shared-secret</path>
                   </completionHelp>
                 </properties>
               </leafNode>
               #include <include/pki/certificate.xml.i>
               #include <include/pki/ca-certificate-multi.xml.i>
               <leafNode name="dh-params">
                 <properties>
                   <help>Diffie Hellman parameters (server only)</help>
                   <completionHelp>
                     <path>pki dh</path>
                   </completionHelp>
                 </properties>
               </leafNode>
               <leafNode name="crypt-key">
                 <properties>
                   <help>Static key to use to authenticate control channel</help>
                   <completionHelp>
                     <path>pki openvpn shared-secret</path>
                   </completionHelp>
                 </properties>
               </leafNode>
               <leafNode name="peer-fingerprint">
                 <properties>
                   <multi/>
                   <help>Peer certificate SHA256 fingerprint</help>
                   <constraint>
                     <regex>[0-9a-fA-F]{2}:([0-9a-fA-F]{2}:){30}[0-9a-fA-F]{2}</regex>
                   </constraint>
                   <constraintErrorMessage>Peer certificate fingerprint must be a colon-separated SHA256 hex digest</constraintErrorMessage>
                 </properties>
               </leafNode>
               <leafNode name="tls-version-min">
                 <properties>
                   <help>Specify the minimum required TLS version</help>
                   <completionHelp>
                     <list>1.0 1.1 1.2 1.3</list>
                   </completionHelp>
                   <valueHelp>
                     <format>1.0</format>
                     <description>TLS v1.0</description>
                   </valueHelp>
                   <valueHelp>
                     <format>1.1</format>
                     <description>TLS v1.1</description>
                   </valueHelp>
                   <valueHelp>
                     <format>1.2</format>
                     <description>TLS v1.2</description>
                   </valueHelp>
                   <valueHelp>
                     <format>1.3</format>
                     <description>TLS v1.3</description>
                   </valueHelp>
                   <constraint>
                     <regex>(1.0|1.1|1.2|1.3)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="role">
                 <properties>
                   <help>TLS negotiation role</help>
                   <completionHelp>
                     <list>active passive</list>
                   </completionHelp>
                   <valueHelp>
                     <format>active</format>
                     <description>Initiate TLS negotiation actively</description>
                   </valueHelp>
                   <valueHelp>
                     <format>passive</format>
                     <description>Wait for incoming TLS connection</description>
                   </valueHelp>
                   <constraint>
                     <regex>(active|passive)</regex>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="use-lzo-compression">
             <properties>
               <help>Use fast LZO compression on this TUN/TAP interface</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-pppoe.xml.in b/interface-definitions/interfaces_pppoe.xml.in
similarity index 99%
rename from interface-definitions/interfaces-pppoe.xml.in
rename to interface-definitions/interfaces_pppoe.xml.in
index 4542b8b01..56660bc15 100644
--- a/interface-definitions/interfaces-pppoe.xml.in
+++ b/interface-definitions/interfaces_pppoe.xml.in
@@ -1,153 +1,153 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="pppoe" owner="${vyos_conf_scripts_dir}/interfaces-pppoe.py">
+      <tagNode name="pppoe" owner="${vyos_conf_scripts_dir}/interfaces_pppoe.py">
         <properties>
           <help>Point-to-Point Protocol over Ethernet (PPPoE) Interface</help>
           <priority>322</priority>
           <constraint>
             <regex>pppoe[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>PPPoE interface must be named pppoeN</constraintErrorMessage>
           <valueHelp>
             <format>pppoeN</format>
             <description>PPPoE dialer interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/pppoe-access-concentrator.xml.i>
           #include <include/interface/authentication.xml.i>
           #include <include/interface/dial-on-demand.xml.i>
           #include <include/interface/no-default-route.xml.i>
           #include <include/interface/default-route-distance.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           <leafNode name="idle-timeout">
             <properties>
               <help>Delay before disconnecting idle session (in seconds)</help>
               <valueHelp>
                 <format>u32:0-86400</format>
                 <description>Idle timeout in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-86400"/>
               </constraint>
               <constraintErrorMessage>Timeout must be in range 0 to 86400</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="host-uniq">
             <properties>
               <help>PPPoE RFC2516 host-uniq tag</help>
               <valueHelp>
                 <format>txt</format>
                 <description>Host-uniq tag as byte string in HEX</description>
               </valueHelp>
               <constraint>
                 <regex>([a-fA-F0-9][a-fA-F0-9]){1,18}</regex>
               </constraint>
               <constraintErrorMessage>Host-uniq must be specified as hex-adecimal byte-string (even number of HEX characters)</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="holdoff">
             <properties>
               <help>Delay before re-dial to the access concentrator when PPP session terminated by peer (in seconds)</help>
               <valueHelp>
                 <format>u32:0-86400</format>
                 <description>Holdoff time in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-86400"/>
               </constraint>
               <constraintErrorMessage>Holdoff must be in range 0 to 86400</constraintErrorMessage>
             </properties>
             <defaultValue>30</defaultValue>
           </leafNode>
           <node name="ip">
             <properties>
               <help>IPv4 routing parameters</help>
             </properties>
             <children>
               #include <include/interface/adjust-mss.xml.i>
               #include <include/interface/disable-forwarding.xml.i>
               #include <include/interface/source-validation.xml.i>
             </children>
           </node>
           <node name="ipv6">
             <properties>
               <help>IPv6 routing parameters</help>
             </properties>
             <children>
               <node name="address">
                 <properties>
                   <help>IPv6 address configuration modes</help>
                 </properties>
                 <children>
                   #include <include/interface/ipv6-address-autoconf.xml.i>
                 </children>
               </node>
               #include <include/interface/adjust-mss.xml.i>
               #include <include/interface/disable-forwarding.xml.i>
             </children>
           </node>
           #include <include/source-interface.xml.i>
           <leafNode name="local-address">
             <properties>
               <help>IPv4 address of local end of the PPPoE link</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Address of local end of the PPPoE link</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4-address"/>
               </constraint>
             </properties>
           </leafNode>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/mtu-68-1500.xml.i>
           <leafNode name="mtu">
             <defaultValue>1492</defaultValue>
           </leafNode>
           <leafNode name="mru">
             <properties>
               <help>Maximum Receive Unit (MRU) (default: MTU value)</help>
               <valueHelp>
                 <format>u32:128-16384</format>
                 <description>Maximum Receive Unit in byte</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 128-16384"/>
               </constraint>
               <constraintErrorMessage>MRU must be between 128 and 16384</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/interface/no-peer-dns.xml.i>
           <leafNode name="remote-address">
             <properties>
               <help>IPv4 address of remote end of the PPPoE link</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Address of remote end of the PPPoE link</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4-address"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="service-name">
             <properties>
               <help>Service name, only connect to access concentrators advertising this</help>
               <constraint>
                 <regex>[a-zA-Z0-9]+</regex>
               </constraint>
               <constraintErrorMessage>Service name must be alphanumeric only</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-pseudo-ethernet.xml.in b/interface-definitions/interfaces_pseudo-ethernet.xml.in
similarity index 98%
rename from interface-definitions/interfaces-pseudo-ethernet.xml.in
rename to interface-definitions/interfaces_pseudo-ethernet.xml.in
index 5c73825c3..031af3563 100644
--- a/interface-definitions/interfaces-pseudo-ethernet.xml.in
+++ b/interface-definitions/interfaces_pseudo-ethernet.xml.in
@@ -1,68 +1,68 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="pseudo-ethernet" owner="${vyos_conf_scripts_dir}/interfaces-pseudo-ethernet.py">
+      <tagNode name="pseudo-ethernet" owner="${vyos_conf_scripts_dir}/interfaces_pseudo-ethernet.py">
         <properties>
           <help>Pseudo Ethernet Interface (Macvlan)</help>
           <priority>321</priority>
           <constraint>
             <regex>peth[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Pseudo Ethernet interface must be named pethN</constraintErrorMessage>
           <valueHelp>
             <format>pethN</format>
             <description>Pseudo Ethernet interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/vrf.xml.i>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/source-interface-ethernet.xml.i>
           #include <include/interface/mac.xml.i>
           #include <include/interface/mirror.xml.i>
           <leafNode name="mode">
             <properties>
               <help>Receive mode (default: private)</help>
               <completionHelp>
                 <list>private vepa bridge passthru</list>
               </completionHelp>
               <valueHelp>
                 <format>private</format>
                 <description>No communication with other pseudo-devices</description>
               </valueHelp>
               <valueHelp>
                 <format>vepa</format>
                 <description>Virtual Ethernet Port Aggregator reflective relay</description>
               </valueHelp>
               <valueHelp>
                 <format>bridge</format>
                 <description>Simple bridge between pseudo-devices</description>
               </valueHelp>
               <valueHelp>
                 <format>passthru</format>
                 <description>Promicious mode passthrough of underlying device</description>
               </valueHelp>
               <constraint>
                 <regex>(private|vepa|bridge|passthru)</regex>
               </constraint>
               <constraintErrorMessage>mode must be private, vepa, bridge or passthru</constraintErrorMessage>
             </properties>
             <defaultValue>private</defaultValue>
           </leafNode>
           #include <include/interface/mtu-68-16000.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vif-s.xml.i>
           #include <include/interface/vif.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-sstpc.xml.in b/interface-definitions/interfaces_sstpc.xml.in
similarity index 99%
rename from interface-definitions/interfaces-sstpc.xml.in
rename to interface-definitions/interfaces_sstpc.xml.in
index b569e9bde..b7c49446f 100644
--- a/interface-definitions/interfaces-sstpc.xml.in
+++ b/interface-definitions/interfaces_sstpc.xml.in
@@ -1,47 +1,47 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="sstpc" owner="${vyos_conf_scripts_dir}/interfaces-sstpc.py">
+      <tagNode name="sstpc" owner="${vyos_conf_scripts_dir}/interfaces_sstpc.py">
         <properties>
           <help>Secure Socket Tunneling Protocol (SSTP) client Interface</help>
           <priority>460</priority>
           <constraint>
             <regex>sstpc[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Secure Socket Tunneling Protocol interface must be named sstpcN</constraintErrorMessage>
           <valueHelp>
             <format>sstpcN</format>
             <description>Secure Socket Tunneling Protocol interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/authentication.xml.i>
           #include <include/interface/no-default-route.xml.i>
           #include <include/interface/default-route-distance.xml.i>
           #include <include/interface/no-peer-dns.xml.i>
           #include <include/interface/mtu-68-1500.xml.i>
           <leafNode name="mtu">
             <defaultValue>1452</defaultValue>
           </leafNode>
           #include <include/server-ipv4-fqdn.xml.i>
           #include <include/port-number.xml.i>
           <leafNode name="port">
             <defaultValue>443</defaultValue>
           </leafNode>
           <node name="ssl">
             <properties>
               <help>Secure Sockets Layer (SSL) configuration</help>
             </properties>
             <children>
               #include <include/pki/ca-certificate.xml.i>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-tunnel.xml.in b/interface-definitions/interfaces_tunnel.xml.in
similarity index 99%
rename from interface-definitions/interfaces-tunnel.xml.in
rename to interface-definitions/interfaces_tunnel.xml.in
index 58f95dddb..99d9b34c6 100644
--- a/interface-definitions/interfaces-tunnel.xml.in
+++ b/interface-definitions/interfaces_tunnel.xml.in
@@ -1,281 +1,281 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="tunnel" owner="${vyos_conf_scripts_dir}/interfaces-tunnel.py">
+      <tagNode name="tunnel" owner="${vyos_conf_scripts_dir}/interfaces_tunnel.py">
         <properties>
           <help>Tunnel interface</help>
           <priority>380</priority>
           <constraint>
             <regex>tun[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>tunnel interface must be named tunN</constraintErrorMessage>
           <valueHelp>
             <format>tunN</format>
             <description>Tunnel interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/mtu-64-8024.xml.i>
           <leafNode name="mtu">
             <defaultValue>1476</defaultValue>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/source-address-ipv4-ipv6.xml.i>
           #include <include/interface/tunnel-remote.xml.i>
           #include <include/source-interface.xml.i>
           <leafNode name="6rd-prefix">
             <properties>
               <help>6rd network prefix</help>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address and prefix length</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv6-prefix"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="6rd-relay-prefix">
             <properties>
               <help>6rd relay prefix</help>
               <valueHelp>
                 <format>ipv4net</format>
                 <description>IPv4 prefix of interface for 6rd</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4-prefix"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="encapsulation">
             <properties>
               <help>Encapsulation of this tunnel interface</help>
               <completionHelp>
                 <list>erspan gre gretap ip6erspan ip6gre ip6gretap ip6ip6 ipip ipip6 sit</list>
               </completionHelp>
               <valueHelp>
                 <format>erspan</format>
                 <description>Encapsulated Remote Switched Port Analyzer</description>
               </valueHelp>
               <valueHelp>
                 <format>gre</format>
                 <description>Generic Routing Encapsulation (network layer)</description>
               </valueHelp>
               <valueHelp>
                 <format>gretap</format>
                 <description>Generic Routing Encapsulation (datalink layer)</description>
               </valueHelp>
               <valueHelp>
                 <format>ip6erspan</format>
                 <description>Encapsulated Remote Switched Port Analyzer over IPv6</description>
               </valueHelp>
               <valueHelp>
                 <format>ip6gre</format>
                 <description>GRE over IPv6 (network layer)</description>
               </valueHelp>
               <valueHelp>
                 <format>ip6gretap</format>
                 <description>GRE over IPv6 (datalink layer)</description>
               </valueHelp>
               <valueHelp>
                 <format>ip6ip6</format>
                 <description>IPv6 in IPv6 encapsulation</description>
               </valueHelp>
               <valueHelp>
                 <format>ipip</format>
                 <description>IPv4 in IPv4 encapsulation</description>
               </valueHelp>
               <valueHelp>
                 <format>ipip6</format>
                 <description>IPv4 in IP6 encapsulation</description>
               </valueHelp>
               <valueHelp>
                 <format>sit</format>
                 <description>Simple Internet Transition (IPv6 in IPv4)</description>
               </valueHelp>
               <constraint>
                 <regex>(erspan|gre|gretap|ip6erspan|ip6gre|ip6gretap|ip6ip6|ipip|ipip6|sit)</regex>
               </constraint>
               <constraintErrorMessage>Invalid encapsulation, must be one of: erspan, gre, gretap, ip6erspan, ip6gre, ip6gretap, ipip, sit, ipip6 or ip6ip6</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/interface/mirror.xml.i>
           <leafNode name="enable-multicast">
             <properties>
               <help>Enable multicast operation over tunnel</help>
               <valueless/>
             </properties>
           </leafNode>
           <node name="parameters">
             <properties>
               <help>Tunnel parameters</help>
             </properties>
             <children>
               <node name="erspan">
                 <properties>
                   <help>ERSPAN tunnel parameters</help>
                 </properties>
                 <children>
                   <leafNode name="direction">
                     <properties>
                       <help>Mirrored traffic direction</help>
                       <completionHelp>
                         <list>ingress egress</list>
                       </completionHelp>
                       <valueHelp>
                         <format>ingress</format>
                         <description>Mirror ingress traffic</description>
                       </valueHelp>
                       <valueHelp>
                         <format>egress</format>
                         <description>Mirror egress traffic</description>
                       </valueHelp>
                       <constraint>
                         <regex>(ingress|egress)</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="hw-id">
                     <properties>
                       <help>Unique identifier of an ERSPAN engine within a system</help>
                       <valueHelp>
                         <format>u32:0-1048575</format>
                         <description>Unique identifier of an ERSPAN engine</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-1048575"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="index">
                     <properties>
                       <help>ERSPAN version 1 index field</help>
                       <valueHelp>
                         <format>u32:0-63</format>
                         <description>Platform-depedent field for specifying port number and direction</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-63"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="version">
                     <properties>
                       <help>Protocol version</help>
                       <completionHelp>
                         <list>1 2</list>
                       </completionHelp>
                       <valueHelp>
                         <format>1</format>
                         <description>ERSPAN Type II</description>
                       </valueHelp>
                       <valueHelp>
                         <format>2</format>
                         <description>ERSPAN Type III</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-2"/>
                       </constraint>
                     </properties>
                     <defaultValue>1</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <node name="ip">
                 <properties>
                   <help>IPv4-specific tunnel parameters</help>
                 </properties>
                 <children>
                   <leafNode name="no-pmtu-discovery">
                     <properties>
                       <help>Disable path MTU discovery</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="ignore-df">
                     <properties>
                       <help>Ignore the DF (don't fragment) bit</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   #include <include/interface/parameters-key.xml.i>
                   #include <include/interface/parameters-tos.xml.i>
                   #include <include/interface/parameters-ttl.xml.i>
                   <leafNode name="ttl">
                     <defaultValue>64</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <node name="ipv6">
                 <properties>
                   <help>IPv6-specific tunnel parameters</help>
                 </properties>
                 <children>
                   <leafNode name="encaplimit">
                     <properties>
                       <help>Set fixed encapsulation limit</help>
                       <completionHelp>
                         <list>none</list>
                       </completionHelp>
                       <valueHelp>
                         <format>u32:0-255</format>
                         <description>Encapsulation limit</description>
                       </valueHelp>
                       <valueHelp>
                         <format>none</format>
                         <description>Disable encapsulation limit</description>
                       </valueHelp>
                       <constraint>
                         <regex>(none)</regex>
                         <validator name="numeric" argument="--range 0-255"/>
                       </constraint>
                       <constraintErrorMessage>Tunnel encaplimit must be 0-255 or none</constraintErrorMessage>
                     </properties>
                     <defaultValue>4</defaultValue>
                   </leafNode>
                   #include <include/interface/parameters-flowlabel.xml.i>
                   <leafNode name="hoplimit">
                     <properties>
                       <help>Hoplimit</help>
                       <valueHelp>
                         <format>u32:0-255</format>
                         <description>Hop limit</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-255"/>
                       </constraint>
                       <constraintErrorMessage>hop limit must be between 0-255</constraintErrorMessage>
                     </properties>
                     <defaultValue>64</defaultValue>
                   </leafNode>
                   <leafNode name="tclass">
                     <properties>
                       <help>Traffic class (Tclass)</help>
                       <valueHelp>
                         <format>0x0-0x0fffff</format>
                         <description>Traffic class, 'inherit' or hex value</description>
                       </valueHelp>
                       <constraint>
                         <regex>(0x){0,1}(0?[0-9A-Fa-f]{1,2})</regex>
                       </constraint>
                       <constraintErrorMessage>Must be 'inherit' or a number</constraintErrorMessage>
                     </properties>
                     <defaultValue>inherit</defaultValue>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
           #include <include/interface/redirect.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-virtual-ethernet.xml.in b/interface-definitions/interfaces_virtual-ethernet.xml.in
similarity index 97%
rename from interface-definitions/interfaces-virtual-ethernet.xml.in
rename to interface-definitions/interfaces_virtual-ethernet.xml.in
index 0fc89efc0..c4610feec 100644
--- a/interface-definitions/interfaces-virtual-ethernet.xml.in
+++ b/interface-definitions/interfaces_virtual-ethernet.xml.in
@@ -1,48 +1,48 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="virtual-ethernet" owner="${vyos_conf_scripts_dir}/interfaces-virtual-ethernet.py">
+      <tagNode name="virtual-ethernet" owner="${vyos_conf_scripts_dir}/interfaces_virtual-ethernet.py">
         <properties>
           <help>Virtual Ethernet (veth) Interface</help>
           <priority>300</priority>
           <constraint>
             <regex>veth[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Virtual Ethernet interface must be named vethN</constraintErrorMessage>
           <valueHelp>
             <format>vethN</format>
             <description>Virtual Ethernet interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/netns.xml.i>
           #include <include/interface/vif-s.xml.i>
           #include <include/interface/vif.xml.i>
           #include <include/interface/vrf.xml.i>
           <leafNode name="peer-name">
             <properties>
               <help>Virtual ethernet peer interface name</help>
               <completionHelp>
                 <path>interfaces virtual-ethernet</path>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Name of peer interface</description>
               </valueHelp>
               <constraint>
                 <regex>veth[0-9]+</regex>
               </constraint>
               <constraintErrorMessage>Virutal Ethernet interface must be named vethN</constraintErrorMessage>
             </properties>
           </leafNode>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-vti.xml.in b/interface-definitions/interfaces_vti.xml.in
similarity index 98%
rename from interface-definitions/interfaces-vti.xml.in
rename to interface-definitions/interfaces_vti.xml.in
index b116f7386..158d9afd0 100644
--- a/interface-definitions/interfaces-vti.xml.in
+++ b/interface-definitions/interfaces_vti.xml.in
@@ -1,32 +1,32 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="vti" owner="${vyos_conf_scripts_dir}/interfaces-vti.py">
+      <tagNode name="vti" owner="${vyos_conf_scripts_dir}/interfaces_vti.py">
         <properties>
           <help>Virtual Tunnel Interface (XFRM)</help>
           <priority>381</priority>
           <constraint>
             <regex>vti[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>VTI interface must be named vtiN</constraintErrorMessage>
           <valueHelp>
             <format>vtiN</format>
             <description>VTI interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-vxlan.xml.in b/interface-definitions/interfaces_vxlan.xml.in
similarity index 99%
rename from interface-definitions/interfaces-vxlan.xml.in
rename to interface-definitions/interfaces_vxlan.xml.in
index 4461923d9..504c08e7e 100644
--- a/interface-definitions/interfaces-vxlan.xml.in
+++ b/interface-definitions/interfaces_vxlan.xml.in
@@ -1,133 +1,133 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="vxlan" owner="${vyos_conf_scripts_dir}/interfaces-vxlan.py">
+      <tagNode name="vxlan" owner="${vyos_conf_scripts_dir}/interfaces_vxlan.py">
         <properties>
           <help>Virtual Extensible LAN (VXLAN) Interface</help>
           <priority>460</priority>
           <constraint>
             <regex>vxlan[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>VXLAN interface must be named vxlanN</constraintErrorMessage>
           <valueHelp>
             <format>vxlanN</format>
             <description>VXLAN interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           <leafNode name="gpe">
             <properties>
               <help>Enable Generic Protocol extension (VXLAN-GPE)</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="group">
             <properties>
               <help>Multicast group address for VXLAN interface</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Multicast IPv4 group address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>Multicast IPv6 group address</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4-multicast"/>
                 <validator name="ipv6-multicast"/>
               </constraint>
               <constraintErrorMessage>Multicast IPv4/IPv6 address required</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/mac.xml.i>
           #include <include/interface/mtu-1200-16000.xml.i>
           #include <include/interface/mirror.xml.i>
           <node name="parameters">
             <properties>
               <help>VXLAN tunnel parameters</help>
             </properties>
             <children>
               <node name="ip">
                 <properties>
                   <help>IPv4 specific tunnel parameters</help>
                 </properties>
                 <children>
                   #include <include/interface/parameters-df.xml.i>
                   #include <include/interface/parameters-tos.xml.i>
                   #include <include/interface/parameters-ttl.xml.i>
                   <leafNode name="ttl">
                     <defaultValue>16</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <node name="ipv6">
                 <properties>
                   <help>IPv6 specific tunnel parameters</help>
                 </properties>
                 <children>
                   #include <include/interface/parameters-flowlabel.xml.i>
                 </children>
               </node>
               <leafNode name="external">
                 <properties>
                   <help>Use external control plane</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="nolearning">
                 <properties>
                   <help>Do not add unknown addresses into forwarding database</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="neighbor-suppress">
                 <properties>
                   <help>Enable neighbor discovery (ARP and ND) suppression</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="vni-filter">
                 <properties>
                   <help>Enable VNI filter support</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           #include <include/port-number.xml.i>
           <leafNode name="port">
             <defaultValue>4789</defaultValue>
           </leafNode>
           #include <include/source-address-ipv4-ipv6.xml.i>
           #include <include/source-interface.xml.i>
           #include <include/interface/tunnel-remote-multi.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
           #include <include/vni.xml.i>
           <tagNode name="vlan-to-vni">
             <properties>
               <help>Configuring VLAN-to-VNI mappings for EVPN-VXLAN</help>
               <valueHelp>
                 <format>u32:0-4094</format>
                 <description>Virtual Local Area Network (VLAN) ID</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-4094"/>
               </constraint>
               <constraintErrorMessage>VLAN ID must be between 0 and 4094</constraintErrorMessage>
             </properties>
             <children>
               #include <include/vni.xml.i>
             </children>
             </tagNode>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-wireguard.xml.in b/interface-definitions/interfaces_wireguard.xml.in
similarity index 99%
rename from interface-definitions/interfaces-wireguard.xml.in
rename to interface-definitions/interfaces_wireguard.xml.in
index 3c79cef28..f3fe0f1da 100644
--- a/interface-definitions/interfaces-wireguard.xml.in
+++ b/interface-definitions/interfaces_wireguard.xml.in
@@ -1,129 +1,129 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="wireguard" owner="${vyos_conf_scripts_dir}/interfaces-wireguard.py">
+      <tagNode name="wireguard" owner="${vyos_conf_scripts_dir}/interfaces_wireguard.py">
         <properties>
           <help>WireGuard Interface</help>
           <priority>379</priority>
           <constraint>
             <regex>wg[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>WireGuard interface must be named wgN</constraintErrorMessage>
           <valueHelp>
             <format>wgN</format>
             <description>WireGuard interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/port-number.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           #include <include/interface/mirror.xml.i>
           <leafNode name="mtu">
             <defaultValue>1420</defaultValue>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           <leafNode name="fwmark">
             <properties>
               <help>A 32-bit fwmark value set on all outgoing packets</help>
               <valueHelp>
                 <format>number</format>
                 <description>value which marks the packet for QoS/shaper</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-4294967295"/>
               </constraint>
             </properties>
             <defaultValue>0</defaultValue>
           </leafNode>
           <leafNode name="private-key">
             <properties>
               <help>Base64 encoded private key</help>
               <constraint>
                 <regex>[0-9a-zA-Z\+/]{43}=</regex>
               </constraint>
               <constraintErrorMessage>Key is not valid 44-character (32-bytes) base64</constraintErrorMessage>
             </properties>
           </leafNode>
           <tagNode name="peer">
             <properties>
               <help>peer alias</help>
               <constraint>
                 <regex>[^ ]{1,100}</regex>
               </constraint>
               <constraintErrorMessage>peer alias too long (limit 100 characters)</constraintErrorMessage>
             </properties>
             <children>
               #include <include/generic-disable-node.xml.i>
               #include <include/generic-description.xml.i>
               <leafNode name="public-key">
                 <properties>
                   <help>base64 encoded public key</help>
                   <constraint>
                     <regex>[0-9a-zA-Z\+/]{43}=</regex>
                   </constraint>
                   <constraintErrorMessage>Key is not valid 44-character (32-bytes) base64</constraintErrorMessage>
                 </properties>
               </leafNode>
               <leafNode name="preshared-key">
                 <properties>
                   <help>base64 encoded preshared key</help>
                   <constraint>
                     <regex>[0-9a-zA-Z\+/]{43}=</regex>
                   </constraint>
                   <constraintErrorMessage>Key is not valid 44-character (32-bytes) base64</constraintErrorMessage>
                 </properties>
               </leafNode>
               <leafNode name="allowed-ips">
                 <properties>
                   <help>IP addresses allowed to traverse the peer</help>
                   <constraint>
                     <validator name="ip-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="address">
                 <properties>
                   <help>IP address of tunnel endpoint</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 address of remote tunnel endpoint</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address of remote tunnel endpoint</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                     <validator name="ipv6-link-local"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/port-number.xml.i>
               <leafNode name="persistent-keepalive">
                 <properties>
                   <help>Interval to send keepalive messages</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Interval in seconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/per-client-thread.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-wireless.xml.in b/interface-definitions/interfaces_wireless.xml.in
similarity index 99%
rename from interface-definitions/interfaces-wireless.xml.in
rename to interface-definitions/interfaces_wireless.xml.in
index 88b858c07..b5da0a556 100644
--- a/interface-definitions/interfaces-wireless.xml.in
+++ b/interface-definitions/interfaces_wireless.xml.in
@@ -1,832 +1,832 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="wireless" owner="${vyos_conf_scripts_dir}/interfaces-wireless.py">
+      <tagNode name="wireless" owner="${vyos_conf_scripts_dir}/interfaces_wireless.py">
         <properties>
           <help>Wireless (WiFi/WLAN) Network Interface</help>
           <priority>318</priority>
           <completionHelp>
             <script>cd /sys/class/net; if compgen -G "wlan*" > /dev/null; then ls -d wlan*; fi</script>
           </completionHelp>
           <constraint>
             <regex>wlan[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Wireless interface must be named wlanN</constraintErrorMessage>
           <valueHelp>
             <format>wlanN</format>
             <description>Wireless (WiFi/WLAN) interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           <node name="capabilities">
             <properties>
               <help>HT and VHT capabilities for your card</help>
             </properties>
             <children>
               <node name="ht">
                 <properties>
                   <help>HT (High Throughput) settings</help>
                 </properties>
                 <children>
                   <leafNode name="40mhz-incapable">
                     <properties>
                       <help>40MHz intolerance, use 20MHz only!</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="auto-powersave">
                     <properties>
                       <help>Enable WMM-PS unscheduled automatic power aave delivery [U-APSD]</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="channel-set-width">
                     <properties>
                       <help>Supported channel set width</help>
                       <completionHelp>
                         <list>ht20 ht40+ ht40-</list>
                       </completionHelp>
                       <valueHelp>
                         <format>ht20</format>
                         <description>Supported channel set width both 20 MHz only</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ht40+</format>
                         <description>Supported channel set width both 20 MHz and 40 MHz with secondary channel above primary channel</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ht40-</format>
                         <description>Supported channel set width both 20 MHz and 40 MHz with secondary channel below primary channel</description>
                       </valueHelp>
                       <constraint>
                         <regex>(ht20|ht40\+|ht40-)</regex>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="delayed-block-ack">
                     <properties>
                       <help>Enable HT-delayed block ack</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="dsss-cck-40">
                     <properties>
                       <help>Enable DSSS_CCK-40</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="greenfield">
                     <properties>
                       <help>Enable HT-greenfield</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="ldpc">
                     <properties>
                       <help>Enable LDPC coding capability</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="lsig-protection">
                     <properties>
                       <help>Enable L-SIG TXOP protection capability</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="max-amsdu">
                     <properties>
                       <help>Set maximum A-MSDU length</help>
                       <completionHelp>
                         <list>3839 7935</list>
                       </completionHelp>
                       <valueHelp>
                         <format>3839</format>
                         <description>Set maximum A-MSDU length to 3839 octets</description>
                       </valueHelp>
                       <valueHelp>
                         <format>7935</format>
                         <description>Set maximum A-MSDU length to 7935 octets</description>
                       </valueHelp>
                       <constraint>
                         <regex>(3839|7935)</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="short-gi">
                     <properties>
                       <help>Short GI capabilities</help>
                       <completionHelp>
                         <list>20 40</list>
                       </completionHelp>
                       <valueHelp>
                         <format>20</format>
                         <description>Short GI for 20 MHz</description>
                       </valueHelp>
                       <valueHelp>
                         <format>40</format>
                         <description>Short GI for 40 MHz</description>
                       </valueHelp>
                       <constraint>
                         <regex>(20|40)</regex>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="smps">
                     <properties>
                       <help>Spatial Multiplexing Power Save (SMPS) settings</help>
                       <completionHelp>
                         <list>static dynamic</list>
                       </completionHelp>
                       <valueHelp>
                         <format>static</format>
                         <description>STATIC Spatial Multiplexing (SM) Power Save</description>
                       </valueHelp>
                       <valueHelp>
                         <format>dynamic</format>
                         <description>DYNAMIC Spatial Multiplexing (SM) Power Save</description>
                       </valueHelp>
                       <constraint>
                         <regex>(static|dynamic)</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <node name="stbc">
                     <properties>
                       <help>Support for sending and receiving PPDU using STBC (Space Time Block Coding)</help>
                     </properties>
                     <children>
                       <leafNode name="rx">
                         <properties>
                           <help>Enable receiving PPDU using STBC (Space Time Block Coding)</help>
                           <valueHelp>
                             <format>[1-3]+</format>
                             <description>Number of spacial streams that can use RX STBC</description>
                           </valueHelp>
                           <constraint>
                             <regex>[1-3]+</regex>
                           </constraint>
                           <constraintErrorMessage>Invalid capability item</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="tx">
                         <properties>
                           <help>Enable sending PPDU using STBC (Space Time Block Coding)</help>
                           <valueless/>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                 </children>
               </node>
               <leafNode name="require-ht">
                 <properties>
                   <help>Require stations to support HT PHY (reject association if they do not)</help>
                   <completionHelp>
                     <script>echo If you reject non-HT, you also disable 802.11g</script>
                   </completionHelp>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="require-vht">
                 <properties>
                   <help>Require stations to support VHT PHY (reject association if they do not)</help>
                   <completionHelp>
                     <script>echo If you reject non-VHT, you also disable 802.11n</script>
                   </completionHelp>
                   <valueless/>
                 </properties>
               </leafNode>
               <node name="vht">
                 <properties>
                   <help>VHT (Very High Throughput) settings</help>
                 </properties>
                 <children>
                   <leafNode name="antenna-count">
                     <properties>
                       <help>Number of antennas on this card</help>
                       <valueHelp>
                         <format>u32:1-8</format>
                         <description>Number of antennas for this card</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-8"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="antenna-pattern-fixed">
                     <properties>
                       <help>Set if antenna pattern does not change during the lifetime of an association</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="beamform">
                     <properties>
                       <help>Beamforming capabilities</help>
                       <completionHelp>
                         <list>single-user-beamformer single-user-beamformee multi-user-beamformer multi-user-beamformee</list>
                       </completionHelp>
                       <valueHelp>
                         <format>single-user-beamformer</format>
                         <description>Support for operation as single user beamformer</description>
                       </valueHelp>
                       <valueHelp>
                         <format>single-user-beamformee</format>
                         <description>Support for operation as single user beamformee</description>
                       </valueHelp>
                       <valueHelp>
                         <format>multi-user-beamformer</format>
                         <description>Support for operation as multi user beamformer</description>
                       </valueHelp>
                       <valueHelp>
                         <format>multi-user-beamformee</format>
                         <description>Support for operation as multi user beamformee</description>
                       </valueHelp>
                       <constraint>
                         <regex>(single-user-beamformer|single-user-beamformee|multi-user-beamformer|multi-user-beamformee)</regex>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <node name="center-channel-freq">
                     <properties>
                       <help>VHT operating channel center frequency</help>
                     </properties>
                     <children>
                       <leafNode name="freq-1">
                         <properties>
                           <help>VHT operating channel center frequency - center freq 1 (for use with 80, 80+80 and 160 modes)</help>
                           <valueHelp>
                             <format>u32:34-173</format>
                             <description>5Ghz (802.11 a/h/j/n/ac) center channel index (use 42 for primary 80MHz channel 36)</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 34-173"/>
                           </constraint>
                           <constraintErrorMessage>Channel center value must be between 34 and 173</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="freq-2">
                         <properties>
                           <help>VHT operating channel center frequency - center freq 2 (for use with the 80+80 mode)</help>
                           <valueHelp>
                             <format>u32:34-173</format>
                             <description>5Ghz (802.11 a/h/j/n/ac) center channel index (use 58 for primary 80MHz channel 52)</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 34-173"/>
                           </constraint>
                           <constraintErrorMessage>Channel center value must be between 34 and 173</constraintErrorMessage>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   <leafNode name="channel-set-width">
                     <properties>
                       <help>VHT operating Channel width</help>
                       <completionHelp>
                         <list>0 1 2 3</list>
                       </completionHelp>
                       <valueHelp>
                         <format>0</format>
                         <description>20 or 40 MHz channel width</description>
                       </valueHelp>
                       <valueHelp>
                         <format>1</format>
                         <description>80 MHz channel width</description>
                       </valueHelp>
                       <valueHelp>
                         <format>2</format>
                         <description>160 MHz channel width</description>
                       </valueHelp>
                       <valueHelp>
                         <format>3</format>
                         <description>80+80 MHz channel width</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-3"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="ldpc">
                     <properties>
                       <help>Enable LDPC (Low Density Parity Check) coding capability</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="link-adaptation">
                     <properties>
                       <help>VHT link adaptation capabilities</help>
                       <completionHelp>
                         <list>unsolicited both</list>
                       </completionHelp>
                       <valueHelp>
                         <format>unsolicited</format>
                         <description>Station provides only unsolicited VHT MFB</description>
                       </valueHelp>
                       <valueHelp>
                         <format>both</format>
                         <description>Station can provide VHT MFB in response to VHT MRQ and unsolicited VHT MFB</description>
                       </valueHelp>
                       <constraint>
                         <regex>(unsolicited|both)</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid capability item</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="max-mpdu-exp">
                     <properties>
                       <help>Set the maximum length of A-MPDU pre-EOF padding that the station can receive</help>
                       <valueHelp>
                         <format>u32:0-7</format>
                         <description>Maximum length of A-MPDU pre-EOF padding = 2 pow(13 + x) -1 octets</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-7"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="max-mpdu">
                     <properties>
                       <help>Increase Maximum MPDU length to 7991 or 11454 octets (otherwise: 3895 octets)</help>
                       <completionHelp>
                         <list>7991 11454</list>
                       </completionHelp>
                       <valueHelp>
                         <format>7991</format>
                         <description>ncrease Maximum MPDU length to 7991 octets</description>
                       </valueHelp>
                       <valueHelp>
                         <format>11454</format>
                         <description>ncrease Maximum MPDU length to 11454 octets</description>
                       </valueHelp>
                       <constraint>
                         <regex>(7991|11454)</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="short-gi">
                     <properties>
                       <help>Short GI capabilities</help>
                       <completionHelp>
                         <list>80 160</list>
                       </completionHelp>
                       <valueHelp>
                         <format>80</format>
                         <description>Short GI for 80 MHz</description>
                       </valueHelp>
                       <valueHelp>
                         <format>160</format>
                         <description>Short GI for 160 MHz</description>
                       </valueHelp>
                       <constraint>
                         <regex>(80|160)</regex>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <node name="stbc">
                     <properties>
                       <help>Support for sending and receiving PPDU using STBC (Space Time Block Coding)</help>
                     </properties>
                     <children>
                       <leafNode name="rx">
                         <properties>
                           <help>Enable receiving PPDU using STBC (Space Time Block Coding)</help>
                           <valueHelp>
                             <format>[1-4]+</format>
                             <description>Number of spacial streams that can use RX STBC</description>
                           </valueHelp>
                           <constraint>
                             <regex>[1-4]+</regex>
                           </constraint>
                           <constraintErrorMessage>Invalid capability item</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="tx">
                         <properties>
                           <help>Enable sending PPDU using STBC (Space Time Block Coding)</help>
                           <valueless/>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   <leafNode name="tx-powersave">
                     <properties>
                       <help>Enable VHT TXOP Power Save Mode</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="vht-cf">
                     <properties>
                       <help>Station supports receiving VHT variant HT Control field</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           <leafNode name="channel">
             <properties>
               <help>Wireless radio channel</help>
               <valueHelp>
                 <format>0</format>
                 <description>Automatic Channel Selection (ACS)</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:1-14</format>
                 <description>2.4Ghz (802.11 b/g/n) Channel</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:34-173</format>
                 <description>5Ghz (802.11 a/h/j/n/ac) Channel</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-0 --range 1-14 --range 34-173"/>
               </constraint>
             </properties>
             <defaultValue>0</defaultValue>
           </leafNode>
           <leafNode name="country-code">
             <properties>
               <help>Indicate country in which device is operating</help>
               <completionHelp>
                 <list>us eu jp de uk cn es fr ru</list>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>ISO/IEC 3166-1 Country Code</description>
               </valueHelp>
               <constraint>
                 <regex>[a-z][a-z]</regex>
               </constraint>
               <constraintErrorMessage>Invalid ISO/IEC 3166-1 Country Code</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/generic-description.xml.i>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           <leafNode name="disable-broadcast-ssid">
             <properties>
               <help>Disable broadcast of SSID from access-point</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/vrf.xml.i>
           <leafNode name="expunge-failing-stations">
             <properties>
               <help>Disassociate stations based on excessive transmission failures</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/hw-id.xml.i>
           <leafNode name="isolate-stations">
             <properties>
               <help>Isolate stations on the AP so they cannot see each other</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/mac.xml.i>
           <leafNode name="max-stations">
             <properties>
               <help>Maximum number of wireless radio stations. Excess stations will be rejected upon authentication request.</help>
               <valueHelp>
                 <format>u32:1-2007</format>
                 <description>Number of allowed stations</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-2007"/>
               </constraint>
               <constraintErrorMessage>Number of stations must be between 1 and 2007</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="mgmt-frame-protection">
             <properties>
               <help>Management Frame Protection (MFP) according to IEEE 802.11w</help>
               <completionHelp>
                 <list>disabled optional required</list>
               </completionHelp>
               <valueHelp>
                 <format>disabled</format>
                 <description>no MFP</description>
               </valueHelp>
               <valueHelp>
                 <format>optional</format>
                 <description>MFP optional</description>
               </valueHelp>
               <valueHelp>
                 <format>required</format>
                 <description>MFP enforced</description>
               </valueHelp>
               <constraint>
                 <regex>(disabled|optional|required)</regex>
               </constraint>
             </properties>
             <defaultValue>disabled</defaultValue>
           </leafNode>
           <leafNode name="mode">
             <properties>
               <help>Wireless radio mode</help>
               <completionHelp>
                 <list>a b g n ac</list>
               </completionHelp>
               <valueHelp>
                 <format>a</format>
                 <description>802.11a - 54 Mbits/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>b</format>
                 <description>802.11b - 11 Mbits/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>g</format>
                 <description>802.11g - 54 Mbits/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>n</format>
                 <description>802.11n - 600 Mbits/sec</description>
               </valueHelp>
               <valueHelp>
                 <format>ac</format>
                 <description>802.11ac - 1300 Mbits/sec</description>
               </valueHelp>
               <constraint>
                 <regex>(a|b|g|n|ac)</regex>
               </constraint>
             </properties>
             <defaultValue>g</defaultValue>
           </leafNode>
           #include <include/interface/mirror.xml.i>
           <leafNode name="physical-device">
             <properties>
               <help>Wireless physical device</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_wireless_phys.sh</script>
               </completionHelp>
               <constraint>
                 <validator name="wireless-phy"/>
               </constraint>
             </properties>
             <defaultValue>phy0</defaultValue>
           </leafNode>
           <leafNode name="reduce-transmit-power">
             <properties>
               <help>Transmission power reduction in dBm</help>
               <valueHelp>
                 <format>u32:0-255</format>
                 <description>TX power reduction in dBm</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-255"/>
               </constraint>
               <constraintErrorMessage>dBm value must be between 0 and 255</constraintErrorMessage>
             </properties>
           </leafNode>
           <node name="security">
             <properties>
               <help>Wireless security settings</help>
             </properties>
             <children>
               <node name="station-address">
                 <properties>
                   <help>Station MAC address based authentication</help>
                 </properties>
                 <children>
                   <leafNode name="mode">
                     <properties>
                       <help>Select security operation mode</help>
                       <completionHelp>
                         <list>accept deny</list>
                       </completionHelp>
                       <valueHelp>
                         <format>accept</format>
                         <description>Accept all clients unless found in deny list</description>
                       </valueHelp>
                       <valueHelp>
                         <format>deny</format>
                         <description>Deny all clients unless found in accept list</description>
                       </valueHelp>
                       <constraint>
                         <regex>(accept|deny)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>accept</defaultValue>
                   </leafNode>
                   <node name="accept">
                     <properties>
                       <help>Accept station MAC address</help>
                     </properties>
                     <children>
                       #include <include/interface/mac-multi.xml.i>
                     </children>
                   </node>
                   <node name="deny">
                     <properties>
                       <help>Deny station MAC address</help>
                     </properties>
                     <children>
                       #include <include/interface/mac-multi.xml.i>
                     </children>
                   </node>
                 </children>
               </node>
               <node name="wep">
                 <properties>
                   <help>Wired Equivalent Privacy (WEP) parameters</help>
                 </properties>
                 <children>
                   <leafNode name="key">
                     <properties>
                       <help>WEP encryption key</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Wired Equivalent Privacy key</description>
                       </valueHelp>
                       <constraint>
                         <regex>([a-fA-F0-9]{10}|[a-fA-F0-9]{26}|[a-fA-F0-9]{32})</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid WEP key</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               <node name="wpa">
                 <properties>
                   <help>Wifi Protected Access (WPA) parameters</help>
                 </properties>
                 <children>
                   <leafNode name="cipher">
                     <properties>
                       <help>Cipher suite for WPA unicast packets</help>
                       <completionHelp>
                         <list>GCMP-256 GCMP CCMP-256 CCMP TKIP</list>
                       </completionHelp>
                       <valueHelp>
                         <format>GCMP-256</format>
                         <description>AES in Galois/counter mode with 256-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>GCMP</format>
                         <description>AES in Galois/counter mode with 128-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>CCMP-256</format>
                         <description>AES in Counter mode with CBC-MAC with 256-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>CCMP</format>
                         <description>AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] (supported on all WPA2 APs)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>TKIP</format>
                         <description>Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]</description>
                       </valueHelp>
                       <constraint>
                         <regex>(GCMP-256|GCMP|CCMP-256|CCMP|TKIP)</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid cipher selection</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="group-cipher">
                     <properties>
                       <help>Cipher suite for WPA multicast and broadcast packets</help>
                       <completionHelp>
                         <list>GCMP-256 GCMP CCMP-256 CCMP TKIP</list>
                       </completionHelp>
                       <valueHelp>
                         <format>GCMP-256</format>
                         <description>AES in Galois/counter mode with 256-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>GCMP</format>
                         <description>AES in Galois/counter mode with 128-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>CCMP-256</format>
                         <description>AES in Counter mode with CBC-MAC with 256-bit key</description>
                       </valueHelp>
                       <valueHelp>
                         <format>CCMP</format>
                         <description>AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0] (supported on all WPA2 APs)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>TKIP</format>
                         <description>Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]</description>
                       </valueHelp>
                       <constraint>
                         <regex>(GCMP-256|GCMP|CCMP-256|CCMP|TKIP)</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid group cipher selection</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="mode">
                     <properties>
                       <help>WPA mode</help>
                       <completionHelp>
                         <list>wpa wpa2 wpa+wpa2 wpa3</list>
                       </completionHelp>
                       <valueHelp>
                         <format>wpa</format>
                         <description>WPA (IEEE 802.11i/D3.0)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>wpa2</format>
                         <description>WPA2 (full IEEE 802.11i/RSN)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>wpa+wpa2</format>
                         <description>Allow both WPA and WPA2</description>
                       </valueHelp>
                       <constraint>
                         <regex>(wpa|wpa2|wpa\+wpa2|wpa3)</regex>
                       </constraint>
                       <constraintErrorMessage>Unknown WPA mode</constraintErrorMessage>
                     </properties>
                     <defaultValue>wpa+wpa2</defaultValue>
                   </leafNode>
                   <leafNode name="passphrase">
                     <properties>
                       <help>WPA personal shared pass phrase. If you are using special characters in the WPA passphrase then single quotes are required.</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Passphrase of at least 8 but not more than 63 printable characters</description>
                       </valueHelp>
                       <constraint>
                         <regex>.{8,63}</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid WPA pass phrase, must be 8 to 63 printable characters!</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   #include <include/radius-auth-server-ipv4.xml.i>
                   <node name="radius">
                     <children>
                       <tagNode name="server">
                         <children>
                           <leafNode name="accounting">
                             <properties>
                               <help>Enable RADIUS server to receive accounting info</help>
                               <valueless/>
                             </properties>
                           </leafNode>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                 </children>
               </node>
             </children>
           </node>
           <leafNode name="ssid">
             <properties>
               <help>Wireless access-point service set identifier (SSID)</help>
               <constraint>
                 <regex>.{1,32}</regex>
               </constraint>
               <constraintErrorMessage>Invalid SSID</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="type">
             <properties>
               <help>Wireless device type for this interface</help>
               <completionHelp>
                 <list>access-point station monitor</list>
               </completionHelp>
               <valueHelp>
                 <format>access-point</format>
                 <description>Access-point forwards packets between other nodes</description>
               </valueHelp>
               <valueHelp>
                 <format>station</format>
                 <description>Connects to another access point</description>
               </valueHelp>
               <valueHelp>
                 <format>monitor</format>
                 <description>Passively monitor all packets on the frequency/channel</description>
               </valueHelp>
               <constraint>
                 <regex>(access-point|station|monitor)</regex>
               </constraint>
               <constraintErrorMessage>Type must be access-point, station or monitor</constraintErrorMessage>
             </properties>
             <defaultValue>monitor</defaultValue>
           </leafNode>
           #include <include/interface/per-client-thread.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vif.xml.i>
           #include <include/interface/vif-s.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/interfaces-wwan.xml.in b/interface-definitions/interfaces_wwan.xml.in
similarity index 99%
rename from interface-definitions/interfaces-wwan.xml.in
rename to interface-definitions/interfaces_wwan.xml.in
index 5fa3be8db..1580c3bcb 100644
--- a/interface-definitions/interfaces-wwan.xml.in
+++ b/interface-definitions/interfaces_wwan.xml.in
@@ -1,48 +1,48 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="interfaces">
     <children>
-      <tagNode name="wwan" owner="${vyos_conf_scripts_dir}/interfaces-wwan.py">
+      <tagNode name="wwan" owner="${vyos_conf_scripts_dir}/interfaces_wwan.py">
         <properties>
           <help>Wireless Modem (WWAN) Interface</help>
           <priority>350</priority>
           <completionHelp>
             <script>cd /sys/class/net; if compgen -G "wwan*" > /dev/null; then ls -d wwan*; fi</script>
           </completionHelp>
           <constraint>
             <regex>wwan[0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Wireless Modem interface must be named wwanN</constraintErrorMessage>
           <valueHelp>
             <format>wwanN</format>
             <description>Wireless Wide Area Network interface name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/address-ipv4-ipv6-dhcp.xml.i>
           <leafNode name="apn">
             <properties>
               <help>Access Point Name (APN)</help>
             </properties>
           </leafNode>
           #include <include/interface/dhcp-options.xml.i>
           #include <include/interface/dhcpv6-options.xml.i>
           #include <include/interface/authentication.xml.i>
           #include <include/generic-description.xml.i>
           #include <include/interface/disable.xml.i>
           #include <include/interface/disable-link-detect.xml.i>
           #include <include/interface/mirror.xml.i>
           #include <include/interface/mtu-68-1500.xml.i>
           <leafNode name="mtu">
             <defaultValue>1430</defaultValue>
           </leafNode>
           #include <include/interface/ipv4-options.xml.i>
           #include <include/interface/ipv6-options.xml.i>
           #include <include/interface/dial-on-demand.xml.i>
           #include <include/interface/redirect.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/load-balancing-haproxy.xml.in b/interface-definitions/load-balancing_reverse-proxy.xml.in
similarity index 99%
rename from interface-definitions/load-balancing-haproxy.xml.in
rename to interface-definitions/load-balancing_reverse-proxy.xml.in
index 8f6bd3a99..2c2742dff 100644
--- a/interface-definitions/load-balancing-haproxy.xml.in
+++ b/interface-definitions/load-balancing_reverse-proxy.xml.in
@@ -1,254 +1,254 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="load-balancing">
     <children>
-      <node name="reverse-proxy" owner="${vyos_conf_scripts_dir}/load-balancing-haproxy.py">
+      <node name="reverse-proxy" owner="${vyos_conf_scripts_dir}/load-balancing_reverse-proxy.py">
         <properties>
           <help>Configure reverse-proxy</help>
         </properties>
         <children>
           <tagNode name="service">
             <properties>
               <help>Frontend service name</help>
               <constraint>
                 #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
               </constraint>
               <constraintErrorMessage>Server name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="backend">
                 <properties>
                   <help>Backend member</help>
                   <constraint>
                     #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
                   </constraint>
                   <constraintErrorMessage>Backend name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage>
                   <valueHelp>
                     <format>txt</format>
                     <description>Name of reverse-proxy backend system</description>
                   </valueHelp>
                   <completionHelp>
                     <path>load-balancing reverse-proxy backend</path>
                   </completionHelp>
                   <multi/>
                 </properties>
               </leafNode>
               #include <include/generic-description.xml.i>
               #include <include/listen-address.xml.i>
               #include <include/haproxy/mode.xml.i>
               #include <include/port-number.xml.i>
               #include <include/haproxy/rule-frontend.xml.i>
               <leafNode name="redirect-http-to-https">
                 <properties>
                   <help>Redirect HTTP to HTTPS</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <node name="ssl">
                 <properties>
                   <help>SSL Certificate, SSL Key and CA</help>
                 </properties>
                 <children>
                   #include <include/pki/certificate-multi.xml.i>
                 </children>
               </node>
             </children>
           </tagNode>
           <tagNode name="backend">
             <properties>
               <help>Backend server name</help>
               <constraint>
                 #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
               </constraint>
               <constraintErrorMessage>Backend name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="balance">
                 <properties>
                   <help>Load-balancing algorithm</help>
                   <completionHelp>
                     <list>source-address round-robin least-connection</list>
                   </completionHelp>
                   <valueHelp>
                     <format>source-address</format>
                     <description>Based on hash of source IP address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>round-robin</format>
                     <description>Round robin</description>
                   </valueHelp>
                   <valueHelp>
                     <format>least-connection</format>
                     <description>Least connection</description>
                   </valueHelp>
                   <constraint>
                     <regex>(source-address|round-robin|least-connection)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>round-robin</defaultValue>
               </leafNode>
               #include <include/generic-description.xml.i>
               #include <include/haproxy/mode.xml.i>
               <node name="parameters">
                 <properties>
                   <help>Backend parameters</help>
                 </properties>
                 <children>
                   <leafNode name="http-check">
                     <properties>
                       <help>HTTP health check</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               #include <include/haproxy/rule-backend.xml.i>
               <tagNode name="server">
                 <properties>
                   <help>Backend server name</help>
                 </properties>
                 <children>
                   <leafNode name="address">
                     <properties>
                       <help>Backend server address</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 unicast peer address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>IPv6 unicast peer address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ip-address"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="backup">
                     <properties>
                       <help>Use backup server if other servers are not available</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="check">
                     <properties>
                       <help>Active health check backend server</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   #include <include/port-number.xml.i>
                   <leafNode name="send-proxy">
                     <properties>
                       <help>Send a Proxy Protocol version 1 header (text format)</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="send-proxy-v2">
                     <properties>
                       <help>Send a Proxy Protocol version 2 header (binary format)</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <node name="ssl">
                 <properties>
                   <help>SSL Certificate, SSL Key and CA</help>
                 </properties>
                 <children>
                   #include <include/pki/ca-certificate.xml.i>
                 </children>
               </node>
               #include <include/haproxy/timeout.xml.i>
             </children>
           </tagNode>
           <node name="global-parameters">
             <properties>
               <help>Global perfomance parameters and limits</help>
             </properties>
             <children>
               <leafNode name="max-connections">
                 <properties>
                   <help>Maximum allowed connections</help>
                   <valueHelp>
                     <format>u32:1-2000000</format>
                     <description>Maximum allowed connections</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-2000000"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="ssl-bind-ciphers">
                 <properties>
                   <help>Cipher algorithms ("cipher suite") used during SSL/TLS handshake for all frontend servers</help>
                   <completionHelp>
                     <list>ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384</list>
                   </completionHelp>
                   <valueHelp>
                     <format>ecdhe-ecdsa-aes128-gcm-sha256</format>
                     <description>ecdhe-ecdsa-aes128-gcm-sha256</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ecdhe-rsa-aes128-gcm-sha256</format>
                     <description>ecdhe-rsa-aes128-gcm-sha256</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ecdhe-ecdsa-aes256-gcm-sha384</format>
                     <description>ecdhe-ecdsa-aes256-gcm-sha384</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ecdhe-rsa-aes256-gcm-sha384</format>
                     <description>ecdhe-rsa-aes256-gcm-sha384</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ecdhe-ecdsa-chacha20-poly1305</format>
                     <description>ecdhe-ecdsa-chacha20-poly1305</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ecdhe-rsa-chacha20-poly1305</format>
                     <description>ecdhe-rsa-chacha20-poly1305</description>
                   </valueHelp>
                   <valueHelp>
                     <format>dhe-rsa-aes128-gcm-sha256</format>
                     <description>dhe-rsa-aes128-gcm-sha256</description>
                   </valueHelp>
                   <valueHelp>
                     <format>dhe-rsa-aes256-gcm-sha384</format>
                     <description>dhe-rsa-aes256-gcm-sha384</description>
                   </valueHelp>
                   <constraint>
                     <regex>(ecdhe-ecdsa-aes128-gcm-sha256|ecdhe-rsa-aes128-gcm-sha256|ecdhe-ecdsa-aes256-gcm-sha384|ecdhe-rsa-aes256-gcm-sha384|ecdhe-ecdsa-chacha20-poly1305|ecdhe-rsa-chacha20-poly1305|dhe-rsa-aes128-gcm-sha256|dhe-rsa-aes256-gcm-sha384)</regex>
                   </constraint>
                   <multi/>
                 </properties>
                 <defaultValue>ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384</defaultValue>
               </leafNode>
               <leafNode name="tls-version-min">
                 <properties>
                   <help>Specify the minimum required TLS version</help>
                   <completionHelp>
                     <list>1.2 1.3</list>
                   </completionHelp>
                   <valueHelp>
                     <format>1.2</format>
                     <description>TLS v1.2</description>
                   </valueHelp>
                   <valueHelp>
                     <format>1.3</format>
                     <description>TLS v1.3</description>
                   </valueHelp>
                   <constraint>
                     <regex>(1.2|1.3)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>1.3</defaultValue>
               </leafNode>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/load-balancing-wan.xml.in b/interface-definitions/load-balancing_wan.xml.in
similarity index 99%
rename from interface-definitions/load-balancing-wan.xml.in
rename to interface-definitions/load-balancing_wan.xml.in
index c12cab22a..e117fd1b2 100644
--- a/interface-definitions/load-balancing-wan.xml.in
+++ b/interface-definitions/load-balancing_wan.xml.in
@@ -1,399 +1,399 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="load-balancing">
     <properties>
       <help>Configure load-balancing</help>
       <priority>900</priority>
     </properties>
     <children>
-      <node name="wan" owner="${vyos_conf_scripts_dir}/load-balancing-wan.py">
+      <node name="wan" owner="${vyos_conf_scripts_dir}/load-balancing_wan.py">
         <properties>
           <help>Configure Wide Area Network (WAN) load-balancing</help>
         </properties>
         <children>
           <leafNode name="disable-source-nat">
             <properties>
               <help>Disable source NAT rules from being configured for WAN load balancing</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="enable-local-traffic">
             <properties>
               <help>Enable WAN load balancing for locally sourced traffic</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="flush-connections">
             <properties>
               <help>Flush connection tracking tables on connection state change</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="hook">
             <properties>
               <help>Script to be executed on interface status change</help>
               <valueHelp>
                 <format>txt</format>
                 <description>Script in /config/scripts</description>
               </valueHelp>
               <constraint>
                 <validator name="script"/>
               </constraint>
             </properties>
           </leafNode>
           <tagNode name="interface-health">
             <properties>
               <help>Interface name</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
             </properties>
             <children>
               <leafNode name="failure-count">
                 <properties>
                   <help>Failure count</help>
                   <valueHelp>
                     <format>u32:1-10</format>
                     <description>Failure count</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-10"/>
                   </constraint>
                 </properties>
                 <defaultValue>1</defaultValue>
               </leafNode>
               <leafNode name="nexthop">
                 <properties>
                   <help>Outbound interface nexthop address. Can be 'DHCP or IPv4 address' [REQUIRED]</help>
                   <completionHelp>
                     <list>dhcp</list>
                   </completionHelp>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>Nexthop IP address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>dhcp</format>
                     <description>Set the nexthop via DHCP</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                     <regex>(dhcp)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="success-count">
                 <properties>
                   <help>Success count</help>
                   <valueHelp>
                     <format>u32:1-10</format>
                     <description>Success count</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-10"/>
                   </constraint>
                 </properties>
                 <defaultValue>1</defaultValue>
               </leafNode>
               <tagNode name="test">
                 <properties>
                   <help>Rule number</help>
                   <valueHelp>
                     <format>u32:0-4294967295</format>
                     <description>Rule number</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-4294967295"/>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="resp-time">
                     <properties>
                       <help>Ping response time (seconds)</help>
                       <valueHelp>
                         <format>u32:1-30</format>
                         <description>Response time (seconds)</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-30"/>
                       </constraint>
                     </properties>
                     <defaultValue>5</defaultValue>
                   </leafNode>
                   <leafNode name="target">
                     <properties>
                       <help>Health target address</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>Health target address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="test-script">
                     <properties>
                       <help>Path to user-defined script</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Script in /config/scripts</description>
                       </valueHelp>
                       <constraint>
                         <validator name="script"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="ttl-limit">
                     <properties>
                       <help>TTL limit (hop count)</help>
                       <valueHelp>
                         <format>u32:1-254</format>
                         <description>Number of hops</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-254"/>
                       </constraint>
                     </properties>
                     <defaultValue>1</defaultValue>
                   </leafNode>
                   <leafNode name="type">
                     <properties>
                       <help>WLB test type</help>
                       <completionHelp>
                         <list>ping ttl user-defined</list>
                       </completionHelp>
                       <valueHelp>
                         <format>ping</format>
                         <description>Test with ICMP echo response</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ttl</format>
                         <description>Test with UDP TTL expired response</description>
                       </valueHelp>
                       <valueHelp>
                         <format>user-defined</format>
                         <description>User-defined test script</description>
                       </valueHelp>
                       <constraint>
                         <regex>(ping|ttl|user-defined)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>ping</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </tagNode>
           <tagNode name="rule">
             <properties>
               <help>Rule number (1-9999)</help>
               <valueHelp>
                 <format>u32:1-9999</format>
                 <description>Rule number</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-9999"/>
               </constraint>
             </properties>
             <children>
               #include <include/generic-description.xml.i>
               <node name="destination">
                 <properties>
                   <help>Destination</help>
                 </properties>
                 <children>
                   #include <include/ipv4-address-prefix-range.xml.i>
                   #include <include/port-port-range.xml.i>
                 </children>
               </node>
               <leafNode name="exclude">
                 <properties>
                   <help>Exclude packets matching this rule from WAN load balance</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="failover">
                 <properties>
                   <help>Enable failover for packets matching this rule from WAN load balance</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="inbound-interface">
                 <properties>
                   <help>Inbound interface name (e.g., "eth0") [REQUIRED]</help>
                   <completionHelp>
                     <list>any</list>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                 </properties>
               </leafNode>
               <tagNode name="interface">
                 <properties>
                   <help>Interface name [REQUIRED]</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                 </properties>
                 <children>
                   <leafNode name="weight">
                     <properties>
                       <help>Load-balance weight</help>
                       <valueHelp>
                         <format>u32:1-255</format>
                         <description>Interface weight</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-255"/>
                       </constraint>
                       <constraintErrorMessage>Weight must be between 1 and 255</constraintErrorMessage>
                     </properties>
                     <defaultValue>1</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               <node name="limit">
                 <properties>
                   <help>Enable packet limit for this rule</help>
                 </properties>
                 <children>
                   <leafNode name="burst">
                     <properties>
                       <help>Burst limit for matching packets</help>
                       <valueHelp>
                         <format>u32:0-4294967295</format>
                         <description>Burst limit for matching packets</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
                       </constraint>
                     </properties>
                     <defaultValue>5</defaultValue>
                   </leafNode>
                   <leafNode name="period">
                     <properties>
                       <help>Time window for rate calculation</help>
                       <completionHelp>
                         <list>hour minute second</list>
                       </completionHelp>
                       <valueHelp>
                         <format>hour</format>
                         <description>hour</description>
                       </valueHelp>
                       <valueHelp>
                         <format>minute</format>
                         <description>minute</description>
                       </valueHelp>
                       <valueHelp>
                         <format>second</format>
                         <description>second</description>
                       </valueHelp>
                       <constraint>
                         <regex>(hour|minute|second)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>second</defaultValue>
                   </leafNode>
                   <leafNode name="rate">
                     <properties>
                       <help>Number of packets used for rate limit</help>
                       <valueHelp>
                         <format>u32:0-4294967295</format>
                         <description>Number of packets used for rate limit</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
                       </constraint>
                     </properties>
                     <defaultValue>5</defaultValue>
                   </leafNode>
                   <leafNode name="threshold">
                     <properties>
                       <help>Threshold behavior for limit</help>
                       <completionHelp>
                         <list>above below</list>
                       </completionHelp>
                       <valueHelp>
                         <format>above</format>
                         <description>Above limit</description>
                       </valueHelp>
                       <valueHelp>
                         <format>below</format>
                         <description>Below limit</description>
                       </valueHelp>
                       <constraint>
                         <regex>(above|below)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>below</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="per-packet-balancing">
                 <properties>
                   <help>Option to match traffic per-packet instead of the default, per-flow</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="protocol">
                 <properties>
                   <help>Protocol to match (protocol name, number, or "all")</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_protocols.sh</script>
                     <list>all tcp_udp</list>
                   </completionHelp>
                   <valueHelp>
                     <format>all</format>
                     <description>All IP protocols</description>
                   </valueHelp>
                   <valueHelp>
                     <format>tcp_udp</format>
                     <description>Both TCP and UDP</description>
                   </valueHelp>
                   <valueHelp>
                     <format>u32:0-255</format>
                     <description>IP protocol number</description>
                   </valueHelp>
                   <valueHelp>
                     <format>&lt;protocol&gt;</format>
                     <description>IP protocol name</description>
                   </valueHelp>
                   <valueHelp>
                     <format>!&lt;protocol&gt;</format>
                     <description>IP protocol name</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-protocol"/>
                   </constraint>
                 </properties>
                 <defaultValue>all</defaultValue>
               </leafNode>
               <node name="source">
                 <properties>
                   <help>Source information</help>
                 </properties>
                 <children>
                   #include <include/ipv4-address-prefix-range.xml.i>
                   #include <include/port-port-range.xml.i>
                 </children>
               </node>
             </children>
           </tagNode>
           <node name="sticky-connections">
             <properties>
               <help>Configure sticky connections</help>
             </properties>
             <children>
               <leafNode name="inbound">
                 <properties>
                   <help>Enable sticky incoming WAN connections</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/policy-local-route.xml.in b/interface-definitions/policy_local-route.xml.in
similarity index 99%
rename from interface-definitions/policy-local-route.xml.in
rename to interface-definitions/policy_local-route.xml.in
index 15be099c9..7a019154a 100644
--- a/interface-definitions/policy-local-route.xml.in
+++ b/interface-definitions/policy_local-route.xml.in
@@ -1,156 +1,156 @@
 <?xml version="1.0"?>
 <!-- Policy local-route -->
 <interfaceDefinition>
   <node name="policy">
     <children>
-      <node name="local-route" owner="${vyos_conf_scripts_dir}/policy-local-route.py">
+      <node name="local-route" owner="${vyos_conf_scripts_dir}/policy_local-route.py">
         <properties>
           <help>IPv4 policy route of local traffic</help>
           <priority>500</priority>
         </properties>
         <children>
           <tagNode name="rule">
             <properties>
               <help>Policy local-route rule set number</help>
               <valueHelp>
                 <!-- table main with prio 32766 -->
                 <format>u32:1-32765</format>
                 <description>Local-route rule number (1-32765)</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-32765"/>
               </constraint>
             </properties>
             <children>
               <node name="set">
                 <properties>
                   <help>Packet modifications</help>
                 </properties>
                 <children>
                   <leafNode name="table">
                     <properties>
                       <help>Routing table to forward packet with</help>
                       <valueHelp>
                         <format>u32:1-200</format>
                         <description>Table number</description>
                       </valueHelp>
                       <completionHelp>
                         <list>main</list>
                       </completionHelp>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="fwmark">
                 <properties>
                   <help>Match fwmark value</help>
                   <valueHelp>
                     <format>u32:1-2147483647</format>
                     <description>Address to match against</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-2147483647"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/policy/local-route_rule_protocol.xml.i>
               <node name="source">
                 <properties>
                   <help>Source parameters</help>
                 </properties>
                 <children>
                   #include <include/policy/local-route_rule_ipv4_address.xml.i>
                   #include <include/port-number.xml.i>
                 </children>
               </node>
               <node name="destination">
                 <properties>
                   <help>Destination parameters</help>
                 </properties>
                 <children>
                   #include <include/policy/local-route_rule_ipv4_address.xml.i>
                   #include <include/port-number.xml.i>
                 </children>
               </node>
               #include <include/interface/inbound-interface.xml.i>
             </children>
           </tagNode>
         </children>
       </node>
-      <node name="local-route6" owner="${vyos_conf_scripts_dir}/policy-local-route.py">
+      <node name="local-route6" owner="${vyos_conf_scripts_dir}/policy_local-route.py">
         <properties>
           <help>IPv6 policy route of local traffic</help>
           <priority>500</priority>
         </properties>
         <children>
           <tagNode name="rule">
             <properties>
               <help>IPv6 policy local-route rule set number</help>
               <valueHelp>
                 <!-- table main with prio 32766 -->
                 <format>u32:1-32765</format>
                 <description>Local-route rule number (1-32765)</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-32765"/>
               </constraint>
             </properties>
             <children>
               <node name="set">
                 <properties>
                   <help>Packet modifications</help>
                 </properties>
                 <children>
                   <leafNode name="table">
                     <properties>
                       <help>Routing table to forward packet with</help>
                       <valueHelp>
                         <format>u32:1-200</format>
                         <description>Table number</description>
                       </valueHelp>
                       <completionHelp>
                         <list>main</list>
                       </completionHelp>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="fwmark">
                 <properties>
                   <help>Match fwmark value</help>
                   <valueHelp>
                     <format>u32:1-2147483647</format>
                     <description>Address to match against</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-2147483647"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/policy/local-route_rule_protocol.xml.i>
               <node name="source">
                 <properties>
                   <help>Source parameters</help>
                 </properties>
                 <children>
                   #include <include/policy/local-route_rule_ipv6_address.xml.i>
                   #include <include/port-number.xml.i>
                 </children>
               </node>
               <node name="destination">
                 <properties>
                   <help>Destination parameters</help>
                 </properties>
                 <children>
                   #include <include/policy/local-route_rule_ipv6_address.xml.i>
                   #include <include/port-number.xml.i>
                 </children>
               </node>
               #include <include/interface/inbound-interface.xml.i>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/policy-route.xml.in b/interface-definitions/policy_route.xml.in
similarity index 99%
rename from interface-definitions/policy-route.xml.in
rename to interface-definitions/policy_route.xml.in
index 92e7a0cb4..9cc22540b 100644
--- a/interface-definitions/policy-route.xml.in
+++ b/interface-definitions/policy_route.xml.in
@@ -1,117 +1,117 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="policy">
     <children>
-      <tagNode name="route6" owner="${vyos_conf_scripts_dir}/policy-route.py">
+      <tagNode name="route6" owner="${vyos_conf_scripts_dir}/policy_route.py">
         <properties>
           <help>Policy route rule set name for IPv6</help>
           <constraint>
             <regex>[a-zA-Z0-9][\w\-\.]*</regex>
           </constraint>
           <priority>201</priority>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/firewall/default-log.xml.i>
           #include <include/generic-interface-multi-wildcard.xml.i>
           <tagNode name="rule">
             <properties>
               <help>Policy rule number</help>
               <valueHelp>
                 <format>u32:1-999999</format>
                 <description>Number of policy rule</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-999999"/>
               </constraint>
               <constraintErrorMessage>Policy rule number must be between 1 and 999999</constraintErrorMessage>
             </properties>
             <children>
               <node name="destination">
                 <properties>
                   <help>Destination parameters</help>
                 </properties>
                 <children>
                   #include <include/firewall/address-ipv6.xml.i>
                   #include <include/firewall/source-destination-group-ipv6.xml.i>
                   #include <include/firewall/port.xml.i>
                 </children>
               </node>
               <node name="source">
                 <properties>
                   <help>Source parameters</help>
                 </properties>
                 <children>
                   #include <include/firewall/address-ipv6.xml.i>
                   #include <include/firewall/source-destination-group-ipv6.xml.i>
                   #include <include/firewall/port.xml.i>
                 </children>
               </node>
               #include <include/policy/route-common.xml.i>
               #include <include/policy/route-ipv6.xml.i>
               #include <include/firewall/dscp.xml.i>
               #include <include/firewall/packet-options.xml.i>
               #include <include/firewall/hop-limit.xml.i>
               #include <include/firewall/connection-mark.xml.i>
             </children>
           </tagNode>
         </children>
       </tagNode>
-      <tagNode name="route" owner="${vyos_conf_scripts_dir}/policy-route.py">
+      <tagNode name="route" owner="${vyos_conf_scripts_dir}/policy_route.py">
         <properties>
           <help>Policy route rule set name for IPv4</help>
           <constraint>
             <regex>[a-zA-Z0-9][\w\-\.]*</regex>
           </constraint>
           <priority>201</priority>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/firewall/default-log.xml.i>
           #include <include/generic-interface-multi-wildcard.xml.i>
           <tagNode name="rule">
             <properties>
               <help>Policy rule number</help>
               <valueHelp>
                 <format>u32:1-999999</format>
                 <description>Number of policy rule</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-999999"/>
               </constraint>
               <constraintErrorMessage>Policy rule number must be between 1 and 999999</constraintErrorMessage>
             </properties>
             <children>
               <node name="destination">
                 <properties>
                   <help>Destination parameters</help>
                 </properties>
                 <children>
                   #include <include/firewall/address.xml.i>
                   #include <include/firewall/source-destination-group.xml.i>
                   #include <include/firewall/port.xml.i>
                 </children>
               </node>
               <node name="source">
                 <properties>
                   <help>Source parameters</help>
                 </properties>
                 <children>
                   #include <include/firewall/address.xml.i>
                   #include <include/firewall/source-destination-group.xml.i>
                   #include <include/firewall/port.xml.i>
                 </children>
               </node>
               #include <include/policy/route-common.xml.i>
               #include <include/policy/route-ipv4.xml.i>
               #include <include/firewall/dscp.xml.i>
               #include <include/firewall/packet-options.xml.i>
               #include <include/firewall/ttl.xml.i>
               #include <include/firewall/connection-mark.xml.i>
             </children>
           </tagNode>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/protocols-babel.xml.in b/interface-definitions/protocols_babel.xml.in
similarity index 100%
rename from interface-definitions/protocols-babel.xml.in
rename to interface-definitions/protocols_babel.xml.in
diff --git a/interface-definitions/protocols-bfd.xml.in b/interface-definitions/protocols_bfd.xml.in
similarity index 100%
rename from interface-definitions/protocols-bfd.xml.in
rename to interface-definitions/protocols_bfd.xml.in
diff --git a/interface-definitions/protocols-bgp.xml.in b/interface-definitions/protocols_bgp.xml.in
similarity index 100%
rename from interface-definitions/protocols-bgp.xml.in
rename to interface-definitions/protocols_bgp.xml.in
diff --git a/interface-definitions/protocols-eigrp.xml.in b/interface-definitions/protocols_eigrp.xml.in
similarity index 100%
rename from interface-definitions/protocols-eigrp.xml.in
rename to interface-definitions/protocols_eigrp.xml.in
diff --git a/interface-definitions/protocols-failover.xml.in b/interface-definitions/protocols_failover.xml.in
similarity index 100%
rename from interface-definitions/protocols-failover.xml.in
rename to interface-definitions/protocols_failover.xml.in
diff --git a/interface-definitions/igmp-proxy.xml.in b/interface-definitions/protocols_igmp-proxy.xml.in
similarity index 97%
rename from interface-definitions/igmp-proxy.xml.in
rename to interface-definitions/protocols_igmp-proxy.xml.in
index 0eea85060..5cde484f5 100644
--- a/interface-definitions/igmp-proxy.xml.in
+++ b/interface-definitions/protocols_igmp-proxy.xml.in
@@ -1,97 +1,97 @@
 <?xml version="1.0"?>
 <!-- IGMP Proxy  configuration -->
 <interfaceDefinition>
   <node name="protocols">
     <children>
-      <node name="igmp-proxy" owner="${vyos_conf_scripts_dir}/igmp_proxy.py">
+      <node name="igmp-proxy" owner="${vyos_conf_scripts_dir}/protocols_igmp-proxy.py">
         <properties>
           <help>Internet Group Management Protocol (IGMP) proxy parameters</help>
           <priority>740</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           <leafNode name="disable-quickleave">
             <properties>
               <help>Option to disable "quickleave"</help>
               <valueless/>
             </properties>
           </leafNode>
           <tagNode name="interface">
             <properties>
               <help>Interface for IGMP proxy</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
             </properties>
             <children>
               <leafNode name="alt-subnet">
                 <properties>
                   <help>Unicast source networks allowed for multicast traffic to be proxyed</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 network</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="role">
                 <properties>
                   <help>IGMP interface role</help>
                   <completionHelp>
                     <list>upstream downstream disabled</list>
                   </completionHelp>
                   <valueHelp>
                     <format>upstream</format>
                     <description>Upstream interface (only 1 allowed)</description>
                   </valueHelp>
                   <valueHelp>
                     <format>downstream</format>
                     <description>Downstream interface(s)</description>
                   </valueHelp>
                   <valueHelp>
                     <format>disabled</format>
                     <description>Disabled interface</description>
                   </valueHelp>
                   <constraint>
                     <regex>(upstream|downstream|disabled)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>downstream</defaultValue>
               </leafNode>
               <leafNode name="threshold">
                 <properties>
                   <help>TTL threshold</help>
                   <valueHelp>
                     <format>u32:1-255</format>
                     <description>TTL threshold for the interfaces</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-255"/>
                   </constraint>
                   <constraintErrorMessage>Threshold must be between 1 and 255</constraintErrorMessage>
                 </properties>
                 <defaultValue>1</defaultValue>
               </leafNode>
               <leafNode name="whitelist">
                 <properties>
                   <help>Group to whitelist</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 network</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/protocols-isis.xml.in b/interface-definitions/protocols_isis.xml.in
similarity index 100%
rename from interface-definitions/protocols-isis.xml.in
rename to interface-definitions/protocols_isis.xml.in
diff --git a/interface-definitions/protocols-mpls.xml.in b/interface-definitions/protocols_mpls.xml.in
similarity index 100%
rename from interface-definitions/protocols-mpls.xml.in
rename to interface-definitions/protocols_mpls.xml.in
diff --git a/interface-definitions/protocols-nhrp.xml.in b/interface-definitions/protocols_nhrp.xml.in
similarity index 100%
rename from interface-definitions/protocols-nhrp.xml.in
rename to interface-definitions/protocols_nhrp.xml.in
diff --git a/interface-definitions/protocols-ospf.xml.in b/interface-definitions/protocols_ospf.xml.in
similarity index 100%
rename from interface-definitions/protocols-ospf.xml.in
rename to interface-definitions/protocols_ospf.xml.in
diff --git a/interface-definitions/protocols-ospfv3.xml.in b/interface-definitions/protocols_ospfv3.xml.in
similarity index 100%
rename from interface-definitions/protocols-ospfv3.xml.in
rename to interface-definitions/protocols_ospfv3.xml.in
diff --git a/interface-definitions/protocols-pim.xml.in b/interface-definitions/protocols_pim.xml.in
similarity index 100%
rename from interface-definitions/protocols-pim.xml.in
rename to interface-definitions/protocols_pim.xml.in
diff --git a/interface-definitions/protocols-pim6.xml.in b/interface-definitions/protocols_pim6.xml.in
similarity index 100%
rename from interface-definitions/protocols-pim6.xml.in
rename to interface-definitions/protocols_pim6.xml.in
diff --git a/interface-definitions/protocols-rip.xml.in b/interface-definitions/protocols_rip.xml.in
similarity index 100%
rename from interface-definitions/protocols-rip.xml.in
rename to interface-definitions/protocols_rip.xml.in
diff --git a/interface-definitions/protocols-ripng.xml.in b/interface-definitions/protocols_ripng.xml.in
similarity index 100%
rename from interface-definitions/protocols-ripng.xml.in
rename to interface-definitions/protocols_ripng.xml.in
diff --git a/interface-definitions/protocols-rpki.xml.in b/interface-definitions/protocols_rpki.xml.in
similarity index 100%
rename from interface-definitions/protocols-rpki.xml.in
rename to interface-definitions/protocols_rpki.xml.in
diff --git a/interface-definitions/protocols-segment-routing.xml.in b/interface-definitions/protocols_segment-routing.xml.in
similarity index 99%
rename from interface-definitions/protocols-segment-routing.xml.in
rename to interface-definitions/protocols_segment-routing.xml.in
index 4308f0c91..c299f624e 100644
--- a/interface-definitions/protocols-segment-routing.xml.in
+++ b/interface-definitions/protocols_segment-routing.xml.in
@@ -1,137 +1,137 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="protocols">
     <children>
-       <node name="segment-routing" owner="${vyos_conf_scripts_dir}/protocols_segment_routing.py">
+       <node name="segment-routing" owner="${vyos_conf_scripts_dir}/protocols_segment-routing.py">
         <properties>
           <help>Segment Routing</help>
           <priority>900</priority>
         </properties>
         <children>
           <tagNode name="interface">
             <properties>
               <help>Interface specific Segment Routing options</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Interface name</description>
               </valueHelp>
               <constraint>
                 #include <include/constraint/interface-name.xml.i>
               </constraint>
             </properties>
             <children>
               <node name="srv6">
                 <properties>
                   <help>Accept SR-enabled IPv6 packets on this interface</help>
                 </properties>
                 <children>
                   <leafNode name="hmac">
                     <properties>
                       <help>Define HMAC policy for ingress SR-enabled packets on this interface</help>
                       <completionHelp>
                         <list>accept drop ignore</list>
                       </completionHelp>
                       <valueHelp>
                         <format>accept</format>
                         <description>Accept packets without HMAC, validate packets with HMAC</description>
                       </valueHelp>
                       <valueHelp>
                         <format>drop</format>
                         <description>Drop packets without HMAC, validate packets with HMAC</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ignore</format>
                         <description>Ignore HMAC field.</description>
                       </valueHelp>
                       <constraint>
                         <regex>(accept|drop|ignore)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>accept</defaultValue>
                   </leafNode>
                 </children>
               </node>
             </children>
           </tagNode>
           <node name="srv6">
             <properties>
               <help>Segment-Routing SRv6 configuration</help>
             </properties>
             <children>
               <tagNode name="locator">
                 <properties>
                   <help>Segment Routing SRv6 locator</help>
                   <constraint>
                     #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="behavior-usid">
                     <properties>
                       <help>Set SRv6 behavior uSID</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="prefix">
                     <properties>
                       <help>SRv6 locator prefix</help>
                       <valueHelp>
                         <format>ipv6net</format>
                         <description>SRv6 locator prefix</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv6-prefix"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="block-len">
                     <properties>
                       <help>Configure SRv6 locator block length in bits</help>
                       <valueHelp>
                         <format>u32:16-64</format>
                         <description>Specify SRv6 locator block length in bits</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 16-64"/>
                       </constraint>
                     </properties>
                     <defaultValue>40</defaultValue>
                   </leafNode>
                   <leafNode name="func-bits">
                     <properties>
                       <help>Configure SRv6 locator function length in bits</help>
                       <valueHelp>
                         <format>u32:0-64</format>
                         <description>Specify SRv6 locator function length in bits</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-64"/>
                       </constraint>
                     </properties>
                     <defaultValue>16</defaultValue>
                   </leafNode>
                   <leafNode name="node-len">
                     <properties>
                       <help>Configure SRv6 locator node length in bits</help>
                       <valueHelp>
                         <format>u32:16-64</format>
                         <description>Configure SRv6 locator node length in bits</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 16-64"/>
                       </constraint>
                     </properties>
                     <defaultValue>24</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/protocols-static.xml.in b/interface-definitions/protocols_static.xml.in
similarity index 100%
rename from interface-definitions/protocols-static.xml.in
rename to interface-definitions/protocols_static.xml.in
diff --git a/interface-definitions/protocols-static-arp.xml.in b/interface-definitions/protocols_static_arp.xml.in
similarity index 95%
rename from interface-definitions/protocols-static-arp.xml.in
rename to interface-definitions/protocols_static_arp.xml.in
index 4b338df63..05c69f1ed 100644
--- a/interface-definitions/protocols-static-arp.xml.in
+++ b/interface-definitions/protocols_static_arp.xml.in
@@ -1,51 +1,51 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="protocols">
     <children>
       <node name="static">
         <children>
-          <node name="arp" owner="${vyos_conf_scripts_dir}/arp.py">
+          <node name="arp" owner="${vyos_conf_scripts_dir}/protocols_static_arp.py">
             <properties>
               <help>Static ARP translation</help>
             </properties>
             <children>
               <tagNode name="interface">
                 <properties>
                   <help>Interface configuration</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                   <valueHelp>
                     <format>txt</format>
                     <description>Interface name</description>
                   </valueHelp>
                   <constraint>
                     #include <include/constraint/interface-name.xml.i>
                   </constraint>
                 </properties>
                 <children>
                   <tagNode name="address">
                     <properties>
                       <help>IP address for static ARP entry</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 destination address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                     </properties>
                     <children>
                       #include <include/generic-description.xml.i>
                       #include <include/interface/mac.xml.i>
                     </children>
                   </tagNode>
                 </children>
               </tagNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/protocols-multicast.xml.in b/interface-definitions/protocols_static_multicast.xml.in
similarity index 100%
rename from interface-definitions/protocols-multicast.xml.in
rename to interface-definitions/protocols_static_multicast.xml.in
diff --git a/interface-definitions/service-aws-glb.xml.in b/interface-definitions/service_aws_glb.xml.in
similarity index 100%
rename from interface-definitions/service-aws-glb.xml.in
rename to interface-definitions/service_aws_glb.xml.in
diff --git a/interface-definitions/bcast-relay.xml.in b/interface-definitions/service_broadcast-relay.xml.in
similarity index 98%
rename from interface-definitions/bcast-relay.xml.in
rename to interface-definitions/service_broadcast-relay.xml.in
index e2993f3f3..2e4330e20 100644
--- a/interface-definitions/bcast-relay.xml.in
+++ b/interface-definitions/service_broadcast-relay.xml.in
@@ -1,46 +1,46 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="broadcast-relay" owner="${vyos_conf_scripts_dir}/bcast_relay.py">
+      <node name="broadcast-relay" owner="${vyos_conf_scripts_dir}/service_broadcast-relay.py">
         <properties>
           <help>UDP broadcast relay service</help>
           <priority>990</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           <tagNode name="id">
             <properties>
               <help>Unique ID for each UDP port to forward</help>
               <valueHelp>
                 <format>u32:1-99</format>
                 <description>Broadcast relay instance ID</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-99"/>
               </constraint>
             </properties>
             <children>
               #include <include/generic-disable-node.xml.i>
               <leafNode name="address">
                 <properties>
                   <help>Set source IP of forwarded packets, otherwise original senders address is used</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>Optional source address for forwarded packets</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/generic-description.xml.i>
               #include <include/generic-interface-multi.xml.i>
               #include <include/port-number.xml.i>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-config-sync.xml.in b/interface-definitions/service_config-sync.xml.in
similarity index 99%
rename from interface-definitions/service-config-sync.xml.in
rename to interface-definitions/service_config-sync.xml.in
index e804e17f7..9955acfee 100644
--- a/interface-definitions/service-config-sync.xml.in
+++ b/interface-definitions/service_config-sync.xml.in
@@ -1,104 +1,104 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="config-sync" owner="${vyos_conf_scripts_dir}/service_config_sync.py">
+      <node name="config-sync" owner="${vyos_conf_scripts_dir}/service_config-sync.py">
         <properties>
           <help>Configuration synchronization</help>
         </properties>
         <children>
           <node name="secondary">
             <properties>
               <help>Secondary server parameters</help>
             </properties>
             <children>
               <leafNode name="address">
                 <properties>
                   <help>IP address</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 address to match</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address to match</description>
                   </valueHelp>
                   <valueHelp>
                     <format>hostname</format>
                     <description>FQDN address to match</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                     <validator name="ipv6-address"/>
                     <validator name="fqdn"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="timeout">
                 <properties>
                   <help>Connection API timeout</help>
                   <valueHelp>
                     <format>u32:1-300</format>
                     <description>Connection API timeout</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-300"/>
                   </constraint>
                 </properties>
                 <defaultValue>60</defaultValue>
               </leafNode>
               <leafNode name="key">
                 <properties>
                   <help>HTTP API key</help>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="mode">
             <properties>
               <help>Synchronization mode</help>
               <completionHelp>
                 <list>load set</list>
               </completionHelp>
               <valueHelp>
                 <format>load</format>
                 <description>Load and replace configuration section</description>
               </valueHelp>
               <valueHelp>
                 <format>set</format>
                 <description>Set configuration section</description>
               </valueHelp>
               <constraint>
                 <regex>(load|set)</regex>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="section">
             <properties>
               <help>Section for synchronization</help>
               <completionHelp>
                 <list>nat nat66 firewall</list>
               </completionHelp>
               <valueHelp>
                 <format>nat</format>
                 <description>NAT</description>
               </valueHelp>
               <valueHelp>
                 <format>nat66</format>
                 <description>NAT66</description>
               </valueHelp>
               <valueHelp>
                 <format>firewall</format>
                 <description>firewall</description>
               </valueHelp>
               <constraint>
                 <regex>(nat|nat66|firewall)</regex>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in
similarity index 99%
rename from interface-definitions/service-conntrack-sync.xml.in
rename to interface-definitions/service_conntrack-sync.xml.in
index 50a4bf62f..46dc8adc0 100644
--- a/interface-definitions/service-conntrack-sync.xml.in
+++ b/interface-definitions/service_conntrack-sync.xml.in
@@ -1,173 +1,173 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="conntrack-sync" owner="${vyos_conf_scripts_dir}/conntrack_sync.py">
+      <node name="conntrack-sync" owner="${vyos_conf_scripts_dir}/service_conntrack-sync.py">
         <properties>
           <help>Connection tracking synchronization</help>
           <!-- before VRRP / HA -->
           <priority>799</priority>
         </properties>
         <children>
           <leafNode name="accept-protocol">
             <properties>
               <help>Protocols for which local conntrack entries will be synced</help>
               <completionHelp>
                 <list>tcp udp icmp icmp6 sctp dccp</list>
               </completionHelp>
               <valueHelp>
                 <format>tcp</format>
                 <description>Sync Transmission Control Protocol entries</description>
               </valueHelp>
               <valueHelp>
                 <format>udp</format>
                 <description>Sync User Datagram Protocol entries</description>
               </valueHelp>
               <valueHelp>
                 <format>icmp</format>
                 <description>Sync Internet Control Message Protocol entries</description>
               </valueHelp>
               <valueHelp>
                 <format>icmp6</format>
                 <description>Sync IPv6 Internet Control Message Protocol entries</description>
               </valueHelp>
               <valueHelp>
                 <format>sctp</format>
                 <description>Sync Stream Control Transmission Protocol entries</description>
               </valueHelp>
               <valueHelp>
                 <format>dccp</format>
                 <description>Sync Datagram Congestion Control Protocol entries</description>
               </valueHelp>
               <constraint>
                 <regex>(tcp|udp|icmp|icmp6|sctp|dccp)</regex>
               </constraint>
               <constraintErrorMessage>Allowed protocols: tcp udp icmp or sctp</constraintErrorMessage>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="disable-external-cache">
             <properties>
               <help>Directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall.</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="event-listen-queue-size">
             <properties>
               <help>Queue size for local conntrack events</help>
               <valueHelp>
                 <format>u32</format>
                 <description>Queue size in MB</description>
               </valueHelp>
             </properties>
             <defaultValue>8</defaultValue>
           </leafNode>
           <leafNode name="expect-sync">
             <properties>
               <help>Protocol for which expect entries need to be synchronized</help>
               <completionHelp>
                 <list>all ftp sip h323 nfs sqlnet</list>
               </completionHelp>
               <constraint>
                 <regex>(all|ftp|sip|h323|nfs|sqlnet)</regex>
               </constraint>
               <constraintErrorMessage>Invalid protocol</constraintErrorMessage>
               <multi/>
             </properties>
           </leafNode>
           <node name="failover-mechanism">
             <properties>
               <help>Failover mechanism to use for conntrack-sync</help>
             </properties>
             <children>
               <node name="vrrp">
                 <properties>
                   <help>VRRP as failover-mechanism to use for conntrack-sync</help>
                 </properties>
                 <children>
                   <leafNode name="sync-group">
                     <properties>
                       <help>VRRP sync group</help>
                       <completionHelp>
                         <path>high-availability vrrp sync-group</path>
                       </completionHelp>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           <leafNode name="ignore-address">
             <properties>
               <help>IP addresses for which local conntrack entries will not be synced</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 address to ignore</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv4net</format>
                 <description>IPv4 prefix to ignore</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address to ignore</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6net</format>
                 <description>IPv6 prefix to ignore</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4"/>
                 <validator name="ipv6"/>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <tagNode name="interface">
             <properties>
               <help>Interface to use for syncing conntrack entries</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces --bridgeable</script>
               </completionHelp>
             </properties>
             <children>
               <leafNode name="peer">
                 <properties>
                   <help>IP address of the peer to send the UDP conntrack info too. This disable multicast.</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IP address to listen for incoming connections</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/port-number.xml.i>
             </children>
           </tagNode>
           #include <include/listen-address-ipv4.xml.i>
           <leafNode name="mcast-group">
             <properties>
               <help>Multicast group to use for syncing conntrack entries</help>
               <constraint>
                 <validator name="ipv4-multicast"/>
               </constraint>
             </properties>
             <defaultValue>225.0.0.50</defaultValue>
           </leafNode>
           <leafNode name="sync-queue-size">
             <properties>
               <help>Queue size for syncing conntrack entries</help>
               <valueHelp>
                 <format>u32</format>
                 <description>Queue size in MB</description>
               </valueHelp>
             </properties>
             <defaultValue>1</defaultValue>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-console-server.xml.in b/interface-definitions/service_console-server.xml.in
similarity index 100%
rename from interface-definitions/service-console-server.xml.in
rename to interface-definitions/service_console-server.xml.in
diff --git a/interface-definitions/dhcp-relay.xml.in b/interface-definitions/service_dhcp-relay.xml.in
similarity index 98%
rename from interface-definitions/dhcp-relay.xml.in
rename to interface-definitions/service_dhcp-relay.xml.in
index 42715c9bb..9fdd9581d 100644
--- a/interface-definitions/dhcp-relay.xml.in
+++ b/interface-definitions/service_dhcp-relay.xml.in
@@ -1,126 +1,126 @@
 <?xml version="1.0"?>
 <!-- DHCP relay configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="dhcp-relay" owner="${vyos_conf_scripts_dir}/dhcp_relay.py">
+      <node name="dhcp-relay" owner="${vyos_conf_scripts_dir}/service_dhcp-relay.py">
         <properties>
           <help>Host Configuration Protocol (DHCP) relay agent</help>
           <priority>910</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           #include <include/generic-interface-multi-broadcast.xml.i>
           <leafNode name="listen-interface">
             <properties>
               <help>Interface for DHCP Relay Agent to listen for requests</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Interface name</description>
               </valueHelp>
               <constraint>
                 #include <include/constraint/interface-name.xml.i>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="upstream-interface">
             <properties>
               <help>Interface for DHCP Relay Agent forward requests out</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Interface name</description>
               </valueHelp>
               <constraint>
                 #include <include/constraint/interface-name.xml.i>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <node name="relay-options">
             <properties>
               <help>Relay options</help>
             </properties>
             <children>
               <leafNode name="hop-count">
                 <properties>
                   <help>Policy to discard packets that have reached specified hop-count</help>
                   <valueHelp>
                     <format>u32:1-255</format>
                     <description>Hop count</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-255"/>
                   </constraint>
                   <constraintErrorMessage>hop-count must be a value between 1 and 255</constraintErrorMessage>
                 </properties>
                 <defaultValue>10</defaultValue>
               </leafNode>
               <leafNode name="max-size">
                 <properties>
                   <help>Maximum packet size to send to a DHCPv4/BOOTP server</help>
                   <valueHelp>
                     <format>u32:64-1400</format>
                     <description>Maximum packet size</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 64-1400"/>
                   </constraint>
                   <constraintErrorMessage>max-size must be a value between 64 and 1400</constraintErrorMessage>
                 </properties>
                 <defaultValue>576</defaultValue>
               </leafNode>
               <leafNode name="relay-agents-packets">
                 <properties>
                   <help>Policy to handle incoming DHCPv4 packets which already contain relay agent options</help>
                   <completionHelp>
                     <list>append replace forward discard</list>
                   </completionHelp>
                   <valueHelp>
                     <format>append</format>
                     <description>append own relay options to packet</description>
                   </valueHelp>
                   <valueHelp>
                     <format>replace</format>
                     <description>replace existing agent option field</description>
                   </valueHelp>
                   <valueHelp>
                     <format>forward</format>
                     <description>forward packet unchanged</description>
                   </valueHelp>
                   <valueHelp>
                     <format>discard</format>
                     <description>discard packet (default action if giaddr not set in packet)</description>
                   </valueHelp>
                   <constraint>
                     <regex>(append|replace|forward|discard)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>forward</defaultValue>
               </leafNode>
             </children>
           </node>
           <leafNode name="server">
             <properties>
               <help>DHCP server address</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>DHCP server IPv4 address</description>
               </valueHelp>
               <multi/>
               <constraint>
                 <validator name="ipv4-address"/>
               </constraint>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/dhcp-server.xml.in b/interface-definitions/service_dhcp-server.xml.in
similarity index 99%
rename from interface-definitions/dhcp-server.xml.in
rename to interface-definitions/service_dhcp-server.xml.in
index 8aaeeb29d..e35d845f1 100644
--- a/interface-definitions/dhcp-server.xml.in
+++ b/interface-definitions/service_dhcp-server.xml.in
@@ -1,456 +1,456 @@
 <?xml version="1.0"?>
 <!-- DHCP server configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="dhcp-server" owner="${vyos_conf_scripts_dir}/dhcp_server.py">
+      <node name="dhcp-server" owner="${vyos_conf_scripts_dir}/service_dhcp-server.py">
         <properties>
           <help>Dynamic Host Configuration Protocol (DHCP) for DHCP server</help>
           <priority>911</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           <leafNode name="dynamic-dns-update">
             <properties>
               <help>Dynamically update Domain Name System (RFC4702)</help>
               <valueless/>
             </properties>
           </leafNode>
           <node name="failover">
             <properties>
               <help>DHCP failover configuration</help>
             </properties>
             <children>
               #include <include/source-address-ipv4.xml.i>
               <leafNode name="remote">
                 <properties>
                   <help>IPv4 remote address used for connectio</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 address of failover peer</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="name">
                 <properties>
                   <help>Peer name used to identify connection</help>
                   <constraint>
                     <regex>[-_a-zA-Z0-9.]+</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid failover peer name. May only contain letters, numbers and .-_</constraintErrorMessage>
                 </properties>
               </leafNode>
               <leafNode name="status">
                 <properties>
                   <help>Failover hierarchy</help>
                   <completionHelp>
                     <list>primary secondary</list>
                   </completionHelp>
                   <valueHelp>
                     <format>primary</format>
                     <description>Configure this server to be the primary node</description>
                   </valueHelp>
                   <valueHelp>
                     <format>secondary</format>
                     <description>Configure this server to be the secondary node</description>
                   </valueHelp>
                   <constraint>
                     <regex>(primary|secondary)</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid DHCP failover peer status</constraintErrorMessage>
                 </properties>
               </leafNode>
               #include <include/pki/ca-certificate.xml.i>
               #include <include/pki/certificate.xml.i>
             </children>
           </node>
           <leafNode name="hostfile-update">
             <properties>
               <help>Updating /etc/hosts file (per client lease)</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/listen-address-ipv4.xml.i>
           <tagNode name="shared-network-name">
             <properties>
               <help>Name of DHCP shared network</help>
               <constraint>
                 <regex>[-_a-zA-Z0-9.]+</regex>
               </constraint>
               <constraintErrorMessage>Invalid shared network name. May only contain letters, numbers and .-_</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="authoritative">
                 <properties>
                   <help>Option to make DHCP server authoritative for this physical network</help>
                   <valueless/>
                 </properties>
               </leafNode>
               #include <include/dhcp/domain-name.xml.i>
               #include <include/dhcp/domain-search.xml.i>
               #include <include/dhcp/ntp-server.xml.i>
               #include <include/generic-description.xml.i>
               #include <include/generic-disable-node.xml.i>
               #include <include/name-server-ipv4.xml.i>
               <tagNode name="subnet">
                 <properties>
                   <help>DHCP subnet for shared network</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 address and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-prefix"/>
                   </constraint>
                   <constraintErrorMessage>Invalid IPv4 subnet definition</constraintErrorMessage>
                 </properties>
                 <children>
                   <leafNode name="bootfile-name">
                     <properties>
                       <help>Bootstrap file name</help>
                       <constraint>
                         <regex>[[:ascii:]]{1,253}</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="bootfile-server">
                     <properties>
                       <help>Server from which the initial boot file is to be loaded</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>Bootfile server IPv4 address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>hostname</format>
                         <description>Bootfile server FQDN</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                         <validator name="fqdn"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="bootfile-size">
                     <properties>
                       <help>Bootstrap file size</help>
                       <valueHelp>
                         <format>u32:1-16</format>
                         <description>Bootstrap file size in 512 byte blocks</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-16"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/dhcp/captive-portal.xml.i>
                   <leafNode name="client-prefix-length">
                     <properties>
                       <help>Specifies the clients subnet mask as per RFC 950. If unset, subnet declaration is used.</help>
                       <valueHelp>
                         <format>u32:0-32</format>
                         <description>DHCP client prefix length must be 0 to 32</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-32"/>
                       </constraint>
                       <constraintErrorMessage>DHCP client prefix length must be 0 to 32</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="default-router">
                     <properties>
                       <help>IP address of default router</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>Default router IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/dhcp/domain-name.xml.i>
                   #include <include/dhcp/domain-search.xml.i>
                   #include <include/generic-description.xml.i>
                   #include <include/name-server-ipv4.xml.i>
                   <leafNode name="exclude">
                     <properties>
                       <help>IP address to exclude from DHCP lease range</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 address to exclude from lease range</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="ip-forwarding">
                     <properties>
                       <help>Enable IP forwarding on client</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="lease">
                     <properties>
                       <help>Lease timeout in seconds</help>
                       <valueHelp>
                         <format>u32</format>
                         <description>DHCP lease time in seconds</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
                       </constraint>
                       <constraintErrorMessage>DHCP lease time must be between 0 and 4294967295 (49 days)</constraintErrorMessage>
                     </properties>
                     <defaultValue>86400</defaultValue>
                   </leafNode>
                   #include <include/dhcp/ntp-server.xml.i>
                   <leafNode name="pop-server">
                     <properties>
                       <help>IP address of POP3 server</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>POP3 server IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="server-identifier">
                     <properties>
                       <help>Address for DHCP server identifier</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>DHCP server identifier IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="smtp-server">
                     <properties>
                       <help>IP address of SMTP server</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>SMTP server IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <tagNode name="range">
                     <properties>
                       <help>DHCP lease range</help>
                       <constraint>
                         <regex>[-_a-zA-Z0-9.]+</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid range name, may only be alphanumeric, dot and hyphen</constraintErrorMessage>
                     </properties>
                     <children>
                       <leafNode name="start">
                         <properties>
                           <help>First IP address for DHCP lease range</help>
                           <valueHelp>
                             <format>ipv4</format>
                             <description>IPv4 start address of pool</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv4-address"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="stop">
                         <properties>
                           <help>Last IP address for DHCP lease range</help>
                           <valueHelp>
                             <format>ipv4</format>
                             <description>IPv4 end address of pool</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv4-address"/>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                   <tagNode name="static-mapping">
                     <properties>
                       <help>Hostname for static mapping reservation</help>
                       <constraint>
                         <validator name="fqdn"/>
                       </constraint>
                       <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage>
                     </properties>
                     <children>
                       #include <include/generic-disable-node.xml.i>
                       <leafNode name="ip-address">
                         <properties>
                           <help>Fixed IP address of static mapping</help>
                           <valueHelp>
                             <format>ipv4</format>
                             <description>IPv4 address used in static mapping</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv4-address"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       #include <include/interface/mac.xml.i>
                       #include <include/interface/duid.xml.i>
                     </children>
                   </tagNode>
                   <tagNode name="static-route">
                     <properties>
                       <help>Classless static route destination subnet</help>
                       <valueHelp>
                         <format>ipv4net</format>
                         <description>IPv4 address and prefix length</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-prefix"/>
                       </constraint>
                     </properties>
                     <children>
                       <leafNode name="next-hop">
                         <properties>
                           <help>IP address of router to be used to reach the destination subnet</help>
                           <valueHelp>
                             <format>ipv4</format>
                             <description>IPv4 address of router</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ip-address"/>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode >
                   <leafNode name="ipv6-only-preferred">
                     <properties>
                       <help>Disable IPv4 on IPv6 only hosts (RFC 8925)</help>
                       <valueHelp>
                         <format>u32</format>
                         <description>Seconds</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
                       </constraint>
                       <constraintErrorMessage>Seconds must be between 0 and 4294967295 (49 days)</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="tftp-server-name">
                     <properties>
                       <help>TFTP server name</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>TFTP server IPv4 address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>hostname</format>
                         <description>TFTP server FQDN</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                         <validator name="fqdn"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="time-offset">
                     <properties>
                       <help>Client subnet offset in seconds from Coordinated Universal Time (UTC)</help>
                       <valueHelp>
                         <format>[-]N</format>
                         <description>Time offset (number, may be negative)</description>
                       </valueHelp>
                       <constraint>
                         <regex>-?[0-9]+</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid time offset value</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="time-server">
                     <properties>
                       <help>IP address of time server</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>Time server IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="time-zone">
                     <properties>
                       <help>Time zone to send to clients. Uses RFC4833 options 100 and 101</help>
                       <completionHelp>
                         <script>timedatectl list-timezones</script>
                       </completionHelp>
                       <constraint>
                         <validator name="timezone" argument="--validate"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <node name="vendor-option">
                     <properties>
                       <help>Vendor Specific Options</help>
                     </properties>
                     <children>
                       <node name="ubiquiti">
                         <properties>
                           <help>Ubiquiti specific parameters</help>
                         </properties>
                         <children>
                           <leafNode name="unifi-controller">
                             <properties>
                               <help>Address of UniFi controller</help>
                               <valueHelp>
                                 <format>ipv4</format>
                                 <description>IP address of UniFi controller</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="ipv4-address"/>
                               </constraint>
                             </properties>
                           </leafNode>
                         </children>
                       </node>
                     </children>
                   </node>
                   <leafNode name="wins-server">
                     <properties>
                       <help>IP address for Windows Internet Name Service (WINS) server</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>WINS server IPv4 address</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv4-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="wpad-url">
                     <properties>
                       <help>Web Proxy Autodiscovery (WPAD) URL</help>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/dhcpv6-relay.xml.in b/interface-definitions/service_dhcpv6-relay.xml.in
similarity index 99%
rename from interface-definitions/dhcpv6-relay.xml.in
rename to interface-definitions/service_dhcpv6-relay.xml.in
index a80317609..40679d1c2 100644
--- a/interface-definitions/dhcpv6-relay.xml.in
+++ b/interface-definitions/service_dhcpv6-relay.xml.in
@@ -1,82 +1,82 @@
 <?xml version="1.0"?>
 <!-- DHCPv6 relay configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="dhcpv6-relay" owner="${vyos_conf_scripts_dir}/dhcpv6_relay.py">
+      <node name="dhcpv6-relay" owner="${vyos_conf_scripts_dir}/service_dhcpv6-relay.py">
         <properties>
           <help>DHCPv6 Relay Agent parameters</help>
           <priority>900</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           <tagNode name="listen-interface">
             <properties>
               <help>Interface for DHCPv6 Relay Agent to listen for requests</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
             </properties>
             <children>
               <leafNode name="address">
                 <properties>
                   <help>IPv6 address on listen-interface listen for requests on</help>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address on listen interface</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv6-address"/>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="max-hop-count">
             <properties>
               <help>Maximum hop count for which requests will be processed</help>
               <valueHelp>
                 <format>u32:1-255</format>
                 <description>Hop count</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-255"/>
               </constraint>
               <constraintErrorMessage>max-hop-count must be a value between 1 and 255</constraintErrorMessage>
             </properties>
             <defaultValue>10</defaultValue>
           </leafNode>
           <tagNode name="upstream-interface">
             <properties>
               <help>Interface for DHCPv6 Relay Agent forward requests out</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
               </completionHelp>
             </properties>
             <children>
               <leafNode name="address">
                 <properties>
                   <help>IPv6 address to forward requests to</help>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address of the DHCP server</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv6-address"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="use-interface-id-option">
             <properties>
               <help>Option to set DHCPv6 interface-ID option</help>
               <valueless/>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/dhcpv6-server.xml.in b/interface-definitions/service_dhcpv6-server.xml.in
similarity index 99%
rename from interface-definitions/dhcpv6-server.xml.in
rename to interface-definitions/service_dhcpv6-server.xml.in
index 10fdbf3f7..102c164a6 100644
--- a/interface-definitions/dhcpv6-server.xml.in
+++ b/interface-definitions/service_dhcpv6-server.xml.in
@@ -1,375 +1,375 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="dhcpv6-server" owner="${vyos_conf_scripts_dir}/dhcpv6_server.py">
+      <node name="dhcpv6-server" owner="${vyos_conf_scripts_dir}/service_dhcpv6-server.py">
         <properties>
           <help>DHCP for IPv6 (DHCPv6) server</help>
           <priority>900</priority>
         </properties>
         <children>
           #include <include/generic-disable-node.xml.i>
           <node name="global-parameters">
             <properties>
               <help>Additional global parameters for DHCPv6 server</help>
             </properties>
             <children>
               #include <include/name-server-ipv6.xml.i>
             </children>
           </node>
           <leafNode name="preference">
             <properties>
               <help>Preference of this DHCPv6 server compared with others</help>
               <valueHelp>
                 <format>u32:0-255</format>
                 <description>DHCPv6 server preference (0-255)</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-255"/>
               </constraint>
               <constraintErrorMessage>Preference must be between 0 and 255</constraintErrorMessage>
             </properties>
           </leafNode>
           <tagNode name="shared-network-name">
             <properties>
               <help>DHCPv6 shared network name</help>
               <constraint>
                 <regex>[-_a-zA-Z0-9.]+</regex>
               </constraint>
               <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage>
             </properties>
             <children>
               #include <include/generic-disable-node.xml.i>
               #include <include/generic-description.xml.i>
               <leafNode name="interface">
                 <properties>
                   <help>Optional interface for this shared network to accept requests from</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                   <valueHelp>
                     <format>txt</format>
                     <description>Interface name</description>
                   </valueHelp>
                   <constraint>
                     #include <include/constraint/interface-name.xml.i>
                   </constraint>
                 </properties>
               </leafNode>
               <node name="common-options">
                 <properties>
                   <help>Common options to distribute to all clients, including stateless clients</help>
                 </properties>
                 <children>
                   <leafNode name="info-refresh-time">
                     <properties>
                       <help>Time (in seconds) that stateless clients should wait between refreshing the information they were given</help>
                       <valueHelp>
                         <format>u32:1-4294967295</format>
                         <description>DHCPv6 information refresh time</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-4294967295"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/dhcp/domain-search.xml.i>
                   #include <include/name-server-ipv6.xml.i>
                 </children>
               </node>
               <tagNode name="subnet">
                 <properties>
                   <help>IPv6 DHCP subnet for this shared network</help>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 address and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv6-prefix"/>
                   </constraint>
                 </properties>
                 <children>
                   <node name="address-range">
                     <properties>
                       <help>Parameters setting ranges for assigning IPv6 addresses</help>
                     </properties>
                     <children>
                       <leafNode name="prefix">
                         <properties>
                           <help>IPv6 prefix defining range of addresses to assign</help>
                           <valueHelp>
                             <format>ipv6net</format>
                             <description>IPv6 address and prefix length</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv6-prefix"/>
                           </constraint>
                           <multi/>
                         </properties>
                       </leafNode>
                       <tagNode name="start">
                         <properties>
                           <help>First in range of consecutive IPv6 addresses to assign</help>
                           <valueHelp>
                             <format>ipv6</format>
                             <description>IPv6 address</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv6-address"/>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="stop">
                             <properties>
                               <help>Last in range of consecutive IPv6 addresses</help>
                               <valueHelp>
                                 <format>ipv6</format>
                                 <description>IPv6 address</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="ipv6-address"/>
                               </constraint>
                             </properties>
                           </leafNode>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                   #include <include/dhcp/captive-portal.xml.i>
                   #include <include/dhcp/domain-search.xml.i>
                   <node name="lease-time">
                     <properties>
                       <help>Parameters relating to the lease time</help>
                     </properties>
                     <children>
                       <leafNode name="default">
                         <properties>
                           <help>Default time (in seconds) that will be assigned to a lease</help>
                           <valueHelp>
                             <format>u32:1-4294967295</format>
                             <description>DHCPv6 valid lifetime</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-4294967295"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="maximum">
                         <properties>
                           <help>Maximum time (in seconds) that will be assigned to a lease</help>
                           <valueHelp>
                             <format>u32:1-4294967295</format>
                             <description>Maximum lease time in seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-4294967295"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="minimum">
                         <properties>
                           <help>Minimum time (in seconds) that will be assigned to a lease</help>
                           <valueHelp>
                             <format>u32:1-4294967295</format>
                             <description>Minimum lease time in seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-4294967295"/>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   #include <include/name-server-ipv6.xml.i>
                   <leafNode name="nis-domain">
                     <properties>
                       <help>NIS domain name for client to use</help>
                       <constraint>
                         <regex>[-_a-zA-Z0-9.]+</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid NIS domain name</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="nis-server">
                     <properties>
                       <help>IPv6 address of a NIS Server</help>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>IPv6 address of NIS server</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv6-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="nisplus-domain">
                     <properties>
                       <help>NIS+ domain name for client to use</help>
                       <constraint>
                         <regex>[-_a-zA-Z0-9.]+</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid NIS+ domain name. May only contain letters, numbers and .-_</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="nisplus-server">
                     <properties>
                       <help>IPv6 address of a NIS+ Server</help>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>IPv6 address of NIS+ server</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv6-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <node name="prefix-delegation">
                     <properties>
                       <help>Parameters relating to IPv6 prefix delegation</help>
                     </properties>
                     <children>
                       <tagNode name="prefix">
                         <properties>
                           <help>IPv6 prefix to be used in prefix delegation</help>
                           <valueHelp>
                             <format>ipv6</format>
                             <description>IPv6 prefix used in prefix delegation</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv6-address"/>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="prefix-length">
                             <properties>
                               <help>Length in bits of prefix</help>
                               <valueHelp>
                                 <format>u32:32-64</format>
                                 <description>Prefix length (32-64)</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="numeric" argument="--range 32-64"/>
                               </constraint>
                               <constraintErrorMessage>Prefix length must be between 32 and 64</constraintErrorMessage>
                             </properties>
                           </leafNode>
                           <leafNode name="delegated-length">
                             <properties>
                               <help>Length in bits of prefixes to be delegated</help>
                               <valueHelp>
                                 <format>u32:32-64</format>
                                 <description>Delegated prefix length (32-64)</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="numeric" argument="--range 32-96"/>
                               </constraint>
                               <constraintErrorMessage>Delegated prefix length must be between 32 and 96</constraintErrorMessage>
                             </properties>
                           </leafNode>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                   <leafNode name="sip-server">
                     <properties>
                       <help>IPv6 address of SIP server</help>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>IPv6 address of SIP server</description>
                       </valueHelp>
                       <valueHelp>
                         <format>hostname</format>
                         <description>FQDN of SIP server</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ipv6-address"/>
                         <validator name="fqdn"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="sntp-server">
                     <properties>
                       <help>IPv6 address of an SNTP server for client to use</help>
                       <constraint>
                         <validator name="ipv6-address"/>
                       </constraint>
                       <multi/>
                     </properties>
                   </leafNode>
                   <tagNode name="static-mapping">
                     <properties>
                       <help>Hostname for static mapping reservation</help>
                       <constraint>
                         <validator name="fqdn"/>
                       </constraint>
                       <constraintErrorMessage>Invalid static mapping hostname</constraintErrorMessage>
                     </properties>
                     <children>
                       #include <include/generic-disable-node.xml.i>
                       #include <include/interface/mac.xml.i>
                       #include <include/interface/duid.xml.i>
                       <leafNode name="ipv6-address">
                         <properties>
                           <help>Client IPv6 address for this static mapping</help>
                           <valueHelp>
                             <format>ipv6</format>
                             <description>IPv6 address for this static mapping</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv6-address"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="ipv6-prefix">
                         <properties>
                           <help>Client IPv6 prefix for this static mapping</help>
                           <valueHelp>
                             <format>ipv6net</format>
                             <description>IPv6 prefix for this static mapping</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ipv6-prefix"/>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                   <node name="vendor-option">
                     <properties>
                       <help>Vendor Specific Options</help>
                     </properties>
                     <children>
                       <node name="cisco">
                         <properties>
                           <help>Cisco specific parameters</help>
                         </properties>
                         <children>
                           <leafNode name="tftp-server">
                             <properties>
                               <help>TFTP server name</help>
                               <valueHelp>
                                 <format>ipv6</format>
                                 <description>TFTP server IPv6 address</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="ipv6-address"/>
                               </constraint>
                               <multi/>
                             </properties>
                           </leafNode>
                         </children>
                       </node>
                     </children>
                   </node>
                 </children>
               </tagNode>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/dns-dynamic.xml.in b/interface-definitions/service_dns_dynamic.xml.in
similarity index 99%
rename from interface-definitions/dns-dynamic.xml.in
rename to interface-definitions/service_dns_dynamic.xml.in
index d296a6694..d1b0e90bb 100644
--- a/interface-definitions/dns-dynamic.xml.in
+++ b/interface-definitions/service_dns_dynamic.xml.in
@@ -1,213 +1,213 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
       <node name="dns">
         <properties>
           <help>Domain Name System (DNS) related services</help>
         </properties>
         <children>
-          <node name="dynamic" owner="${vyos_conf_scripts_dir}/dns_dynamic.py">
+          <node name="dynamic" owner="${vyos_conf_scripts_dir}/service_dns_dynamic.py">
             <properties>
               <help>Dynamic DNS</help>
               <priority>990</priority>
             </properties>
             <children>
               <tagNode name="name">
                 <properties>
                   <help>Dynamic DNS configuration</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Dynamic DNS service name</description>
                   </valueHelp>
                   <constraint>
                     #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
                   </constraint>
                   <constraintErrorMessage>Dynamic DNS service name must be alphanumeric and can contain hyphens and underscores</constraintErrorMessage>
                 </properties>
                 <children>
                   #include <include/generic-description.xml.i>
                   <leafNode name="protocol">
                     <properties>
                       <help>ddclient protocol used for Dynamic DNS service</help>
                       <completionHelp>
                         <script>${vyos_completion_dir}/list_ddclient_protocols.sh</script>
                       </completionHelp>
                       <constraint>
                         <validator name="ddclient-protocol"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="address">
                     <properties>
                       <help>Obtain IP address to send Dynamic DNS update for</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Use interface to obtain the IP address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>web</format>
                         <description>Use HTTP(S) web request to obtain the IP address</description>
                       </valueHelp>
                       <completionHelp>
                         <script>${vyos_completion_dir}/list_interfaces</script>
                         <list>web</list>
                       </completionHelp>
                       <constraint>
                         #include <include/constraint/interface-name.xml.i>
                         <regex>web</regex>
                       </constraint>
                     </properties>
                   </leafNode>
                   <node name="web-options">
                     <properties>
                       <help>Options when using HTTP(S) web request to obtain the IP address</help>
                     </properties>
                     <children>
                       #include <include/url-http-https.xml.i>
                       <leafNode name="skip">
                         <properties>
                           <help>Pattern to skip from the HTTP(S) respose</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>Pattern to skip from the HTTP(S) respose to extract the external IP address</description>
                           </valueHelp>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   <leafNode name="ip-version">
                     <properties>
                       <help>IP address version to use</help>
                       <valueHelp>
                         <format>_ipv4</format>
                         <description>Use only IPv4 address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>_ipv6</format>
                         <description>Use only IPv6 address</description>
                       </valueHelp>
                       <valueHelp>
                         <format>both</format>
                         <description>Use both IPv4 and IPv6 address</description>
                       </valueHelp>
                       <completionHelp>
                         <list>ipv4 ipv6 both</list>
                       </completionHelp>
                       <constraint>
                         <regex>(ipv[46]|both)</regex>
                       </constraint>
                       <constraintErrorMessage>IP Version must be literal 'ipv4', 'ipv6' or 'both'</constraintErrorMessage>
                     </properties>
                     <defaultValue>ipv4</defaultValue>
                   </leafNode>
                   <leafNode name="host-name">
                     <properties>
                       <help>Hostname to register with Dynamic DNS service</help>
                       <constraint>
                           #include <include/constraint/host-name.xml.i>
                           <regex>(\@|\*)[-.A-Za-z0-9]*</regex>
                       </constraint>
                       <constraintErrorMessage>Host-name must be alphanumeric, can contain hyphens and can be prefixed with '@' or '*'</constraintErrorMessage>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="server">
                     <properties>
                       <help>Remote Dynamic DNS server to send updates to</help>
                       <valueHelp>
                         <format>ipv4</format>
                         <description>IPv4 address of the remote server</description>
                       </valueHelp>
                       <valueHelp>
                         <format>ipv6</format>
                         <description>IPv6 address of the remote server</description>
                       </valueHelp>
                       <valueHelp>
                         <format>hostname</format>
                         <description>Fully qualified domain name of the remote server</description>
                       </valueHelp>
                       <constraint>
                         <validator name="ip-address"/>
                         <validator name="fqdn"/>
                       </constraint>
                       <constraintErrorMessage>Remote server must be IP address or fully qualified domain name</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="zone">
                     <properties>
                       <help>DNS zone to be updated</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Name of DNS zone</description>
                       </valueHelp>
                       <constraint>
                         <validator name="fqdn"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/generic-username.xml.i>
                   #include <include/generic-password.xml.i>
                   <leafNode name="key">
                     <properties>
                       <help>File containing TSIG authentication key for RFC2136 nsupdate on remote DNS server</help>
                       <valueHelp>
                         <format>filename</format>
                         <description>File in /config/auth directory</description>
                       </valueHelp>
                       <constraint>
                         <validator name="file-path" argument="--strict --parent-dir /config/auth"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   #include <include/dns/time-to-live.xml.i>
                   <leafNode name="wait-time">
                     <properties>
                       <help>Time in seconds to wait between update attempts</help>
                       <valueHelp>
                         <format>u32:60-86400</format>
                         <description>Time in seconds</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 60-86400"/>
                       </constraint>
                       <constraintErrorMessage>Wait time must be between 60 and 86400 seconds</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="expiry-time">
                     <properties>
                       <help>Time in seconds for the hostname to be marked expired in cache</help>
                       <valueHelp>
                         <format>u32:300-2160000</format>
                         <description>Time in seconds</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 300-2160000"/>
                       </constraint>
                       <constraintErrorMessage>Expiry time must be between 300 and 2160000 seconds</constraintErrorMessage>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <leafNode name="interval">
                 <properties>
                   <help>Interval in seconds to wait between Dynamic DNS updates</help>
                   <valueHelp>
                     <format>u32:60-3600</format>
                     <description>Time in seconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 60-3600"/>
                   </constraint>
                   <constraintErrorMessage>Interval must be between 60 and 3600 seconds</constraintErrorMessage>
                 </properties>
                 <defaultValue>300</defaultValue>
               </leafNode>
               #include <include/interface/vrf.xml.i>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/dns-forwarding.xml.in b/interface-definitions/service_dns_forwarding.xml.in
similarity index 99%
rename from interface-definitions/dns-forwarding.xml.in
rename to interface-definitions/service_dns_forwarding.xml.in
index 5ca02acef..7dce9b548 100644
--- a/interface-definitions/dns-forwarding.xml.in
+++ b/interface-definitions/service_dns_forwarding.xml.in
@@ -1,703 +1,703 @@
 <?xml version="1.0"?>
 <!-- DNS forwarder configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
       <node name="dns">
         <properties>
           <help>Domain Name System (DNS) related services</help>
         </properties>
         <children>
-          <node name="forwarding" owner="${vyos_conf_scripts_dir}/dns_forwarding.py">
+          <node name="forwarding" owner="${vyos_conf_scripts_dir}/service_dns_forwarding.py">
             <properties>
               <help>DNS forwarding</help>
               <priority>918</priority>
             </properties>
             <children>
               <leafNode name="cache-size">
                 <properties>
                   <help>DNS forwarding cache size</help>
                   <valueHelp>
                     <format>u32:0-2147483647</format>
                     <description>DNS forwarding cache size</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-2147483647"/>
                   </constraint>
                 </properties>
                 <defaultValue>10000</defaultValue>
               </leafNode>
               <leafNode name="dhcp">
                 <properties>
                   <help>Interfaces whose DHCP client nameservers to forward requests to</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="dns64-prefix">
                 <properties>
                   <help>Help to communicate between IPv6-only client and IPv4-only server</help>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 address and /96 only prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv6-prefix"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="dnssec">
                 <properties>
                   <help>DNSSEC mode</help>
                   <completionHelp>
                     <list>off process-no-validate process log-fail validate</list>
                   </completionHelp>
                   <valueHelp>
                     <format>off</format>
                     <description>No DNSSEC processing whatsoever!</description>
                   </valueHelp>
                   <valueHelp>
                     <format>process-no-validate</format>
                     <description>Respond with DNSSEC records to clients that ask for it. No validation done at all!</description>
                   </valueHelp>
                   <valueHelp>
                     <format>process</format>
                     <description>Respond with DNSSEC records to clients that ask for it. Validation for clients that request it.</description>
                   </valueHelp>
                   <valueHelp>
                     <format>log-fail</format>
                     <description>Similar behaviour to process, but validate RRSIGs on responses and log bogus responses.</description>
                   </valueHelp>
                   <valueHelp>
                     <format>validate</format>
                     <description>Full blown DNSSEC validation. Send SERVFAIL to clients on bogus responses.</description>
                   </valueHelp>
                   <constraint>
                     <regex>(off|process-no-validate|process|log-fail|validate)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>process-no-validate</defaultValue>
               </leafNode>
               <tagNode name="domain">
                 <properties>
                   <help>Domain to forward to a custom DNS server</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>An absolute DNS domain name</description>
                   </valueHelp>
                   <constraint>
                     <validator name="fqdn"/>
                   </constraint>
                 </properties>
                 <children>
                   #include <include/name-server-ipv4-ipv6-port.xml.i>
                   <leafNode name="addnta">
                     <properties>
                       <help>Add NTA (negative trust anchor) for this domain (must be set if the domain does not support DNSSEC)</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <leafNode name="recursion-desired">
                     <properties>
                       <help>Set the "recursion desired" bit in requests to the upstream nameserver</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <tagNode name="authoritative-domain">
                 <properties>
                   <help>Domain to host authoritative records for</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>An absolute DNS domain name</description>
                   </valueHelp>
                   <constraint>
                     <validator name="fqdn"/>
                   </constraint>
                 </properties>
                 <children>
                   <node name="records">
                     <properties>
                       <help>DNS zone records</help>
                     </properties>
                     <children>
                       <tagNode name="a">
                         <properties>
                           <help>A record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>any</format>
                             <description>Wildcard record (any subdomain)</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@|any)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="address">
                             <properties>
                               <help>IPv4 address</help>
                               <valueHelp>
                                 <format>ipv4</format>
                                 <description>IPv4 address</description>
                               </valueHelp>
                               <multi/>
                               <constraint>
                                 <validator name="ipv4-address"/>
                               </constraint>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="aaaa">
                         <properties>
                           <help>AAAA record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>any</format>
                             <description>Wildcard record (any subdomain)</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@|any)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="address">
                             <properties>
                               <help>IPv6 address</help>
                               <valueHelp>
                                 <format>ipv6</format>
                                 <description>IPv6 address</description>
                               </valueHelp>
                               <multi/>
                               <constraint>
                                 <validator name="ipv6-address"/>
                               </constraint>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="cname">
                         <properties>
                           <help>CNAME record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="target">
                             <properties>
                               <help>Target DNS name</help>
                               <valueHelp>
                                 <format>name.example.com</format>
                                 <description>Absolute DNS name</description>
                               </valueHelp>
                               <constraint>
                                 <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                               </constraint>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="mx">
                         <properties>
                           <help>MX record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <tagNode name="server">
                             <properties>
                               <help>Mail server</help>
                               <valueHelp>
                                 <format>name.example.com</format>
                                 <description>Absolute DNS name</description>
                               </valueHelp>
                               <constraint>
                                 <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                               </constraint>
                             </properties>
                             <children>
                               <leafNode name="priority">
                                 <properties>
                                   <help>Server priority</help>
                                   <valueHelp>
                                     <format>u32:1-999</format>
                                     <description>Server priority (lower numbers are higher priority)</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 1-999"/>
                                   </constraint>
                                 </properties>
                                 <defaultValue>10</defaultValue>
                               </leafNode>
                             </children>
                           </tagNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="ns">
                         <properties>
                           <help>NS record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="target">
                             <properties>
                               <help>Target DNS server authoritative for subdomain</help>
                               <valueHelp>
                                 <format>nsXX.example.com</format>
                                 <description>Absolute DNS name</description>
                               </valueHelp>
                               <constraint>
                                 <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                               </constraint>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="ptr">
                         <properties>
                           <help>PTR record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="target">
                             <properties>
                               <help>Target DNS name</help>
                               <valueHelp>
                                 <format>name.example.com</format>
                                 <description>Absolute DNS name</description>
                               </valueHelp>
                               <constraint>
                                 <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                               </constraint>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="txt">
                         <properties>
                           <help>TXT record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="value">
                             <properties>
                               <help>Record contents</help>
                               <valueHelp>
                                 <format>txt</format>
                                 <description>Record contents</description>
                               </valueHelp>
                               <multi/>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="spf">
                         <properties>
                           <help>SPF record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <leafNode name="value">
                             <properties>
                               <help>Record contents</help>
                               <valueHelp>
                                 <format>txt</format>
                                 <description>Record contents</description>
                               </valueHelp>
                             </properties>
                           </leafNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="srv">
                         <properties>
                           <help>SRV record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <tagNode name="entry">
                             <properties>
                               <help>Service entry</help>
                               <valueHelp>
                                 <format>u32:0-65535</format>
                                 <description>Entry number</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="numeric" argument="--range 0-65535"/>
                               </constraint>
                             </properties>
                             <children>
                               <leafNode name="hostname">
                                 <properties>
                                   <help>Server hostname</help>
                                   <valueHelp>
                                     <format>name.example.com</format>
                                     <description>Absolute DNS name</description>
                                   </valueHelp>
                                   <constraint>
                                     <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                                   </constraint>
                                 </properties>
                               </leafNode>
                               <leafNode name="port">
                                 <properties>
                                   <help>Port number</help>
                                   <valueHelp>
                                     <format>u32:0-65535</format>
                                     <description>TCP/UDP port number</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 0-65536"/>
                                   </constraint>
                                 </properties>
                               </leafNode>
                               <leafNode name="priority">
                                 <properties>
                                   <help>Entry priority</help>
                                   <valueHelp>
                                     <format>u32:0-65535</format>
                                     <description>Entry priority (lower numbers are higher priority)</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 0-65535"/>
                                   </constraint>
                                 </properties>
                                 <defaultValue>10</defaultValue>
                               </leafNode>
                               <leafNode name="weight">
                                 <properties>
                                   <help>Entry weight</help>
                                   <valueHelp>
                                     <format>u32:0-65535</format>
                                     <description>Entry weight</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 0-65535"/>
                                   </constraint>
                                 </properties>
                                 <defaultValue>0</defaultValue>
                               </leafNode>
                             </children>
                           </tagNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                       <tagNode name="naptr">
                         <properties>
                           <help>NAPTR record</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>A DNS name relative to the root record</description>
                           </valueHelp>
                           <valueHelp>
                             <format>@</format>
                             <description>Root record</description>
                           </valueHelp>
                           <constraint>
                             <regex>([-_a-zA-Z0-9.]{1,63}|@)(?&lt;!\.)</regex>
                           </constraint>
                         </properties>
                         <children>
                           <tagNode name="rule">
                             <properties>
                               <help>NAPTR rule</help>
                               <valueHelp>
                                 <format>u32:0-65535</format>
                                 <description>Rule number</description>
                               </valueHelp>
                               <constraint>
                                 <validator name="numeric" argument="--range 0-65535"/>
                               </constraint>
                             </properties>
                             <children>
                               <leafNode name="order">
                                 <properties>
                                   <help>Rule order</help>
                                   <valueHelp>
                                     <format>u32:0-65535</format>
                                     <description>Rule order (lower order is evaluated first)</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 0-65535"/>
                                   </constraint>
                                 </properties>
                               </leafNode>
                               <leafNode name="preference">
                                 <properties>
                                   <help>Rule preference</help>
                                   <valueHelp>
                                     <format>u32:0-65535</format>
                                     <description>Rule preference</description>
                                   </valueHelp>
                                   <constraint>
                                     <validator name="numeric" argument="--range 0-65535"/>
                                   </constraint>
                                 </properties>
                                 <defaultValue>0</defaultValue>
                               </leafNode>
                               <leafNode name="lookup-srv">
                                 <properties>
                                   <help>S flag</help>
                                   <valueless/>
                                 </properties>
                               </leafNode>
                               <leafNode name="lookup-a">
                                 <properties>
                                   <help>A flag</help>
                                   <valueless/>
                                 </properties>
                               </leafNode>
                               <leafNode name="resolve-uri">
                                 <properties>
                                   <help>U flag</help>
                                   <valueless/>
                                 </properties>
                               </leafNode>
                               <leafNode name="protocol-specific">
                                 <properties>
                                   <help>P flag</help>
                                   <valueless/>
                                 </properties>
                               </leafNode>
                               <leafNode name="service">
                                 <properties>
                                   <help>Service type</help>
                                   <constraint>
                                     <regex>[a-zA-Z][a-zA-Z0-9]{0,31}(\+[a-zA-Z][a-zA-Z0-9]{0,31})?</regex>
                                   </constraint>
                                 </properties>
                               </leafNode>
                               <leafNode name="regexp">
                                 <properties>
                                   <help>Regular expression</help>
                                 </properties>
                               </leafNode>
                               <leafNode name="replacement">
                                 <properties>
                                   <help>Replacement DNS name</help>
                                   <valueHelp>
                                     <format>name.example.com</format>
                                     <description>Absolute DNS name</description>
                                   </valueHelp>
                                   <constraint>
                                     <regex>[-_a-zA-Z0-9.]{1,63}(?&lt;!\.)</regex>
                                   </constraint>
                                 </properties>
                               </leafNode>
                             </children>
                           </tagNode>
                           #include <include/dns/time-to-live.xml.i>
                           <leafNode name="ttl">
                               <defaultValue>300</defaultValue>
                           </leafNode>
                           #include <include/generic-disable-node.xml.i>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                   #include <include/generic-disable-node.xml.i>
                 </children>
               </tagNode>
               <leafNode name="ignore-hosts-file">
                 <properties>
                   <help>Do not use local /etc/hosts file in name resolution</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="no-serve-rfc1918">
                 <properties>
                   <help>Makes the server authoritatively not aware of RFC1918 addresses</help>
 		          <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="allow-from">
                 <properties>
                   <help>Networks allowed to query this server</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IP address and prefix length</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 address and prefix length</description>
                   </valueHelp>
                   <multi/>
                   <constraint>
                     <validator name="ip-prefix"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/listen-address.xml.i>
               #include <include/port-number.xml.i>
               <leafNode name="port">
                 <defaultValue>53</defaultValue>
               </leafNode>
               <leafNode name="negative-ttl">
                 <properties>
                   <help>Maximum amount of time negative entries are cached</help>
                   <valueHelp>
                     <format>u32:0-7200</format>
                     <description>Seconds to cache NXDOMAIN entries</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 0-7200"/>
                   </constraint>
                 </properties>
                 <defaultValue>3600</defaultValue>
               </leafNode>
               <leafNode name="timeout">
                 <properties>
                   <help>Number of milliseconds to wait for a remote authoritative server to respond</help>
                   <valueHelp>
                     <format>u32:10-60000</format>
                     <description>Network timeout in milliseconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 10-60000"/>
                   </constraint>
                 </properties>
                 <defaultValue>1500</defaultValue>
               </leafNode>
               #include <include/name-server-ipv4-ipv6-port.xml.i>
               #include <include/source-address-ipv4-ipv6-multi.xml.i>
               <leafNode name="source-address">
                 <defaultValue>0.0.0.0 ::</defaultValue>
               </leafNode>
               <leafNode name="system">
                 <properties>
                   <help>Use system name servers</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-event-handler.xml.in b/interface-definitions/service_event-handler.xml.in
similarity index 98%
rename from interface-definitions/service-event-handler.xml.in
rename to interface-definitions/service_event-handler.xml.in
index aef6bc1bc..2cee4f595 100644
--- a/interface-definitions/service-event-handler.xml.in
+++ b/interface-definitions/service_event-handler.xml.in
@@ -1,70 +1,70 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="event-handler" owner="${vyos_conf_scripts_dir}/service_event_handler.py">
+      <node name="event-handler" owner="${vyos_conf_scripts_dir}/service_event-handler.py">
         <properties>
           <help>Service event handler</help>
         </properties>
         <children>
           <tagNode name="event">
             <properties>
               <help>Event handler name</help>
             </properties>
             <children>
               <node name="filter">
                 <properties>
                   <help>Logs filter settings</help>
                 </properties>
                 <children>
                   <leafNode name="pattern">
                     <properties>
                       <help>Match pattern (regex)</help>
                     </properties>
                   </leafNode>
                   <leafNode name="syslog-identifier">
                     <properties>
                       <help>Identifier of a process in syslog (string)</help>
                     </properties>
                   </leafNode>
                 </children>
               </node>
               <node name="script">
                 <properties>
                   <help>Event handler script file</help>
                 </properties>
                 <children>
                   <leafNode name="arguments">
                     <properties>
                       <help>Script arguments</help>
                     </properties>
                   </leafNode>
                   <tagNode name="environment">
                     <properties>
                       <help>Script environment arguments</help>
                     </properties>
                     <children>
                       <leafNode name="value">
                         <properties>
                           <help>Environment value</help>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                   <leafNode name="path">
                     <properties>
                       <help>Path to the script</help>
                       <constraint>
                         <validator name="script"/>
                       </constraint>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/https.xml.in b/interface-definitions/service_https.xml.in
similarity index 98%
rename from interface-definitions/https.xml.in
rename to interface-definitions/service_https.xml.in
index ca5a5f088..223f10962 100644
--- a/interface-definitions/https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -1,220 +1,220 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="https" owner="${vyos_conf_scripts_dir}/https.py">
+      <node name="https" owner="${vyos_conf_scripts_dir}/service_https.py">
         <properties>
           <help>HTTPS configuration</help>
           <priority>1001</priority>
         </properties>
         <children>
           <tagNode name="virtual-host">
             <properties>
               <help>Identifier for virtual host</help>
               <constraint>
                 <regex>[a-zA-Z0-9-_.:]{1,255}</regex>
               </constraint>
               <constraintErrorMessage>illegal characters in identifier or identifier longer than 255 characters</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="listen-address">
                 <properties>
                   <help>Address to listen for HTTPS requests</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
                   </completionHelp>
                   <valueHelp>
                     <format>ipv4</format>
                    <description>HTTPS IPv4 address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>HTTPS IPv6 address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>'*'</format>
                     <description>any</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                     <regex>\*</regex>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/port-number.xml.i>
               <leafNode name='port'>
                 <defaultValue>443</defaultValue>
               </leafNode>
               <leafNode name="server-name">
                 <properties>
                   <help>Server names: exact, wildcard, or regex</help>
                   <multi/>
                 </properties>
               </leafNode>
               #include <include/allow-client.xml.i>
             </children>
           </tagNode>
           <node name="api">
             <properties>
               <help>VyOS HTTP API configuration</help>
             </properties>
             <children>
               <node name="keys">
                 <properties>
                   <help>HTTP API keys</help>
                 </properties>
                 <children>
                   <tagNode name="id">
                     <properties>
                       <help>HTTP API id</help>
                     </properties>
                     <children>
                       <leafNode name="key">
                         <properties>
                           <help>HTTP API plaintext key</help>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                 </children>
               </node>
               <leafNode name="strict">
                 <properties>
                   <help>Enforce strict path checking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="debug">
                 <properties>
                   <help>Debug</help>
                   <valueless/>
                   <hidden/>
                 </properties>
               </leafNode>
               <node name="graphql">
                 <properties>
                   <help>GraphQL support</help>
                 </properties>
                 <children>
                   <leafNode name="introspection">
                     <properties>
                       <help>Schema introspection</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                   <node name="authentication">
                     <properties>
                       <help>GraphQL authentication</help>
                     </properties>
                     <children>
                       <leafNode name="type">
                         <properties>
                           <help>Authentication type</help>
                           <completionHelp>
                             <list>key token</list>
                           </completionHelp>
                           <valueHelp>
                             <format>key</format>
                             <description>Use API keys</description>
                           </valueHelp>
                           <valueHelp>
                             <format>token</format>
                             <description>Use JWT token</description>
                           </valueHelp>
                           <constraint>
                             <regex>(key|token)</regex>
                           </constraint>
                         </properties>
                         <defaultValue>key</defaultValue>
                       </leafNode>
                       <leafNode name="expiration">
                         <properties>
                           <help>Token time to expire in seconds</help>
                           <valueHelp>
                             <format>u32:60-31536000</format>
                             <description>Token lifetime in seconds</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 60-31536000"/>
                           </constraint>
                         </properties>
                         <defaultValue>3600</defaultValue>
                       </leafNode>
                       <leafNode name="secret-length">
                         <properties>
                           <help>Length of shared secret in bytes</help>
                           <valueHelp>
                             <format>u32:16-65535</format>
                             <description>Byte length of generated shared secret</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 16-65535"/>
                           </constraint>
                         </properties>
                         <defaultValue>32</defaultValue>
                       </leafNode>
                     </children>
                   </node>
                 </children>
               </node>
               <node name="cors">
                 <properties>
                   <help>Set CORS options</help>
                 </properties>
                 <children>
                   <leafNode name="allow-origin">
                     <properties>
                       <help>Allow resource request from origin</help>
                       <multi/>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           <node name="api-restrict">
             <properties>
               <help>Restrict api proxy to subset of virtual hosts</help>
             </properties>
             <children>
               <leafNode name="virtual-host">
                 <properties>
                   <help>Restrict proxy to virtual host(s)</help>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <node name="certificates">
             <properties>
               <help>TLS certificates</help>
             </properties>
             <children>
               #include <include/pki/ca-certificate.xml.i>
               #include <include/pki/certificate.xml.i>
-              <node name="certbot" owner="${vyos_conf_scripts_dir}/le_cert.py">
+              <node name="certbot" owner="${vyos_conf_scripts_dir}/service_https_certificates_certbot.py">
                 <properties>
                   <help>Request or apply a letsencrypt certificate for domain-name</help>
                 </properties>
                 <children>
                   <leafNode name="domain-name">
                     <properties>
                       <help>Domain name(s) for which to obtain certificate</help>
                       <multi/>
                     </properties>
                   </leafNode>
                   <leafNode name="email">
                     <properties>
                       <help>Email address to associate with certificate</help>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-ids-ddos-protection.xml.in b/interface-definitions/service_ids_ddos-protection.xml.in
similarity index 99%
rename from interface-definitions/service-ids-ddos-protection.xml.in
rename to interface-definitions/service_ids_ddos-protection.xml.in
index 78463136b..3ef2640b3 100644
--- a/interface-definitions/service-ids-ddos-protection.xml.in
+++ b/interface-definitions/service_ids_ddos-protection.xml.in
@@ -1,167 +1,167 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
       <node name="ids">
         <properties>
           <help>Intrusion Detection System</help>
         </properties>
         <children>
-          <node name="ddos-protection" owner="${vyos_conf_scripts_dir}/service_ids_fastnetmon.py">
+          <node name="ddos-protection" owner="${vyos_conf_scripts_dir}/service_ids_ddos-protection.py">
             <properties>
               <help>FastNetMon detection and protection parameters</help>
               <priority>731</priority>
             </properties>
             <children>
               <leafNode name="alert-script">
                 <properties>
                   <help>Path to fastnetmon alert script</help>
                 </properties>
               </leafNode>
               <leafNode name="ban-time">
                 <properties>
                   <help>How long we should keep an IP in blocked state</help>
                   <valueHelp>
                     <format>u32:1-4294967294</format>
                     <description>Time in seconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-4294967294"/>
                   </constraint>
                 </properties>
                 <defaultValue>1900</defaultValue>
               </leafNode>
               <leafNode name="direction">
                 <properties>
                   <help>Direction for processing traffic</help>
                   <completionHelp>
                     <list>in out</list>
                   </completionHelp>
                   <constraint>
                     <regex>(in|out)</regex>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="excluded-network">
                 <properties>
                   <help>Specify IPv4 and IPv6 networks which are going to be excluded from protection</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 prefix(es) to exclude</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 prefix(es) to exclude</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-prefix"/>
                     <validator name="ipv6-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="listen-interface">
                 <properties>
                   <help>Listen interface for mirroring traffic</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_interfaces</script>
                   </completionHelp>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="mode">
                 <properties>
                   <help>Traffic capture mode</help>
                   <completionHelp>
                     <list>mirror sflow</list>
                   </completionHelp>
                   <valueHelp>
                     <format>mirror</format>
                     <description>Listen to mirrored traffic</description>
                   </valueHelp>
                   <valueHelp>
                     <format>sflow</format>
                     <description>Capture sFlow flows</description>
                   </valueHelp>
                   <constraint>
                     <regex>(mirror|sflow)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <node name="sflow">
                 <properties>
                   <help>Sflow settings</help>
                 </properties>
                 <children>
                   #include <include/listen-address-ipv4-single.xml.i>
                   #include <include/port-number.xml.i>
                   <leafNode name="port">
                     <defaultValue>6343</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="network">
                 <properties>
                   <help>Specify IPv4 and IPv6 networks which belong to you</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>Your IPv4 prefix(es)</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>Your IPv6 prefix(es)</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-prefix"/>
                     <validator name="ipv6-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <node name="threshold">
                 <properties>
                   <help>Attack limits thresholds</help>
                 </properties>
                 <children>
                   <node name="general">
                     <properties>
                       <help>General threshold</help>
                     </properties>
                     <children>
                       #include <include/ids/threshold.xml.i>
                     </children>
                   </node>
                   <node name="tcp">
                     <properties>
                       <help>TCP threshold</help>
                     </properties>
                     <children>
                       #include <include/ids/threshold.xml.i>
                     </children>
                   </node>
                   <node name="udp">
                     <properties>
                       <help>UDP threshold</help>
                     </properties>
                     <children>
                       #include <include/ids/threshold.xml.i>
                     </children>
                   </node>
                   <node name="icmp">
                     <properties>
                       <help>ICMP threshold</help>
                     </properties>
                     <children>
                       #include <include/ids/threshold.xml.i>
                     </children>
                   </node>
                 </children>
               </node>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in
similarity index 100%
rename from interface-definitions/service-ipoe-server.xml.in
rename to interface-definitions/service_ipoe-server.xml.in
diff --git a/interface-definitions/lldp.xml.in b/interface-definitions/service_lldp.xml.in
similarity index 99%
rename from interface-definitions/lldp.xml.in
rename to interface-definitions/service_lldp.xml.in
index 25fb575b6..1a06e0cb3 100644
--- a/interface-definitions/lldp.xml.in
+++ b/interface-definitions/service_lldp.xml.in
@@ -1,188 +1,188 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="lldp" owner="${vyos_conf_scripts_dir}/lldp.py">
+      <node name="lldp" owner="${vyos_conf_scripts_dir}/service_lldp.py">
         <properties>
           <help>LLDP settings</help>
           <priority>985</priority>
         </properties>
         <children>
           <tagNode name="interface">
             <properties>
               <help>Location data for interface</help>
               <valueHelp>
                 <format>all</format>
                 <description>Location data all interfaces</description>
               </valueHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Location data for a specific interface</description>
               </valueHelp>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_interfaces</script>
                 <list>all</list>
               </completionHelp>
             </properties>
             <children>
               #include <include/generic-disable-node.xml.i>
               <node name="location">
                 <properties>
                   <help>LLDP-MED location data</help>
                 </properties>
                 <children>
                   <node name="coordinate-based">
                     <properties>
                       <help>Coordinate based location</help>
                     </properties>
                     <children>
                       <leafNode name="altitude">
                         <properties>
                           <help>Altitude in meters</help>
                           <valueHelp>
                             <format>0</format>
                             <description>No altitude</description>
                           </valueHelp>
                           <valueHelp>
                             <format>[+-]&lt;meters&gt;</format>
                             <description>Altitude in meters</description>
                           </valueHelp>
                           <constraintErrorMessage>Altitude should be a positive or negative number</constraintErrorMessage>
                           <constraint>
                             <validator name="numeric"/>
                           </constraint>
                         </properties>
                         <defaultValue>0</defaultValue>
                       </leafNode>
                       <leafNode name="datum">
                         <properties>
                           <help>Coordinate datum type</help>
                           <valueHelp>
                             <format>WGS84</format>
                             <description>WGS84</description>
                           </valueHelp>
                           <valueHelp>
                             <format>NAD83</format>
                             <description>NAD83</description>
                           </valueHelp>
                           <valueHelp>
                             <format>MLLW</format>
                             <description>NAD83/MLLW</description>
                           </valueHelp>
                           <completionHelp>
                             <list>WGS84 NAD83 MLLW</list>
                           </completionHelp>
                           <constraintErrorMessage>Datum should be WGS84, NAD83, or MLLW</constraintErrorMessage>
                           <constraint>
                             <regex>(WGS84|NAD83|MLLW)</regex>
                           </constraint>
                         </properties>
                         <defaultValue>WGS84</defaultValue>
                       </leafNode>
                       <leafNode name="latitude">
                         <properties>
                           <help>Latitude</help>
                           <valueHelp>
                             <format>&lt;latitude&gt;</format>
                             <description>Latitude (example "37.524449N")</description>
                           </valueHelp>
                           <constraintErrorMessage>Latitude should be a number followed by S or N</constraintErrorMessage>
                           <constraint>
                             <regex>(\d+)(\.\d+)?[nNsS]</regex>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="longitude">
                         <properties>
                           <help>Longitude</help>
                           <valueHelp>
                             <format>&lt;longitude&gt;</format>
                             <description>Longitude (example "122.267255W")</description>
                           </valueHelp>
                           <constraintErrorMessage>Longiture should be a number followed by E or W</constraintErrorMessage>
                           <constraint>
                             <regex>(\d+)(\.\d+)?[eEwW]</regex>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   <leafNode name="elin">
                     <properties>
                       <help>ECS ELIN (Emergency location identifier number)</help>
                       <valueHelp>
                         <format>u32:0-9999999999</format>
                         <description>Emergency Call Service ELIN number (between 10-25 numbers)</description>
                       </valueHelp>
                       <constraint>
                         <regex>[0-9]{10,25}</regex>
                       </constraint>
                       <constraintErrorMessage>ELIN number must be between 10-25 numbers</constraintErrorMessage>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </tagNode>
           <node name="legacy-protocols">
             <properties>
               <help>Legacy (vendor specific) protocols</help>
             </properties>
             <children>
               <leafNode name="cdp">
                 <properties>
                   <help>Listen for CDP for Cisco routers/switches</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="edp">
                 <properties>
                   <help>Listen for EDP for Extreme routers/switches</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="fdp">
                 <properties>
                   <help>Listen for FDP for Foundry routers/switches</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="sonmp">
                 <properties>
                   <help>Listen for SONMP for Nortel routers/switches</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="management-address">
             <properties>
               <help>Management IP Address</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
               </completionHelp>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 Management Address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 Management Address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="snmp">
             <properties>
               <help>Enable SNMP queries of the LLDP database</help>
               <valueless/>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-mdns-repeater.xml.in b/interface-definitions/service_mdns_repeater.xml.in
similarity index 99%
rename from interface-definitions/service-mdns-repeater.xml.in
rename to interface-definitions/service_mdns_repeater.xml.in
index 67870946c..5d6f61d74 100644
--- a/interface-definitions/service-mdns-repeater.xml.in
+++ b/interface-definitions/service_mdns_repeater.xml.in
@@ -1,82 +1,82 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
       <node name="mdns">
         <properties>
           <help>Multicast DNS (mDNS) parameters</help>
         </properties>
         <children>
-          <node name="repeater" owner="${vyos_conf_scripts_dir}/service_mdns-repeater.py">
+          <node name="repeater" owner="${vyos_conf_scripts_dir}/service_mdns_repeater.py">
             <properties>
               <help>mDNS repeater configuration</help>
               <priority>990</priority>
             </properties>
             <children>
               #include <include/generic-disable-node.xml.i>
               #include <include/generic-interface-multi.xml.i>
               <leafNode name="ip-version">
                 <properties>
                   <help>IP address version to use</help>
                   <valueHelp>
                     <format>_ipv4</format>
                     <description>Use only IPv4 address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>_ipv6</format>
                     <description>Use only IPv6 address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>both</format>
                     <description>Use both IPv4 and IPv6 address</description>
                   </valueHelp>
                   <completionHelp>
                     <list>ipv4 ipv6 both</list>
                   </completionHelp>
                   <constraint>
                     <regex>(ipv[46]|both)</regex>
                   </constraint>
                   <constraintErrorMessage>IP Version must be literal 'ipv4', 'ipv6' or 'both'</constraintErrorMessage>
                 </properties>
                 <defaultValue>both</defaultValue>
               </leafNode>
               <leafNode name="browse-domain">
                 <properties>
                   <help>mDNS browsing domains in addition to the default one</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>mDNS browsing domain</description>
                   </valueHelp>
                   <constraint>
                     <validator name="fqdn"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="allow-service">
                 <properties>
                   <help>Allowed mDNS services to be repeated</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>mDNS service</description>
                   </valueHelp>
                   <constraint>
                     <regex>[-_.a-zA-Z0-9]+</regex>
                   </constraint>
                   <constraintErrorMessage>Service name must be alphanumeric and can contain hyphens and underscores</constraintErrorMessage>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="vrrp-disable">
                 <properties>
                   <help>Disables mDNS repeater on VRRP interfaces not in MASTER state</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-monitoring-telegraf.xml.in b/interface-definitions/service_monitoring_telegraf.xml.in
similarity index 100%
rename from interface-definitions/service-monitoring-telegraf.xml.in
rename to interface-definitions/service_monitoring_telegraf.xml.in
diff --git a/interface-definitions/service-monitoring-zabbix-agent.xml.in b/interface-definitions/service_monitoring_zabbix-agent.xml.in
similarity index 100%
rename from interface-definitions/service-monitoring-zabbix-agent.xml.in
rename to interface-definitions/service_monitoring_zabbix-agent.xml.in
diff --git a/interface-definitions/ntp.xml.in b/interface-definitions/service_ntp.xml.in
similarity index 96%
rename from interface-definitions/ntp.xml.in
rename to interface-definitions/service_ntp.xml.in
index 4e874434b..65a45d7a1 100644
--- a/interface-definitions/ntp.xml.in
+++ b/interface-definitions/service_ntp.xml.in
@@ -1,67 +1,67 @@
 <?xml version="1.0"?>
 <!-- NTP configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="ntp" owner="${vyos_conf_scripts_dir}/ntp.py">
+      <node name="ntp" owner="${vyos_conf_scripts_dir}/service_ntp.py">
         <properties>
           <help>Network Time Protocol (NTP) configuration</help>
           <priority>900</priority>
         </properties>
         <children>
           <tagNode name="server">
             <properties>
               <help>Network Time Protocol (NTP) server</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IP address of NTP server</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address of NTP server</description>
               </valueHelp>
               <valueHelp>
                 <format>hostname</format>
                 <description>Fully qualified domain name of NTP server</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
                 <validator name="fqdn"/>
               </constraint>
             </properties>
             <children>
               <leafNode name="noselect">
                 <properties>
                   <help>Marks the server as unused</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="nts">
                 <properties>
                   <help>Enable Network Time Security (NTS) for the server</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="pool">
                 <properties>
                   <help>Associate with a number of remote servers</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="prefer">
                 <properties>
                   <help>Marks the server as preferred</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           #include <include/allow-client.xml.i>
           #include <include/generic-interface.xml.i>
           #include <include/listen-address.xml.i>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in
similarity index 100%
rename from interface-definitions/service-pppoe-server.xml.in
rename to interface-definitions/service_pppoe-server.xml.in
diff --git a/interface-definitions/service-router-advert.xml.in b/interface-definitions/service_router-advert.xml.in
similarity index 100%
rename from interface-definitions/service-router-advert.xml.in
rename to interface-definitions/service_router-advert.xml.in
diff --git a/interface-definitions/salt-minion.xml.in b/interface-definitions/service_salt-minion.xml.in
similarity index 99%
rename from interface-definitions/salt-minion.xml.in
rename to interface-definitions/service_salt-minion.xml.in
index c3219cff3..eaa2899f4 100644
--- a/interface-definitions/salt-minion.xml.in
+++ b/interface-definitions/service_salt-minion.xml.in
@@ -1,74 +1,74 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="salt-minion" owner="${vyos_conf_scripts_dir}/salt-minion.py">
+      <node name="salt-minion" owner="${vyos_conf_scripts_dir}/service_salt-minion.py">
         <properties>
           <help>Salt Minion</help>
           <priority>500</priority>
         </properties>
         <children>
           <leafNode name="hash">
             <properties>
               <help>Hash used when discovering file on master server (default: sha256)</help>
               <completionHelp>
                 <list>md5 sha1 sha224 sha256 sha384 sha512</list>
               </completionHelp>
               <constraint>
                 <regex>(md5|sha1|sha224|sha256|sha384|sha512)</regex>
               </constraint>
             </properties>
             <defaultValue>sha256</defaultValue>
           </leafNode>
           <leafNode name="master">
             <properties>
               <help>Hostname or IP address of the Salt master server</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Salt server IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>Salt server IPv6 address</description>
               </valueHelp>
               <valueHelp>
                 <format>hostname</format>
                 <description>Salt server FQDN address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
                 <validator name="fqdn"/>
               </constraint>
               <constraintErrorMessage>Invalid FQDN or IP address</constraintErrorMessage>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="id">
             <properties>
               <help>Explicitly declare ID for this minion to use (default: hostname)</help>
             </properties>
           </leafNode>
           <leafNode name="interval">
             <properties>
               <help>Interval in minutes between updates (default: 60)</help>
               <valueHelp>
                 <format>u32:1-1440</format>
                 <description>Update interval in minutes</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-1440"/>
               </constraint>
             </properties>
             <defaultValue>60</defaultValue>
           </leafNode>
           <leafNode name="master-key">
             <properties>
               <help>URL with signature of master for auth reply verification</help>
             </properties>
           </leafNode>
           #include <include/source-interface.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-sla.xml.in b/interface-definitions/service_sla.xml.in
similarity index 100%
rename from interface-definitions/service-sla.xml.in
rename to interface-definitions/service_sla.xml.in
diff --git a/interface-definitions/snmp.xml.in b/interface-definitions/service_snmp.xml.in
similarity index 99%
rename from interface-definitions/snmp.xml.in
rename to interface-definitions/service_snmp.xml.in
index ec2151b98..e16e9daa1 100644
--- a/interface-definitions/snmp.xml.in
+++ b/interface-definitions/service_snmp.xml.in
@@ -1,598 +1,598 @@
 <?xml version="1.0"?>
 <!-- SNMP forwarder configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="snmp" owner="${vyos_conf_scripts_dir}/snmp.py">
+      <node name="snmp" owner="${vyos_conf_scripts_dir}/service_snmp.py">
         <properties>
           <help>Simple Network Management Protocol (SNMP)</help>
           <priority>900</priority>
         </properties>
         <children>
           <tagNode name="community">
             <properties>
               <help>Community name</help>
               <constraint>
                 <regex>[[:alnum:]-_!@*#]{1,100}</regex>
               </constraint>
               <constraintErrorMessage>Community string is limited to alphanumerical characters, -, _, !, @, *, and # with a total lenght of 100</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="authorization">
                 <properties>
                   <help>Authorization type</help>
                   <completionHelp>
                     <list>ro rw</list>
                   </completionHelp>
                   <valueHelp>
                     <format>ro</format>
                     <description>Read-Only</description>
                   </valueHelp>
                   <valueHelp>
                     <format>rw</format>
                     <description>Read-Write</description>
                   </valueHelp>
                   <constraint>
                     <regex>(ro|rw)</regex>
                   </constraint>
                   <constraintErrorMessage>Authorization type must be either 'rw' or 'ro'</constraintErrorMessage>
                 </properties>
                 <defaultValue>ro</defaultValue>
               </leafNode>
               <leafNode name="client">
                 <properties>
                   <help>IP address of SNMP client allowed to contact system</help>
                   <constraint>
                     <validator name="ipv4-address"/>
                     <validator name="ipv6-address"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="network">
                 <properties>
                   <help>Subnet of SNMP client(s) allowed to contact system</help>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IP address and prefix length</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 address and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
                 <defaultValue>0.0.0.0/0 ::/0</defaultValue>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="contact">
             <properties>
               <help>Contact information</help>
               <constraint>
                 <regex>.{1,255}</regex>
               </constraint>
               <constraintErrorMessage>Contact information is limited to 255 characters or less</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/generic-description.xml.i>
           <node name="mib">
             <properties>
               <help>Management information base (MIB)</help>
             </properties>
             <children>
               <leafNode name="interface-max">
                 <properties>
                   <help>Sets the maximum number of interfaces included in IF-MIB data collection</help>
                   <valueHelp>
                     <format>u32:1-4294967295</format>
                     <description>Sets the maximum number of interfaces included in IF-MIB data collection</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-4294967295"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="interface">
                 <properties>
                   <help>Sets the interface name prefix to include in the IF-MIB data collection</help>
                   <completionHelp>
                     <list>br bond dum eth gnv macsec peth sstpc tun veth vti vtun vxlan wg wlan wwan</list>
                   </completionHelp>
                   <valueHelp>
                     <format>br</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>bond</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>dum</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>eth</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>gnv</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>macsec</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>peth</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>sstpc</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>tun</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>veth</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>vti</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>vtun</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>vxlan</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>wg</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>wlan</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <valueHelp>
                     <format>wwan</format>
                     <description>Allow prefix for IF-MIB data collection</description>
                   </valueHelp>
                   <constraint>
                     <regex>(br|bond|dum|eth|gnv|macsec|peth|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)</regex>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <tagNode name="listen-address">
             <properties>
               <help>IP address to listen for incoming SNMP requests</help>
               <completionHelp>
                 <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
               </completionHelp>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 address to listen for incoming SNMP requests</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address to listen for incoming SNMP requests</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
             </properties>
             <children>
               #include <include/port-number.xml.i>
               <leafNode name="port">
                 <defaultValue>161</defaultValue>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="location">
             <properties>
               <help>Location information</help>
               <constraint>
                 <regex>.{1,255}</regex>
               </constraint>
               <constraintErrorMessage>Location is limited to 255 characters or less</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="oid-enable">
             <properties>
               <help>Enable specific OIDs that by default are disable</help>
               <completionHelp>
                 <list>ip-forward ip-route-table ip-net-to-media-table ip-net-to-physical-phys-address</list>
               </completionHelp>
               <valueHelp>
                 <format>ip-forward</format>
                 <description>Enable ipForward: .1.3.6.1.2.1.4.24</description>
               </valueHelp>
               <valueHelp>
                 <format>ip-route-table</format>
                 <description>Enable ipRouteTable: .1.3.6.1.2.1.4.21</description>
               </valueHelp>
               <valueHelp>
                 <format>ip-net-to-media-table</format>
                 <description>Enable ipNetToMediaTable: .1.3.6.1.2.1.4.22</description>
               </valueHelp>
               <valueHelp>
                 <format>ip-net-to-physical-phys-address</format>
                 <description>Enable ipNetToPhysicalPhysAddress: .1.3.6.1.2.1.4.35</description>
               </valueHelp>
               <constraint>
                 <regex>(ip-forward|ip-route-table|ip-net-to-media-table|ip-net-to-physical-phys-address)</regex>
               </constraint>
               <constraintErrorMessage>OID must be one of the liste options</constraintErrorMessage>
               <multi/>
             </properties>
           </leafNode>
           #include <include/protocol-tcp-udp.xml.i>
           <leafNode name="smux-peer">
             <properties>
               <help>Register a subtree for SMUX-based processing</help>
               <valueHelp>
                 <format>txt</format>
                 <description>SNMP Object Identifier</description>
               </valueHelp>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="trap-source">
             <properties>
               <help>SNMP trap source address</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
             </properties>
           </leafNode>
           <tagNode name="trap-target">
             <properties>
               <help>Address of trap target</help>
               <valueHelp>
                 <format>ipv4</format>
                 <description>IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>IPv6 address</description>
               </valueHelp>
               <constraint>
                 <validator name="ip-address"/>
               </constraint>
             </properties>
             <children>
               <leafNode name="community">
                 <properties>
                   <help>Community used when sending trap information</help>
                 </properties>
               </leafNode>
               #include <include/port-number.xml.i>
               <leafNode name="port">
                 <defaultValue>162</defaultValue>
               </leafNode>
             </children>
           </tagNode>
           <node name="v3">
             <properties>
               <help>Simple Network Management Protocol (SNMP) v3</help>
             </properties>
             <children>
               <leafNode name="engineid">
                 <properties>
                   <help>Specifies the EngineID that uniquely identify an agent (e.g. 000000000000000000000002)</help>
                   <constraint>
                     <regex>([0-9a-f][0-9a-f]){1,18}</regex>
                   </constraint>
                   <constraintErrorMessage>ID must contain an even number (from 2 to 36) of hex digits</constraintErrorMessage>
                 </properties>
                 <defaultValue></defaultValue>
               </leafNode>
               <tagNode name="group">
                 <properties>
                   <help>Specifies the group with name groupname</help>
                 </properties>
                 <children>
                   #include <include/snmp/access-mode.xml.i>
                   <leafNode name="seclevel">
                     <properties>
                       <help>Security levels</help>
                       <completionHelp>
                         <list>noauth auth priv</list>
                       </completionHelp>
                       <valueHelp>
                         <format>noauth</format>
                         <description>Messages not authenticated and not encrypted (noAuthNoPriv)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>auth</format>
                         <description>Messages are authenticated but not encrypted (authNoPriv)</description>
                       </valueHelp>
                       <valueHelp>
                         <format>priv</format>
                         <description>Messages are authenticated and encrypted (authPriv)</description>
                       </valueHelp>
                       <constraint>
                         <regex>(noauth|auth|priv)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>auth</defaultValue>
                   </leafNode>
                   <leafNode name="view">
                     <properties>
                       <help>Defines the name of view</help>
                       <completionHelp>
                         <path>service snmp v3 view</path>
                       </completionHelp>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <tagNode name="trap-target">
                 <properties>
                   <help>Defines SNMP target for inform or traps for IP</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IP address of trap target</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address of trap target</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                     <validator name="ipv6-address"/>
                   </constraint>
                 </properties>
                 <children>
                   <node name="auth">
                     <properties>
                       <help>Defines the privacy</help>
                     </properties>
                     <children>
                       <leafNode name="encrypted-password">
                         <properties>
                           <help>Defines the encrypted key for authentication</help>
                           <constraint>
                             <regex>[0-9a-f]*</regex>
                           </constraint>
                           <constraintErrorMessage>Encrypted key must only contain hex digits</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="plaintext-password">
                         <properties>
                           <help>Defines the clear text key for authentication</help>
                           <constraint>
                             <regex>.{8,}</regex>
                           </constraint>
                           <constraintErrorMessage>Key must contain 8 or more characters</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       #include <include/snmp/authentication-type.xml.i>
                     </children>
                   </node>
                   #include <include/port-number.xml.i>
                   <leafNode name="port">
                     <defaultValue>162</defaultValue>
                   </leafNode>
                   <node name="privacy">
                     <properties>
                       <help>Defines the privacy</help>
                     </properties>
                     <children>
                       <leafNode name="encrypted-password">
                         <properties>
                           <help>Defines the encrypted key for privacy protocol</help>
                           <constraint>
                             <regex>[0-9a-f]*</regex>
                           </constraint>
                           <constraintErrorMessage>Encrypted key must only contain hex digits</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="plaintext-password">
                         <properties>
                           <help>Defines the clear text key for privacy protocol</help>
                           <constraint>
                             <regex>.{8,}</regex>
                           </constraint>
                           <constraintErrorMessage>Key must contain 8 or more characters</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       #include <include/snmp/privacy-type.xml.i>
                     </children>
                   </node>
                   #include <include/protocol-tcp-udp.xml.i>
                   <leafNode name="type">
                     <properties>
                       <help>Specifies the type of notification between inform and trap</help>
                       <completionHelp>
                         <list>inform trap</list>
                       </completionHelp>
                       <valueHelp>
                         <format>inform</format>
                         <description>Use INFORM</description>
                       </valueHelp>
                       <valueHelp>
                         <format>trap</format>
                         <description>Use TRAP</description>
                       </valueHelp>
                       <constraint>
                         <regex>(inform|trap)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>inform</defaultValue>
                   </leafNode>
                   <leafNode name="user">
                     <properties>
                       <help>Defines username for authentication</help>
                       <completionHelp>
                         <path>service snmp v3 user</path>
                       </completionHelp>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
               <tagNode name="user">
                 <properties>
                   <help>Specifies the user with name username</help>
                   <constraint>
                     <regex>[^\(\)\|\-]+</regex>
                   </constraint>
                   <constraintErrorMessage>Illegal characters in name</constraintErrorMessage>
                 </properties>
                 <children>
                   <node name="auth">
                     <properties>
                       <help>Specifies the auth</help>
                     </properties>
                     <children>
                       <leafNode name="encrypted-password">
                         <properties>
                           <help>Defines the encrypted key for authentication</help>
                           <constraint>
                             <regex>[0-9a-f]*</regex>
                           </constraint>
                           <constraintErrorMessage>Encrypted key must only contain hex digits</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="plaintext-password">
                         <properties>
                           <help>Defines the clear text key for authentication</help>
                           <constraint>
                             <regex>.{8,}</regex>
                           </constraint>
                           <constraintErrorMessage>Key must contain 8 or more characters</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       #include <include/snmp/authentication-type.xml.i>
                     </children>
                   </node>
                   <leafNode name="group">
                     <properties>
                       <help>Specifies group for user name</help>
                       <completionHelp>
                         <path>service snmp v3 group</path>
                       </completionHelp>
                     </properties>
                   </leafNode>
                   #include <include/snmp/access-mode.xml.i>
                   <node name="privacy">
                     <properties>
                       <help>Defines the privacy</help>
                     </properties>
                     <children>
                       <leafNode name="encrypted-password">
                         <properties>
                           <help>Defines the encrypted key for privacy protocol</help>
                           <constraint>
                             <regex>[0-9a-f]*</regex>
                           </constraint>
                           <constraintErrorMessage>Encrypted key must only contain hex digits</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       <leafNode name="plaintext-password">
                         <properties>
                           <help>Defines the clear text key for privacy protocol</help>
                           <constraint>
                             <regex>.{8,}</regex>
                           </constraint>
                           <constraintErrorMessage>Key must contain 8 or more characters</constraintErrorMessage>
                         </properties>
                       </leafNode>
                       #include <include/snmp/privacy-type.xml.i>
                     </children>
                   </node>
                 </children>
               </tagNode>
               <tagNode name="view">
                 <properties>
                   <help>Specifies the view with name viewname</help>
                   <constraint>
                     <regex>[^\(\)\|\-]+</regex>
                   </constraint>
                   <constraintErrorMessage>Illegal characters in name</constraintErrorMessage>
                 </properties>
                 <children>
                   <tagNode name="oid">
                     <properties>
                       <help>Specifies the oid</help>
                       <constraint>
                         <regex>[0-9]+(\.[0-9]+)*</regex>
                       </constraint>
                       <constraintErrorMessage>OID must start from a number</constraintErrorMessage>
                     </properties>
                     <children>
                       <leafNode name="exclude">
                         <properties>
                           <help>Exclude is an optional argument</help>
                         </properties>
                       </leafNode>
                       <leafNode name="mask">
                         <properties>
                           <help>Defines a bit-mask that is indicating which subidentifiers of the associated subtree OID should be regarded as significant</help>
                           <constraint>
                             <regex>[0-9a-f]{2}([\.:][0-9a-f]{2})*</regex>
                           </constraint>
                           <constraintErrorMessage>MASK is a list of hex octets, separated by '.' or ':'</constraintErrorMessage>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                 </children>
               </tagNode>
             </children>
           </node>
           <node name="script-extensions">
             <properties>
               <help>SNMP script extensions</help>
             </properties>
             <children>
               <tagNode name="extension-name">
                 <properties>
                   <help>Extension name</help>
                   <constraint>
                     <regex>[a-z0-9\.\-\_]+</regex>
                   </constraint>
                   <constraintErrorMessage>Script extension contains invalid characters</constraintErrorMessage>
                 </properties>
                 <children>
                   <leafNode name="script">
                     <properties>
                       <help>Script location and name</help>
                       <completionHelp>
                         <script>ls /config/user-data</script>
                       </completionHelp>
                       <constraint>
                         <regex>[a-z0-9\.\-\_\/]+</regex>
                       </constraint>
                       <constraintErrorMessage>Script extension contains invalid characters</constraintErrorMessage>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/ssh.xml.in b/interface-definitions/service_ssh.xml.in
similarity index 99%
rename from interface-definitions/ssh.xml.in
rename to interface-definitions/service_ssh.xml.in
index 2bcce2cf0..5c893bd35 100644
--- a/interface-definitions/ssh.xml.in
+++ b/interface-definitions/service_ssh.xml.in
@@ -1,270 +1,270 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="service">
     <properties>
       <help>System services</help>
     </properties>
     <children>
-      <node name="ssh" owner="${vyos_conf_scripts_dir}/ssh.py">
+      <node name="ssh" owner="${vyos_conf_scripts_dir}/service_ssh.py">
         <properties>
           <help>Secure Shell (SSH)</help>
           <priority>1000</priority>
         </properties>
         <children>
           <node name="access-control">
             <properties>
               <help>SSH user/group access controls</help>
             </properties>
             <children>
               <node name="allow">
                 <properties>
                   <help>Allow user/group SSH access</help>
                 </properties>
                 <children>
                   #include <include/ssh-group.xml.i>
                   #include <include/ssh-user.xml.i>
                 </children>
               </node>
               <node name="deny">
                 <properties>
                   <help>Deny user/group SSH access</help>
                 </properties>
                 <children>
                   #include <include/ssh-group.xml.i>
                   #include <include/ssh-user.xml.i>
                 </children>
               </node>
             </children>
           </node>
           <leafNode name="ciphers">
             <properties>
               <help>Allowed ciphers</help>
               <completionHelp>
                 <!-- generated by ssh -Q cipher | tr '\n' ' ' as this will not change dynamically  -->
                 <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list>
               </completionHelp>
                 <constraint>
                   <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|rijndael-cbc@lysator.liu.se|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex>
                 </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="disable-host-validation">
             <properties>
               <help>Disable IP Address to Hostname lookup</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="disable-password-authentication">
             <properties>
               <help>Disable password-based authentication</help>
               <valueless/>
             </properties>
           </leafNode>
           <node name="dynamic-protection">
             <properties>
               <help>Allow dynamic protection</help>
             </properties>
             <children>
               <leafNode name="block-time">
                 <properties>
                   <help>Block source IP in seconds. Subsequent blocks increase by a factor of 1.5</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Time interval in seconds for blocking</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
                 <defaultValue>120</defaultValue>
               </leafNode>
               <leafNode name="detect-time">
                 <properties>
                   <help>Remember source IP in seconds before reset their score</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Time interval in seconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
                 <defaultValue>1800</defaultValue>
               </leafNode>
               <leafNode name="threshold">
                 <properties>
                   <help>Block source IP when their cumulative attack score exceeds threshold</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Threshold score</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
                 <defaultValue>30</defaultValue>
               </leafNode>
               <leafNode name="allow-from">
                 <properties>
                   <help>Always allow inbound connections from these systems</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>Address to match against</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv4net</format>
                     <description>IPv4 address and prefix length</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address to match against</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6net</format>
                     <description>IPv6 address and prefix length</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                     <validator name="ip-prefix"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="hostkey-algorithm">
             <properties>
               <help>Allowed host key signature algorithms</help>
               <completionHelp>
                 <!-- generated by ssh -Q HostKeyAlgorithms | tr '\n' ' ' as this will not change dynamically  -->
                 <list>ssh-ed25519 ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com sk-ssh-ed25519-cert-v01@openssh.com ssh-rsa rsa-sha2-256 rsa-sha2-512 ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com webauthn-sk-ecdsa-sha2-nistp256@openssh.com ssh-rsa-cert-v01@openssh.com rsa-sha2-256-cert-v01@openssh.com rsa-sha2-512-cert-v01@openssh.com ssh-dss-cert-v01@openssh.com ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521-cert-v01@openssh.com sk-ecdsa-sha2-nistp256-cert-v01@openssh.com</list>
               </completionHelp>
               <multi/>
               <constraint>
                 <regex>(ssh-ed25519|ssh-ed25519-cert-v01@openssh.com|sk-ssh-ed25519@openssh.com|sk-ssh-ed25519-cert-v01@openssh.com|ssh-rsa|rsa-sha2-256|rsa-sha2-512|ssh-dss|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ecdsa-sha2-nistp256@openssh.com|webauthn-sk-ecdsa-sha2-nistp256@openssh.com|ssh-rsa-cert-v01@openssh.com|rsa-sha2-256-cert-v01@openssh.com|rsa-sha2-512-cert-v01@openssh.com|ssh-dss-cert-v01@openssh.com|ecdsa-sha2-nistp256-cert-v01@openssh.com|ecdsa-sha2-nistp384-cert-v01@openssh.com|ecdsa-sha2-nistp521-cert-v01@openssh.com|sk-ecdsa-sha2-nistp256-cert-v01@openssh.com)</regex>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="key-exchange">
             <properties>
               <help>Allowed key exchange (KEX) algorithms</help>
               <completionHelp>
                 <!-- generated by ssh -Q kex | tr '\n' ' ' as this will not change dynamically  -->
                 <list>diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 curve25519-sha256 curve25519-sha256@libssh.org</list>
               </completionHelp>
               <multi/>
               <constraint>
                 <regex>(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group14-sha256|diffie-hellman-group16-sha512|diffie-hellman-group18-sha512|diffie-hellman-group-exchange-sha1|diffie-hellman-group-exchange-sha256|ecdh-sha2-nistp256|ecdh-sha2-nistp384|ecdh-sha2-nistp521|curve25519-sha256|curve25519-sha256@libssh.org)</regex>
               </constraint>
             </properties>
           </leafNode>
           #include <include/listen-address.xml.i>
           <leafNode name="loglevel">
             <properties>
               <help>Log level</help>
               <completionHelp>
                 <list>quiet fatal error info verbose</list>
               </completionHelp>
               <valueHelp>
                 <format>quiet</format>
                 <description>stay silent</description>
               </valueHelp>
               <valueHelp>
                 <format>fatal</format>
                 <description>log fatals only</description>
               </valueHelp>
               <valueHelp>
                 <format>error</format>
                 <description>log errors and fatals only</description>
               </valueHelp>
               <valueHelp>
                 <format>info</format>
                 <description>default log level</description>
               </valueHelp>
               <valueHelp>
                 <format>verbose</format>
                 <description>enable logging of failed login attempts</description>
               </valueHelp>
               <constraint>
                 <regex>(quiet|fatal|error|info|verbose)</regex>
               </constraint>
             </properties>
             <defaultValue>info</defaultValue>
           </leafNode>
           <leafNode name="mac">
             <properties>
               <help>Allowed message authentication code (MAC) algorithms</help>
               <completionHelp>
                 <!-- generated by ssh -Q mac | tr '\n' ' ' as this will not change dynamically  -->
                 <list>hmac-sha1 hmac-sha1-96 hmac-sha2-256 hmac-sha2-512 hmac-md5 hmac-md5-96 umac-64@openssh.com umac-128@openssh.com hmac-sha1-etm@openssh.com hmac-sha1-96-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com hmac-md5-etm@openssh.com hmac-md5-96-etm@openssh.com umac-64-etm@openssh.com umac-128-etm@openssh.com</list>
               </completionHelp>
               <constraint>
                 <regex>(hmac-sha1|hmac-sha1-96|hmac-sha2-256|hmac-sha2-512|hmac-md5|hmac-md5-96|umac-64@openssh.com|umac-128@openssh.com|hmac-sha1-etm@openssh.com|hmac-sha1-96-etm@openssh.com|hmac-sha2-256-etm@openssh.com|hmac-sha2-512-etm@openssh.com|hmac-md5-etm@openssh.com|hmac-md5-96-etm@openssh.com|umac-64-etm@openssh.com|umac-128-etm@openssh.com)</regex>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="port">
             <properties>
               <help>Port for SSH service</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Numeric IP port</description>
               </valueHelp>
               <multi/>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
             <defaultValue>22</defaultValue>
           </leafNode>
           <node name="rekey">
             <properties>
               <help>SSH session rekey limit</help>
             </properties>
             <children>
               <leafNode name="data">
                 <properties>
                   <help>Threshold data in megabytes</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Megabytes</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="time">
                 <properties>
                   <help>Threshold time in minutes</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Minutes</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="client-keepalive-interval">
             <properties>
               <help>Enable transmission of keepalives from server to client</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Time interval in seconds for keepalive message</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
             </properties>
           </leafNode>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/tftp-server.xml.in b/interface-definitions/service_tftp-server.xml.in
similarity index 91%
rename from interface-definitions/tftp-server.xml.in
rename to interface-definitions/service_tftp-server.xml.in
index 8ca4da883..e48b5a3f0 100644
--- a/interface-definitions/tftp-server.xml.in
+++ b/interface-definitions/service_tftp-server.xml.in
@@ -1,32 +1,32 @@
 <?xml version="1.0"?>
 <!-- TFTP configuration -->
 <interfaceDefinition>
   <node name="service">
     <children>
-      <node name="tftp-server" owner="${vyos_conf_scripts_dir}/tftp_server.py">
+      <node name="tftp-server" owner="${vyos_conf_scripts_dir}/service_tftp-server.py">
         <properties>
           <help>Trivial File Transfer Protocol (TFTP) server</help>
           <priority>990</priority>
         </properties>
         <children>
           <leafNode name="directory">
             <properties>
               <help>Folder containing files served by TFTP</help>
             </properties>
           </leafNode>
           <leafNode name="allow-upload">
             <properties>
               <help>Allow TFTP file uploads</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/port-number.xml.i>
           <leafNode name="port">
             <defaultValue>69</defaultValue>
           </leafNode>
           #include <include/listen-address-vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/service-upnp.xml.in b/interface-definitions/service_upnp.xml.in
similarity index 100%
rename from interface-definitions/service-upnp.xml.in
rename to interface-definitions/service_upnp.xml.in
diff --git a/interface-definitions/service-webproxy.xml.in b/interface-definitions/service_webproxy.xml.in
similarity index 100%
rename from interface-definitions/service-webproxy.xml.in
rename to interface-definitions/service_webproxy.xml.in
diff --git a/interface-definitions/system-acceleration-qat.xml.in b/interface-definitions/system_acceleration.xml.in
similarity index 95%
rename from interface-definitions/system-acceleration-qat.xml.in
rename to interface-definitions/system_acceleration.xml.in
index 812484184..fb5c9d4ea 100644
--- a/interface-definitions/system-acceleration-qat.xml.in
+++ b/interface-definitions/system_acceleration.xml.in
@@ -1,21 +1,21 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="acceleration" owner="${vyos_conf_scripts_dir}/intel_qat.py">
+      <node name="acceleration" owner="${vyos_conf_scripts_dir}/system_acceleration.py">
         <properties>
           <help>Acceleration components</help>
           <priority>50</priority>
         </properties>
         <children>
         <leafNode name="qat">
           <properties>
             <help>Enable Intel QAT (Quick Assist Technology) for cryptographic acceleration</help>
             <valueless/>
           </properties>
         </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-config-mgmt.xml.in b/interface-definitions/system_config-management.xml.in
similarity index 98%
rename from interface-definitions/system-config-mgmt.xml.in
rename to interface-definitions/system_config-management.xml.in
index 61089ce34..7ae347955 100644
--- a/interface-definitions/system-config-mgmt.xml.in
+++ b/interface-definitions/system_config-management.xml.in
@@ -1,82 +1,82 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="config-management" owner="${vyos_conf_scripts_dir}/config_mgmt.py">
+      <node name="config-management" owner="${vyos_conf_scripts_dir}/system_config-management.py">
         <properties>
           <help>Configuration management settings</help>
           <priority>400</priority>
         </properties>
         <children>
           <node name="commit-archive">
             <properties>
               <help>Commit archive settings</help>
             </properties>
             <children>
               <leafNode name="location">
                 <properties>
                   <help>Commit archive location</help>
                   <valueHelp>
                     <format>http://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>https://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>ftp://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>sftp://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>scp://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>tftp://&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <valueHelp>
                     <format>git+https://&lt;user&gt;:&lt;passwd&gt;@&lt;host&gt;/&lt;path&gt;</format>
                     <description/>
                   </valueHelp>
                   <constraint>
                     <validator name="url --file-transport"/>
                     <regex>(ssh|git|git\+(\w+)):\/\/.*</regex>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
               <leafNode name="source-address">
                 <properties>
                   <help>Source address or interface for archive server connections</help>
                   <constraint>
                     <validator name="ip-address"/>
                     #include <include/constraint/interface-name.xml.i>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="commit-revisions">
             <properties>
               <help>Commit revisions</help>
               <valueHelp>
                 <format>u32:1-65535</format>
                 <description>Number of config backups to keep</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65535"/>
               </constraint>
               <constraintErrorMessage>Number of revisions must be between 0 and 65535</constraintErrorMessage>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-conntrack.xml.in b/interface-definitions/system_conntrack.xml.in
similarity index 99%
rename from interface-definitions/system-conntrack.xml.in
rename to interface-definitions/system_conntrack.xml.in
index d9504544d..a348097cc 100644
--- a/interface-definitions/system-conntrack.xml.in
+++ b/interface-definitions/system_conntrack.xml.in
@@ -1,513 +1,513 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="conntrack" owner="${vyos_conf_scripts_dir}/conntrack.py">
+      <node name="conntrack" owner="${vyos_conf_scripts_dir}/system_conntrack.py">
         <properties>
           <help>Connection Tracking Engine Options</help>
           <!-- Before NAT and conntrack-sync are configured -->
           <priority>218</priority>
         </properties>
         <children>
           <leafNode name="flow-accounting">
             <properties>
               <help>Enable connection tracking flow accounting</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="expect-table-size">
             <properties>
               <help>Size of connection tracking expect table</help>
               <valueHelp>
                 <format>u32:1-50000000</format>
                 <description>Number of entries allowed in connection tracking expect table</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-50000000"/>
               </constraint>
             </properties>
             <defaultValue>2048</defaultValue>
           </leafNode>
           <leafNode name="hash-size">
             <properties>
               <help>Hash size for connection tracking table</help>
               <valueHelp>
                 <format>u32:1-50000000</format>
                 <description>Size of hash to use for connection tracking table</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-50000000"/>
               </constraint>
             </properties>
             <defaultValue>32768</defaultValue>
           </leafNode>
           <node name="ignore">
             <properties>
               <help>Customized rules to ignore selective connection tracking</help>
             </properties>
             <children>
               <node name="ipv4">
                 <properties>
                   <help>IPv4 rules</help>
                 </properties>
                 <children>
                   <tagNode name="rule">
                     <properties>
                       <help>Rule number</help>
                       <valueHelp>
                         <format>u32:1-999999</format>
                         <description>Number of conntrack ignore rule</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-999999"/>
                       </constraint>
                       <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
                     </properties>
                     <children>
                       #include <include/generic-description.xml.i>
                       <node name="destination">
                         <properties>
                           <help>Destination parameters</help>
                         </properties>
                         <children>
                           #include <include/firewall/source-destination-group-ipv4.xml.i>
                           #include <include/nat-address.xml.i>
                           #include <include/nat-port.xml.i>
                         </children>
                       </node>
                       <leafNode name="inbound-interface">
                         <properties>
                           <help>Interface to ignore connections tracking on</help>
                           <completionHelp>
                             <list>any</list>
                             <script>${vyos_completion_dir}/list_interfaces</script>
                           </completionHelp>
                         </properties>
                       </leafNode>
                       #include <include/ip-protocol.xml.i>
                       <leafNode name="protocol">
                         <properties>
                           <help>Protocol to match (protocol name, number, or "all")</help>
                           <completionHelp>
                             <script>${vyos_completion_dir}/list_protocols.sh</script>
                             <list>all tcp_udp</list>
                           </completionHelp>
                           <valueHelp>
                             <format>all</format>
                             <description>All IP protocols</description>
                           </valueHelp>
                           <valueHelp>
                             <format>tcp_udp</format>
                             <description>Both TCP and UDP</description>
                           </valueHelp>
                           <valueHelp>
                             <format>u32:0-255</format>
                             <description>IP protocol number</description>
                           </valueHelp>
                           <valueHelp>
                             <format>&lt;protocol&gt;</format>
                             <description>IP protocol name</description>
                           </valueHelp>
                           <valueHelp>
                             <format>!&lt;protocol&gt;</format>
                             <description>IP protocol name</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ip-protocol"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <node name="source">
                         <properties>
                           <help>Source parameters</help>
                         </properties>
                         <children>
                           #include <include/firewall/source-destination-group-ipv4.xml.i>
                           #include <include/nat-address.xml.i>
                           #include <include/nat-port.xml.i>
                         </children>
                       </node>
                       #include <include/firewall/tcp-flags.xml.i>
                     </children>
                   </tagNode>
                 </children>
               </node>
               <node name="ipv6">
                 <properties>
                   <help>IPv6 rules</help>
                 </properties>
                 <children>
                   <tagNode name="rule">
                     <properties>
                       <help>Rule number</help>
                       <valueHelp>
                         <format>u32:1-999999</format>
                         <description>Number of conntrack ignore rule</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-999999"/>
                       </constraint>
                       <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
                     </properties>
                     <children>
                       #include <include/generic-description.xml.i>
                       <node name="destination">
                         <properties>
                           <help>Destination parameters</help>
                         </properties>
                         <children>
                           #include <include/firewall/address-ipv6.xml.i>
                           #include <include/firewall/source-destination-group-ipv6.xml.i>
                           #include <include/nat-port.xml.i>
                         </children>
                       </node>
                       <leafNode name="inbound-interface">
                         <properties>
                           <help>Interface to ignore connections tracking on</help>
                           <completionHelp>
                             <list>any</list>
                             <script>${vyos_completion_dir}/list_interfaces</script>
                           </completionHelp>
                         </properties>
                       </leafNode>
                       #include <include/ip-protocol.xml.i>
                       <leafNode name="protocol">
                         <properties>
                           <help>Protocol to match (protocol name, number, or "all")</help>
                           <completionHelp>
                             <script>${vyos_completion_dir}/list_protocols.sh</script>
                             <list>all tcp_udp</list>
                           </completionHelp>
                           <valueHelp>
                             <format>all</format>
                             <description>All IP protocols</description>
                           </valueHelp>
                           <valueHelp>
                             <format>tcp_udp</format>
                             <description>Both TCP and UDP</description>
                           </valueHelp>
                           <valueHelp>
                             <format>u32:0-255</format>
                             <description>IP protocol number</description>
                           </valueHelp>
                           <valueHelp>
                             <format>&lt;protocol&gt;</format>
                             <description>IP protocol name</description>
                           </valueHelp>
                           <valueHelp>
                             <format>!&lt;protocol&gt;</format>
                             <description>IP protocol name</description>
                           </valueHelp>
                           <constraint>
                             <validator name="ip-protocol"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <node name="source">
                         <properties>
                           <help>Source parameters</help>
                         </properties>
                         <children>
                           #include <include/firewall/address-ipv6.xml.i>
                           #include <include/firewall/source-destination-group-ipv6.xml.i>
                           #include <include/nat-port.xml.i>
                         </children>
                       </node>
                       #include <include/firewall/tcp-flags.xml.i>
                     </children>
                   </tagNode>
                 </children>
               </node>
-              
+
             </children>
           </node>
           <node name="log">
             <properties>
               <help>Log connection tracking events per protocol</help>
             </properties>
             <children>
               <node name="icmp">
                 <properties>
                   <help>Log connection tracking events for ICMP</help>
                 </properties>
                 <children>
                   #include <include/conntrack/log-common.xml.i>
                 </children>
               </node>
               <node name="other">
                 <properties>
                   <help>Log connection tracking events for all protocols other than TCP, UDP and ICMP</help>
                 </properties>
                 <children>
                   #include <include/conntrack/log-common.xml.i>
                 </children>
               </node>
               <node name="tcp">
                 <properties>
                   <help>Log connection tracking events for TCP</help>
                 </properties>
                 <children>
                   #include <include/conntrack/log-common.xml.i>
                 </children>
               </node>
               <node name="udp">
                 <properties>
                   <help>Log connection tracking events for UDP</help>
                 </properties>
                 <children>
                   #include <include/conntrack/log-common.xml.i>
                 </children>
               </node>
             </children>
           </node>
           <node name="modules">
             <properties>
               <help>Connection tracking modules</help>
             </properties>
             <children>
               <leafNode name="ftp">
                 <properties>
                   <help>FTP connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="h323">
                 <properties>
                   <help>H.323 connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="nfs">
                 <properties>
                   <help>NFS connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="pptp">
                 <properties>
                   <help>PPTP connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="sip">
                 <properties>
                   <help>SIP connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="sqlnet">
                 <properties>
                   <help>SQLnet connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="tftp">
                 <properties>
                   <help>TFTP connection tracking</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <leafNode name="table-size">
             <properties>
               <help>Size of connection tracking table</help>
               <valueHelp>
                 <format>u32:1-50000000</format>
                 <description>Number of entries allowed in connection tracking table</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-50000000"/>
               </constraint>
             </properties>
             <defaultValue>262144</defaultValue>
           </leafNode>
           <node name="tcp">
             <properties>
               <help>TCP options</help>
             </properties>
             <children>
               <leafNode name="half-open-connections">
                 <properties>
                   <help>Maximum number of TCP half-open connections</help>
                   <valueHelp>
                     <format>u32:1-2147483647</format>
                     <description>Generic connection timeout in seconds</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-2147483647"/>
                   </constraint>
                 </properties>
                 <defaultValue>512</defaultValue>
               </leafNode>
               <leafNode name="loose">
                 <properties>
                   <help>Policy to track previously established connections</help>
                   <completionHelp>
                     <list>enable disable</list>
                   </completionHelp>
                   <valueHelp>
                     <format>enable</format>
                     <description>Allow tracking of previously established connections</description>
                   </valueHelp>
                   <valueHelp>
                     <format>disable</format>
                     <description>Do not allow tracking of previously established connections</description>
                   </valueHelp>
                   <constraint>
                     <regex>(enable|disable)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>enable</defaultValue>
               </leafNode>
               <leafNode name="max-retrans">
                 <properties>
                   <help>Maximum number of packets that can be retransmitted without received an ACK</help>
                   <valueHelp>
                     <format>u32:1-255</format>
                     <description>Number of packets to be retransmitted</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-255"/>
                   </constraint>
                 </properties>
                 <defaultValue>3</defaultValue>
               </leafNode>
             </children>
           </node>
           <node name="timeout">
             <properties>
               <help>Connection timeout options</help>
             </properties>
             <children>
               <node name="custom">
                 <properties>
                   <help>Define custom timeouts per connection</help>
                 </properties>
                 <children>
                   <node name="ipv4">
                     <properties>
                       <help>IPv4 rules</help>
                     </properties>
                     <children>
                       <tagNode name="rule">
                         <properties>
                           <help>Rule number</help>
                           <valueHelp>
                             <format>u32:1-999999</format>
                             <description>Number of conntrack rule</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-999999"/>
                           </constraint>
                           <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
                         </properties>
                         <children>
                           #include <include/generic-description.xml.i>
                           <node name="destination">
                             <properties>
                               <help>Destination parameters</help>
                             </properties>
                             <children>
                               #include <include/nat-address.xml.i>
                               #include <include/nat-port.xml.i>
                             </children>
                           </node>
                           <leafNode name="inbound-interface">
                             <properties>
                               <help>Interface to ignore connections tracking on</help>
                               <completionHelp>
                                 <list>any</list>
                                 <script>${vyos_completion_dir}/list_interfaces</script>
                               </completionHelp>
                             </properties>
                           </leafNode>
                           <node name="protocol">
                             <properties>
                               <help>Customize protocol specific timers, one protocol configuration per rule</help>
                             </properties>
                             <children>
                               #include <include/conntrack/timeout-custom-protocols.xml.i>
                             </children>
                           </node>
                           <node name="source">
                             <properties>
                               <help>Source parameters</help>
                             </properties>
                             <children>
                               #include <include/nat-address.xml.i>
                               #include <include/nat-port.xml.i>
                             </children>
                           </node>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                   <node name="ipv6">
                     <properties>
                       <help>IPv6 rules</help>
                     </properties>
                     <children>
                       <tagNode name="rule">
                         <properties>
                           <help>Rule number</help>
                           <valueHelp>
                             <format>u32:1-999999</format>
                             <description>Number of conntrack rule</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-999999"/>
                           </constraint>
                           <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
                         </properties>
                         <children>
                           #include <include/generic-description.xml.i>
                           <node name="destination">
                             <properties>
                               <help>Destination parameters</help>
                             </properties>
                             <children>
                               #include <include/firewall/address-ipv6.xml.i>
                               #include <include/nat-port.xml.i>
                             </children>
                           </node>
                           <leafNode name="inbound-interface">
                             <properties>
                               <help>Interface to ignore connections tracking on</help>
                               <completionHelp>
                                 <list>any</list>
                                 <script>${vyos_completion_dir}/list_interfaces</script>
                               </completionHelp>
                             </properties>
                           </leafNode>
                           <node name="protocol">
                             <properties>
                               <help>Customize protocol specific timers, one protocol configuration per rule</help>
                             </properties>
                             <children>
                               #include <include/conntrack/timeout-custom-protocols.xml.i>
                             </children>
                           </node>
                           <node name="source">
                             <properties>
                               <help>Source parameters</help>
                             </properties>
                             <children>
                               #include <include/firewall/address-ipv6.xml.i>
                               #include <include/nat-port.xml.i>
                             </children>
                           </node>
                         </children>
                       </tagNode>
                     </children>
                   </node>
                 </children>
               </node>
               #include <include/conntrack/timeout-common-protocols.xml.i>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-console.xml.in b/interface-definitions/system_console.xml.in
similarity index 100%
rename from interface-definitions/system-console.xml.in
rename to interface-definitions/system_console.xml.in
diff --git a/interface-definitions/system_domain-name.xml.in b/interface-definitions/system_domain-name.xml.in
new file mode 100644
index 000000000..bfca9b8ce
--- /dev/null
+++ b/interface-definitions/system_domain-name.xml.in
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="system">
+    <children>
+      <leafNode name="domain-name" owner="${vyos_conf_scripts_dir}/system_host-name.py">
+        <properties>
+          <help>System domain name</help>
+          <constraint>
+            <validator name="fqdn"/>
+          </constraint>
+        </properties>
+      </leafNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/system_domain-search.xml.in b/interface-definitions/system_domain-search.xml.in
new file mode 100644
index 000000000..eb6c8a85c
--- /dev/null
+++ b/interface-definitions/system_domain-search.xml.in
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="system">
+    <children>
+      <leafNode name="domain-search" owner="${vyos_conf_scripts_dir}/system_host-name.py">
+        <properties>
+          <help>Domain Name Server (DNS) domain completion order</help>
+          <priority>400</priority>
+          <constraint>
+            <validator name="fqdn"/>
+          </constraint>
+          <constraintErrorMessage>Invalid domain name (RFC 1123 section 2).\nMay only contain letters, numbers and period.</constraintErrorMessage>
+          <multi/>
+        </properties>
+      </leafNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/flow-accounting-conf.xml.in b/interface-definitions/system_flow-accounting.xml.in
similarity index 99%
rename from interface-definitions/flow-accounting-conf.xml.in
rename to interface-definitions/system_flow-accounting.xml.in
index 40a9bb423..83a2480a3 100644
--- a/interface-definitions/flow-accounting-conf.xml.in
+++ b/interface-definitions/system_flow-accounting.xml.in
@@ -1,437 +1,437 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- flow-accounting configuration -->
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="flow-accounting" owner="${vyos_conf_scripts_dir}/flow_accounting_conf.py">
+      <node name="flow-accounting" owner="${vyos_conf_scripts_dir}/system_flow-accounting.py">
         <properties>
           <help>Flow accounting settings</help>
           <priority>990</priority>
         </properties>
         <children>
           <leafNode name="buffer-size">
             <properties>
               <help>Buffer size</help>
               <valueHelp>
                 <format>u32</format>
                 <description>Buffer size in MiB</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-4294967295"/>
               </constraint>
             </properties>
             <defaultValue>10</defaultValue>
           </leafNode>
           <leafNode name="packet-length">
             <properties>
               <help>Specifies the maximum number of bytes to capture for each packet</help>
               <valueHelp>
                 <format>u32:128-750</format>
                 <description>Packet length in bytes</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 128-750"/>
               </constraint>
             </properties>
             <defaultValue>128</defaultValue>
           </leafNode>
           <leafNode name="enable-egress">
             <properties>
               <help>Enable egress flow accounting</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="disable-imt">
             <properties>
               <help>Disable in memory table plugin</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="syslog-facility">
             <properties>
               <help>Syslog facility for flow-accounting</help>
               <completionHelp>
                 <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
               </completionHelp>
               <valueHelp>
                 <format>auth</format>
                 <description>Authentication and authorization</description>
               </valueHelp>
               <valueHelp>
                 <format>authpriv</format>
                 <description>Non-system authorization</description>
               </valueHelp>
               <valueHelp>
                 <format>cron</format>
                 <description>Cron daemon</description>
               </valueHelp>
               <valueHelp>
                 <format>daemon</format>
                 <description>System daemons</description>
               </valueHelp>
               <valueHelp>
                 <format>kern</format>
                 <description>Kernel</description>
               </valueHelp>
               <valueHelp>
                 <format>lpr</format>
                 <description>Line printer spooler</description>
               </valueHelp>
               <valueHelp>
                 <format>mail</format>
                 <description>Mail subsystem</description>
               </valueHelp>
               <valueHelp>
                 <format>mark</format>
                 <description>Timestamp</description>
               </valueHelp>
               <valueHelp>
                 <format>news</format>
                 <description>USENET subsystem</description>
               </valueHelp>
               <valueHelp>
                 <format>protocols</format>
                 <description>Routing protocols (local7)</description>
               </valueHelp>
               <valueHelp>
                 <format>security</format>
                 <description>Authentication and authorization</description>
               </valueHelp>
               <valueHelp>
                 <format>syslog</format>
                 <description>Authentication and authorization</description>
               </valueHelp>
               <valueHelp>
                 <format>user</format>
                 <description>Application processes</description>
               </valueHelp>
               <valueHelp>
                 <format>uucp</format>
                 <description>UUCP subsystem</description>
               </valueHelp>
               <valueHelp>
                 <format>local0</format>
                 <description>Local facility 0</description>
               </valueHelp>
               <valueHelp>
                 <format>local1</format>
                 <description>Local facility 1</description>
               </valueHelp>
               <valueHelp>
                 <format>local2</format>
                 <description>Local facility 2</description>
               </valueHelp>
               <valueHelp>
                 <format>local3</format>
                 <description>Local facility 3</description>
               </valueHelp>
               <valueHelp>
                 <format>local4</format>
                 <description>Local facility 4</description>
               </valueHelp>
               <valueHelp>
                 <format>local5</format>
                 <description>Local facility 5</description>
               </valueHelp>
               <valueHelp>
                 <format>local6</format>
                 <description>Local facility 6</description>
               </valueHelp>
               <valueHelp>
                 <format>local7</format>
                 <description>Local facility 7</description>
               </valueHelp>
               <valueHelp>
                 <format>all</format>
                 <description>Authentication and authorization</description>
               </valueHelp>
               <constraint>
                 <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
               </constraint>
             </properties>
           </leafNode>
           #include <include/generic-interface-multi.xml.i>
           <node name="netflow">
             <properties>
               <help>NetFlow settings</help>
             </properties>
             <children>
               <leafNode name="engine-id">
                 <properties>
                   <help>NetFlow engine-id</help>
                   <valueHelp>
                     <format>0-255 or 0-255:0-255</format>
                     <description>NetFlow engine-id for v5</description>
                   </valueHelp>
                   <valueHelp>
                     <format>u32</format>
                     <description>NetFlow engine-id for v9 / IPFIX</description>
                   </valueHelp>
                   <constraint>
                    <regex>(\d|[1-9]\d{1,8}|[1-3]\d{9}|4[01]\d{8}|42[0-8]\d{7}|429[0-3]\d{6}|4294[0-8]\d{5}|42949[0-5]\d{4}|429496[0-6]\d{3}|4294967[01]\d{2}|42949672[0-8]\d|429496729[0-5])$|^(\d|[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]):(\d|[1-9]\d|1\d{2}|2[0-4]\d|25[0-5])</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="max-flows">
                 <properties>
                   <help>NetFlow maximum flows</help>
                   <valueHelp>
                     <format>u32</format>
                     <description>NetFlow maximum flows</description>
                   </valueHelp>
                   <constraint>
                    <validator name="numeric" argument="--range 0-4294967295"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="sampling-rate">
                 <properties>
                   <help>NetFlow sampling-rate</help>
                   <valueHelp>
                     <format>u32</format>
                     <description>Sampling rate (1 in N packets)</description>
                   </valueHelp>
                   <constraint>
                    <validator name="numeric" argument="--range 0-4294967295"/>
                   </constraint>
                 </properties>
               </leafNode>
               #include <include/source-address-ipv4-ipv6.xml.i>
               <leafNode name="version">
                 <properties>
                   <help>NetFlow version to export</help>
                   <completionHelp>
                     <list>5 9 10</list>
                   </completionHelp>
                   <valueHelp>
                     <format>5</format>
                     <description>NetFlow version 5</description>
                   </valueHelp>
                   <valueHelp>
                     <format>9</format>
                     <description>NetFlow version 9</description>
                   </valueHelp>
                   <valueHelp>
                     <format>10</format>
                     <description>Internet Protocol Flow Information Export (IPFIX)</description>
                   </valueHelp>
                 </properties>
                 <defaultValue>9</defaultValue>
               </leafNode>
               <tagNode name="server">
                 <properties>
                   <help>NetFlow destination server</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 server to export NetFlow</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 server to export NetFlow</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="port">
                     <properties>
                       <help>NetFlow port number</help>
                       <valueHelp>
                         <format>u32:1025-65535</format>
                         <description>NetFlow port number</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 1025-65535"/>
                       </constraint>
                     </properties>
                     <defaultValue>2055</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               <node name="timeout">
                 <properties>
                   <help>NetFlow timeout values</help>
                 </properties>
                 <children>
                   <leafNode name="expiry-interval">
                     <properties>
                       <help>Expiry scan interval</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>Expiry scan interval</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>60</defaultValue>
                   </leafNode>
                   <leafNode name="flow-generic">
                     <properties>
                       <help>Generic flow timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>Generic flow timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>3600</defaultValue>
                   </leafNode>
                   <leafNode name="icmp">
                     <properties>
                       <help>ICMP timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>ICMP timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>300</defaultValue>
                   </leafNode>
                   <leafNode name="max-active-life">
                     <properties>
                       <help>Max active timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>Max active timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>604800</defaultValue>
                   </leafNode>
                   <leafNode name="tcp-fin">
                     <properties>
                       <help>TCP finish timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>TCP FIN timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>300</defaultValue>
                   </leafNode>
                   <leafNode name="tcp-generic">
                     <properties>
                       <help>TCP generic timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>TCP generic timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>3600</defaultValue>
                   </leafNode>
                   <leafNode name="tcp-rst">
                     <properties>
                       <help>TCP reset timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>TCP RST timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>120</defaultValue>
                   </leafNode>
                   <leafNode name="udp">
                     <properties>
                       <help>UDP timeout value</help>
                       <valueHelp>
                         <format>u32:0-2147483647</format>
                         <description>UDP timeout in seconds</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 0-2147483647"/>
                       </constraint>
                     </properties>
                     <defaultValue>300</defaultValue>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           <node name="sflow">
             <properties>
               <help>sFlow settings</help>
             </properties>
             <children>
               <leafNode name="agent-address">
                 <properties>
                   <help>sFlow agent IPv4 address</help>
                   <completionHelp>
                     <list>auto</list>
                     <script>${vyos_completion_dir}/list_local_ips.sh --ipv4</script>
                   </completionHelp>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>sFlow IPv4 agent address</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="sampling-rate">
                 <properties>
                   <help>sFlow sampling-rate</help>
                   <valueHelp>
                     <format>u32</format>
                     <description>Sampling rate (1 in N packets)</description>
                   </valueHelp>
                   <constraint>
                    <validator name="numeric" argument="--range 0-4294967295"/>
                   </constraint>
                 </properties>
               </leafNode>
               <tagNode name="server">
                 <properties>
                   <help>sFlow destination server</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 server to export sFlow</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 server to export sFlow</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="port">
                     <properties>
                       <help>sFlow port number</help>
                       <valueHelp>
                         <format>u32:1025-65535</format>
                         <description>sFlow port number</description>
                       </valueHelp>
                       <constraint>
                        <validator name="numeric" argument="--range 1025-65535"/>
                       </constraint>
                     </properties>
                     <defaultValue>6343</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               #include <include/source-address-ipv4-ipv6.xml.i>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-frr.xml.in b/interface-definitions/system_frr.xml.in
similarity index 100%
rename from interface-definitions/system-frr.xml.in
rename to interface-definitions/system_frr.xml.in
diff --git a/interface-definitions/system_host-name.xml.in b/interface-definitions/system_host-name.xml.in
new file mode 100644
index 000000000..423531a68
--- /dev/null
+++ b/interface-definitions/system_host-name.xml.in
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="system">
+    <children>
+      <!-- script does not use XML defaults so far -->
+      <leafNode name="host-name" owner="${vyos_conf_scripts_dir}/system_host-name.py">
+        <properties>
+          <help>System host name (default: vyos)</help>
+          <constraint>
+            #include <include/constraint/host-name.xml.i>
+          </constraint>
+        </properties>
+      </leafNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/system-ip.xml.in b/interface-definitions/system_ip.xml.in
similarity index 98%
rename from interface-definitions/system-ip.xml.in
rename to interface-definitions/system_ip.xml.in
index 6db4dbfc7..6e3b7d5d0 100644
--- a/interface-definitions/system-ip.xml.in
+++ b/interface-definitions/system_ip.xml.in
@@ -1,114 +1,114 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="ip" owner="${vyos_conf_scripts_dir}/system-ip.py">
+      <node name="ip" owner="${vyos_conf_scripts_dir}/system_ip.py">
         <properties>
           <help>IPv4 Settings</help>
           <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl -->
           <priority>290</priority>
         </properties>
         <children>
           <node name="arp">
             <properties>
               <help>Parameters for ARP cache</help>
             </properties>
             <children>
               #include <include/arp-ndp-table-size.xml.i>
             </children>
           </node>
           <leafNode name="disable-forwarding">
             <properties>
               <help>Disable IPv4 forwarding on all interfaces</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="disable-directed-broadcast">
             <properties>
               <help>Disable IPv4 directed broadcast forwarding on all interfaces</help>
               <valueless/>
             </properties>
           </leafNode>
           <node name="multipath">
             <properties>
               <help>IPv4 multipath settings</help>
             </properties>
             <children>
               <leafNode name="ignore-unreachable-nexthops">
                 <properties>
                   <help>Ignore next hops that are not in the ARP table</help>
                   <valueless/>
                 </properties>
               </leafNode>
               <leafNode name="layer4-hashing">
                 <properties>
                   <help>Use layer 4 information for ECMP hashing</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <node name="tcp">
             <properties>
               <help>IPv4 TCP parameters</help>
             </properties>
             <children>
               <node name="mss">
                 <properties>
                   <help>IPv4 TCP MSS probing options</help>
                 </properties>
                 <children>
                   <leafNode name="probing">
                     <properties>
                       <help>Attempt to lower the MSS if TCP connections fail to establish</help>
                       <completionHelp>
                         <list>on-icmp-black-hole force</list>
                       </completionHelp>
                       <valueHelp>
                         <format>on-icmp-black-hole</format>
                         <description>Attempt TCP MSS probing when an ICMP black hole is detected</description>
                       </valueHelp>
                       <valueHelp>
                         <format>force</format>
                       <description>Attempt TCP MSS probing by default</description>
                       </valueHelp>
                       <constraint>
                         <regex>(on-icmp-black-hole|force)</regex>
                       </constraint>
                       <constraintErrorMessage>Must be on-icmp-black-hole or force</constraintErrorMessage>
                     </properties>
                   </leafNode>
                   <leafNode name="base">
                     <properties>
                       <help>Base MSS to start probing from (applicable to "probing force")</help>
                       <valueHelp>
                         <format>u32:48-1460</format>
                         <description>Base MSS value for probing (default: 1024)</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 48-1460"/>
                       </constraint>
                     </properties>
                   </leafNode>
                   <leafNode name="floor">
                     <properties>
                       <help>Minimum MSS to stop probing at (default: 48)</help>
                       <valueHelp>
                         <format>u32:48-1460</format>
                         <description>Minimum MSS value to probe</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 48-1460"/>
                       </constraint>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
           #include <include/system-ip-protocol.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-ipv6.xml.in b/interface-definitions/system_ipv6.xml.in
similarity index 96%
rename from interface-definitions/system-ipv6.xml.in
rename to interface-definitions/system_ipv6.xml.in
index e17e1c01c..8957cb6a7 100644
--- a/interface-definitions/system-ipv6.xml.in
+++ b/interface-definitions/system_ipv6.xml.in
@@ -1,50 +1,50 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="ipv6" owner="${vyos_conf_scripts_dir}/system-ipv6.py">
+      <node name="ipv6" owner="${vyos_conf_scripts_dir}/system_ipv6.py">
         <properties>
           <help>IPv6 Settings</help>
           <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl -->
           <priority>290</priority>
         </properties>
         <children>
           <leafNode name="disable-forwarding">
             <properties>
               <help>Disable IPv6 forwarding on all interfaces</help>
               <valueless/>
             </properties>
           </leafNode>
           <node name="multipath">
             <properties>
               <help>IPv6 multipath settings</help>
             </properties>
             <children>
               <leafNode name="layer4-hashing">
                 <properties>
                   <help>Use layer 4 information for ECMP hashing</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <node name="neighbor">
             <properties>
               <help>Parameters for neighbor discovery cache</help>
             </properties>
             <children>
               #include <include/arp-ndp-table-size.xml.i>
             </children>
           </node>
           #include <include/system-ipv6-protocol.xml.i>
           <leafNode name="strict-dad">
             <properties>
               <help>Disable IPv6 operation on interface when DAD fails on LL addr</help>
               <valueless/>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-lcd.xml.in b/interface-definitions/system_lcd.xml.in
similarity index 100%
rename from interface-definitions/system-lcd.xml.in
rename to interface-definitions/system_lcd.xml.in
diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system_login.xml.in
similarity index 99%
rename from interface-definitions/system-login.xml.in
rename to interface-definitions/system_login.xml.in
index a2f8beead..44e1a7a92 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system_login.xml.in
@@ -1,302 +1,302 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="login" owner="${vyos_conf_scripts_dir}/system-login.py">
+      <node name="login" owner="${vyos_conf_scripts_dir}/system_login.py">
         <properties>
           <help>System User Login Configuration</help>
           <priority>400</priority>
         </properties>
         <children>
           <tagNode name="user">
             <properties>
               <help>Local user account information</help>
               <constraint>
                 #include <include/constraint/login-username.xml.i>
               </constraint>
               <constraintErrorMessage>Username contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage>
             </properties>
             <children>
               <node name="authentication">
                 <properties>
                   <help>Authentication settings</help>
                 </properties>
                 <children>
                   <leafNode name="encrypted-password">
                     <properties>
                       <help>Encrypted password</help>
                       <constraint>
                         <regex>(\*|\!)</regex>
                         <regex>[a-zA-Z0-9\.\/]{13}</regex>
                         <regex>\$1\$[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{22}</regex>
                         <regex>\$5\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{43}</regex>
                         <regex>\$6\$(rounds=[0-9]+\$)?[a-zA-Z0-9\./]*\$[a-zA-Z0-9\./]{86}</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid encrypted password for $VAR(../../@).</constraintErrorMessage>
                     </properties>
                     <defaultValue>!</defaultValue>
                   </leafNode>
                   <node name="otp">
                     <properties>
                       <help>One-Time-Pad (two-factor) authentication parameters</help>
                     </properties>
                     <children>
                       <leafNode name="rate-limit">
                         <properties>
                           <help>Limit number of logins (rate-limit) per rate-time</help>
                           <valueHelp>
                             <format>u32:1-10</format>
                             <description>Number of attempts</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-10"/>
                           </constraint>
                           <constraintErrorMessage>Number of login attempts must me between 1 and 10</constraintErrorMessage>
                         </properties>
                         <defaultValue>3</defaultValue>
                       </leafNode>
                       <leafNode name="rate-time">
                         <properties>
                           <help>Limit number of logins (rate-limit) per rate-time</help>
                           <valueHelp>
                             <format>u32:15-600</format>
                             <description>Time interval</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 15-600"/>
                           </constraint>
                           <constraintErrorMessage>Rate limit time interval must be between 15 and 600 seconds</constraintErrorMessage>
                         </properties>
                         <defaultValue>30</defaultValue>
                       </leafNode>
                       <leafNode name="window-size">
                         <properties>
                           <help>Set window of concurrently valid codes</help>
                           <valueHelp>
                             <format>u32:1-21</format>
                             <description>Window size</description>
                           </valueHelp>
                           <constraint>
                             <validator name="numeric" argument="--range 1-21"/>
                           </constraint>
                           <constraintErrorMessage>Window of concurrently valid codes must be between 1 and 21</constraintErrorMessage>
                         </properties>
                         <defaultValue>3</defaultValue>
                       </leafNode>
                       <leafNode name="key">
                         <properties>
                           <help>Key/secret the token algorithm (see RFC4226)</help>
                           <valueHelp>
                             <format>txt</format>
                             <description>Base32 encoded key/token</description>
                           </valueHelp>
                           <constraint>
                             <regex>[a-zA-Z2-7]{26,10000}</regex>
                           </constraint>
                           <constraintErrorMessage>Key must only include base32 characters and be at least 26 characters long</constraintErrorMessage>
                         </properties>
                       </leafNode>
                     </children>
                   </node>
                   <leafNode name="plaintext-password">
                     <properties>
                       <help>Plaintext password used for encryption</help>
                     </properties>
                   </leafNode>
                   <tagNode name="public-keys">
                     <properties>
                       <help>Remote access public keys</help>
                       <valueHelp>
                         <format>txt</format>
                         <description>Key identifier used by ssh-keygen (usually of form user@host)</description>
                       </valueHelp>
                     </properties>
                     <children>
                       <leafNode name="key">
                         <properties>
                           <help>Public key value (Base64 encoded)</help>
                           <constraint>
                             <validator name="base64"/>
                           </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="options">
                         <properties>
                           <help>Optional public key options</help>
                         </properties>
                       </leafNode>
                       <leafNode name="type">
                         <properties>
                           <help>SSH public key type</help>
                           <completionHelp>
                             <list>ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com</list>
                           </completionHelp>
                           <valueHelp>
                             <format>ssh-dss</format>
                             <description>Digital Signature Algorithm (DSA) key support</description>
                           </valueHelp>
                           <valueHelp>
                             <format>ssh-rsa</format>
                             <description>Key pair based on RSA algorithm</description>
                           </valueHelp>
                           <valueHelp>
                             <format>ecdsa-sha2-nistp256</format>
                             <description>Elliptic Curve DSA with NIST P-256 curve</description>
                           </valueHelp>
                           <valueHelp>
                             <format>ecdsa-sha2-nistp384</format>
                             <description>Elliptic Curve DSA with NIST P-384 curve</description>
                           </valueHelp>
                           <valueHelp>
                             <format>ecdsa-sha2-nistp521</format>
                             <description>Elliptic Curve DSA with NIST P-521 curve</description>
                           </valueHelp>
                           <valueHelp>
                             <format>ssh-ed25519</format>
                             <description>Edwards-curve DSA with elliptic curve 25519</description>
                           </valueHelp>
                           <valueHelp>
                             <format>sk-ecdsa-sha2-nistp256@openssh.com</format>
                             <description>Elliptic Curve DSA security key</description>
                           </valueHelp>
                           <valueHelp>
                             <format>sk-ssh-ed25519@openssh.com</format>
                             <description>Elliptic curve 25519 security key</description>
                           </valueHelp>
                           <constraint>
                             <regex>(ssh-dss|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519|sk-ecdsa-sha2-nistp256@openssh.com|sk-ssh-ed25519@openssh.com)</regex>
                           </constraint>
                         </properties>
                       </leafNode>
                     </children>
                   </tagNode>
                 </children>
               </node>
               <leafNode name="full-name">
                 <properties>
                   <help>Full name of the user (use quotes for names with spaces)</help>
                   <constraint>
                     <regex>[^:]*</regex>
                   </constraint>
                   <constraintErrorMessage>Cannot use ':' in full name</constraintErrorMessage>
                 </properties>
               </leafNode>
               <leafNode name="home-directory">
                 <properties>
                   <help>Home directory</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Path to home directory</description>
                   </valueHelp>
                   <constraint>
                     <regex>\/$|(\/[a-zA-Z_0-9-.]+)+</regex>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           #include <include/radius-server-ipv4-ipv6.xml.i>
           <node name="radius">
             <children>
               <tagNode name="server">
                 <children>
                   #include <include/radius-timeout.xml.i>
                   <leafNode name="priority">
                     <properties>
                       <help>Server priority</help>
                       <valueHelp>
                         <format>u32:1-255</format>
                         <description>Server priority</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-255"/>
                       </constraint>
                     </properties>
                     <defaultValue>255</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               #include <include/interface/vrf.xml.i>
             </children>
           </node>
           <node name="tacacs">
             <properties>
               <help>TACACS+ based user authentication</help>
             </properties>
             <children>
               <tagNode name="server">
                 <properties>
                   <help>TACACS+ server configuration</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>TACACS+ server IPv4 address</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
                   </constraint>
                 </properties>
                 <children>
                   #include <include/generic-disable-node.xml.i>
                   #include <include/radius-server-key.xml.i>
                   #include <include/port-number.xml.i>
                   <leafNode name="port">
                     <defaultValue>49</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
               #include <include/source-address-ipv4.xml.i>
               <leafNode name="security-mode">
                 <properties>
                   <help>Security mode for TACACS+ authentication</help>
                   <completionHelp>
                     <list>mandatory optional</list>
                   </completionHelp>
                   <valueHelp>
                     <format>mandatory</format>
                     <description>Deny access immediately if TACACS+ answers with REJECT</description>
                   </valueHelp>
                   <valueHelp>
                     <format>optional</format>
                     <description>Pass to the next authentication method if TACACS+ answers with REJECT</description>
                   </valueHelp>
                   <constraint>
                     <regex>(mandatory|optional)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>optional</defaultValue>
               </leafNode>
               #include <include/radius-timeout.xml.i>
               #include <include/interface/vrf.xml.i>
             </children>
           </node>
           <leafNode name="max-login-session">
             <properties>
               <help>Maximum number of all login sessions</help>
               <valueHelp>
                 <format>u32:1-65536</format>
                 <description>Maximum number of all login sessions</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 1-65536"/>
               </constraint>
               <constraintErrorMessage>Maximum logins must be between 1 and 65536</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="timeout">
             <properties>
               <help>Session timeout</help>
               <valueHelp>
                 <format>u32:5-604800</format>
                 <description>Session timeout in seconds</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 5-604800"/>
               </constraint>
               <constraintErrorMessage>Timeout must be between 5 and 604800 seconds</constraintErrorMessage>
             </properties>
           </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-login-banner.xml.in b/interface-definitions/system_login_banner.xml.in
similarity index 91%
rename from interface-definitions/system-login-banner.xml.in
rename to interface-definitions/system_login_banner.xml.in
index bdd0ad96a..211505ae4 100644
--- a/interface-definitions/system-login-banner.xml.in
+++ b/interface-definitions/system_login_banner.xml.in
@@ -1,32 +1,32 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="login" owner="${vyos_conf_scripts_dir}/system-login.py">
+      <node name="login" owner="${vyos_conf_scripts_dir}/system_login.py">
         <properties>
           <help>System User Login Configuration</help>
           <priority>400</priority>
         </properties>
         <children>
-          <node name="banner" owner="${vyos_conf_scripts_dir}/system-login-banner.py">
+          <node name="banner" owner="${vyos_conf_scripts_dir}/system_login_banner.py">
             <properties>
               <help>System login banners</help>
             </properties>
             <children>
               <leafNode name="post-login">
                 <properties>
                   <help>A system banner after the user logs in </help>
                 </properties>
               </leafNode>
               <leafNode name="pre-login">
                 <properties>
                   <help>A system banner before the user logs in</help>
                 </properties>
               </leafNode>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-logs.xml.in b/interface-definitions/system_logs.xml.in
similarity index 98%
rename from interface-definitions/system-logs.xml.in
rename to interface-definitions/system_logs.xml.in
index 1caa7abb6..b34cbdc39 100644
--- a/interface-definitions/system-logs.xml.in
+++ b/interface-definitions/system_logs.xml.in
@@ -1,92 +1,92 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="logs" owner="${vyos_conf_scripts_dir}/system-logs.py">
+      <node name="logs" owner="${vyos_conf_scripts_dir}/system_logs.py">
         <properties>
           <help>Logging options</help>
           <priority>9999</priority>
         </properties>
         <children>
           <node name="logrotate">
             <properties>
               <help>Logrotate options</help>
             </properties>
             <children>
               <node name="atop">
                 <properties>
                   <help>Atop logs options (system resources usage)</help>
                 </properties>
                 <children>
                   <leafNode name="max-size">
                     <properties>
                       <help>Size of a single log file that triggers rotation</help>
                       <valueHelp>
                         <format>u32:1-1024</format>
                         <description>Size in MB</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-1024" />
                       </constraint>
                       <constraintErrorMessage>The size must be between 1 and 1024 MB</constraintErrorMessage>
                     </properties>
                     <defaultValue>10</defaultValue>
                   </leafNode>
                   <leafNode name="rotate">
                     <properties>
                       <help>Count of rotations before old logs will be deleted</help>
                       <valueHelp>
                         <format>u32:1-100</format>
                         <description>Rotations</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-100" />
                       </constraint>
                       <constraintErrorMessage>The count must be between 1 and 100</constraintErrorMessage>
                     </properties>
                     <defaultValue>10</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <node name="messages">
                 <properties>
                   <help>The /var/log/messages file rotation</help>
                 </properties>
                 <children>
                   <leafNode name="max-size">
                     <properties>
                       <help>Size of a single log file that triggers rotation</help>
                       <valueHelp>
                         <format>u32:1-1024</format>
                         <description>Size in MB</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-1024" />
                       </constraint>
                       <constraintErrorMessage>The size must be between 1 and 1024 MB</constraintErrorMessage>
                     </properties>
                     <defaultValue>1</defaultValue>
                   </leafNode>
                   <leafNode name="rotate">
                     <properties>
                       <help>Count of rotations before old logs will be deleted</help>
                       <valueHelp>
                         <format>u32:1-100</format>
                         <description>Rotations</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-100" />
                       </constraint>
                       <constraintErrorMessage>The count must be between 1 and 100</constraintErrorMessage>
                     </properties>
                     <defaultValue>10</defaultValue>
                   </leafNode>
                 </children>
               </node>
             </children>
           </node>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system_name-server.xml.in b/interface-definitions/system_name-server.xml.in
new file mode 100644
index 000000000..2f750abfa
--- /dev/null
+++ b/interface-definitions/system_name-server.xml.in
@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="system">
+    <children>
+      <leafNode name="name-server" owner="${vyos_conf_scripts_dir}/system_host-name.py">
+        <properties>
+          <help>System Domain Name Servers (DNS)</help>
+          <priority>400</priority>
+          <completionHelp>
+            <script>${vyos_completion_dir}/list_interfaces</script>
+          </completionHelp>
+          <valueHelp>
+            <format>ipv4</format>
+            <description>Domain Name Server IPv4 address</description>
+          </valueHelp>
+          <valueHelp>
+            <format>ipv6</format>
+            <description>Domain Name Server IPv6 address</description>
+          </valueHelp>
+          <valueHelp>
+            <format>txt</format>
+            <description>Use Domain Name Server from DHCP interface</description>
+          </valueHelp>
+          <multi/>
+          <constraint>
+            <validator name="ip-address"/>
+            #include <include/constraint/interface-name.xml.i>
+          </constraint>
+        </properties>
+      </leafNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/system-option.xml.in b/interface-definitions/system_option.xml.in
similarity index 99%
rename from interface-definitions/system-option.xml.in
rename to interface-definitions/system_option.xml.in
index b1b5f7fae..adb45bdcc 100644
--- a/interface-definitions/system-option.xml.in
+++ b/interface-definitions/system_option.xml.in
@@ -1,171 +1,171 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="option" owner="${vyos_conf_scripts_dir}/system-option.py">
+      <node name="option" owner="${vyos_conf_scripts_dir}/system_option.py">
         <properties>
           <help>System Options</help>
           <priority>9999</priority>
         </properties>
         <children>
           <leafNode name="ctrl-alt-delete">
             <properties>
               <help>System action on Ctrl-Alt-Delete keystroke</help>
               <completionHelp>
                 <list>ignore reboot poweroff</list>
               </completionHelp>
               <valueHelp>
                 <format>ignore</format>
                 <description>Ignore key sequence</description>
               </valueHelp>
               <valueHelp>
                 <format>reboot</format>
                 <description>Reboot system</description>
               </valueHelp>
               <valueHelp>
                 <format>poweroff</format>
                 <description>Poweroff system</description>
               </valueHelp>
               <constraint>
                 <regex>(ignore|reboot|poweroff)</regex>
               </constraint>
               <constraintErrorMessage>Must be ignore, reboot, or poweroff</constraintErrorMessage>
             </properties>
            </leafNode>
            <leafNode name="keyboard-layout">
              <properties>
                <help>System keyboard layout, type ISO2</help>
                <completionHelp>
                  <list>us uk fr de es fi jp106 no dk se-latin1 dvorak</list>
                </completionHelp>
                <valueHelp>
                  <format>us</format>
                  <description>United States</description>
                </valueHelp>
                <valueHelp>
                  <format>uk</format>
                  <description>United Kingdom</description>
                </valueHelp>
                <valueHelp>
                  <format>fr</format>
                  <description>France</description>
                </valueHelp>
                <valueHelp>
                  <format>de</format>
                  <description>Germany</description>
                </valueHelp>
                <valueHelp>
                  <format>es</format>
                  <description>Spain</description>
                </valueHelp>
                <valueHelp>
                  <format>fi</format>
                  <description>Finland</description>
                </valueHelp>
                <valueHelp>
                  <format>jp106</format>
                  <description>Japan</description>
                </valueHelp>
                <valueHelp>
                  <format>no</format>
                  <description>Norway</description>
                </valueHelp>
                <valueHelp>
                  <format>dk</format>
                  <description>Denmark</description>
                </valueHelp>
                <valueHelp>
                  <format>se-latin1</format>
                  <description>Sweden</description>
                </valueHelp>
                <valueHelp>
                  <format>dvorak</format>
                  <description>Dvorak</description>
                </valueHelp>
                <constraint>
                 <regex>(us|uk|fr|de|es|fi|jp106|no|dk|se-latin1|dvorak)</regex>
               </constraint>
               <constraintErrorMessage>Invalid keyboard layout</constraintErrorMessage>
              </properties>
              <defaultValue>us</defaultValue>
            </leafNode>
            <leafNode name="performance">
             <properties>
               <help>Tune system performance</help>
               <completionHelp>
                 <list>throughput latency</list>
               </completionHelp>
               <valueHelp>
                 <format>throughput</format>
                 <description>Tune for maximum network throughput</description>
               </valueHelp>
               <valueHelp>
                 <format>latency</format>
                 <description>Tune for low network latency</description>
               </valueHelp>
               <constraint>
                 <regex>(throughput|latency)</regex>
               </constraint>
             </properties>
            </leafNode>
            <node name="http-client">
              <properties>
                <help>Global options used for HTTP client</help>
              </properties>
              <children>
                #include <include/source-interface.xml.i>
                #include <include/source-address-ipv4-ipv6.xml.i>
              </children>
            </node>
            <leafNode name="reboot-on-panic">
              <properties>
                <help>Reboot system on kernel panic</help>
                <valueless/>
              </properties>
            </leafNode>
            <node name="ssh-client">
              <properties>
                <help>Global options used for SSH client</help>
              </properties>
              <children>
                #include <include/source-address-ipv4-ipv6.xml.i>
                #include <include/source-interface.xml.i>
              </children>
            </node>
            <leafNode name="startup-beep">
              <properties>
                <help>plays sound via system speaker when you can login</help>
                <valueless/>
              </properties>
            </leafNode>
            <leafNode name="root-partition-auto-resize">
              <properties>
                <help>Enable root partition auto-extention on system boot</help>
                <valueless/>
              </properties>
            </leafNode>
            <leafNode name="time-format">
             <properties>
               <help>System time-format</help>
               <completionHelp>
                 <list>12-hour 24-hour</list>
               </completionHelp>
               <valueHelp>
                 <format>12-hour</format>
                 <description>12 hour time format</description>
               </valueHelp>
               <valueHelp>
                 <format>24-hour</format>
                 <description>24 hour time format</description>
               </valueHelp>
               <constraint>
                 <regex>(12-hour|24-hour)</regex>
               </constraint>
             </properties>
             <defaultValue>12-hour</defaultValue>
            </leafNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-proxy.xml.in b/interface-definitions/system_proxy.xml.in
similarity index 91%
rename from interface-definitions/system-proxy.xml.in
rename to interface-definitions/system_proxy.xml.in
index f7ab31d7e..214534dbb 100644
--- a/interface-definitions/system-proxy.xml.in
+++ b/interface-definitions/system_proxy.xml.in
@@ -1,25 +1,25 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="proxy" owner="${vyos_conf_scripts_dir}/system-proxy.py">
+      <node name="proxy" owner="${vyos_conf_scripts_dir}/system_proxy.py">
         <properties>
           <help>Sets a proxy for system wide use</help>
         </properties>
         <children>
           <leafNode name="url">
             <properties>
               <help>Proxy URL</help>
               <constraint>
                 <regex>http(s)?:\/\/[a-z0-9-\.]+</regex>
               </constraint>
             </properties>
           </leafNode>
           #include <include/port-number.xml.i>
           #include <include/generic-username.xml.i>
           #include <include/generic-password.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-sflow.xml.in b/interface-definitions/system_sflow.xml.in
similarity index 100%
rename from interface-definitions/system-sflow.xml.in
rename to interface-definitions/system_sflow.xml.in
diff --git a/interface-definitions/system_static-host-mapping.xml.in b/interface-definitions/system_static-host-mapping.xml.in
new file mode 100644
index 000000000..492741f11
--- /dev/null
+++ b/interface-definitions/system_static-host-mapping.xml.in
@@ -0,0 +1,53 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="system">
+    <children>
+      <node name="static-host-mapping" owner="${vyos_conf_scripts_dir}/system_host-name.py">
+        <properties>
+          <help>Map host names to addresses</help>
+          <priority>400</priority>
+        </properties>
+        <children>
+          <tagNode name="host-name">
+            <properties>
+              <help>Host name for static address mapping</help>
+              <constraint>
+                #include <include/constraint/host-name.xml.i>
+              </constraint>
+              <constraintErrorMessage>Host-name must be alphanumeric and can contain hyphens</constraintErrorMessage>
+            </properties>
+            <children>
+              <leafNode name="alias">
+                <properties>
+                  <help>Alias for this address</help>
+                  <constraint>
+                    <regex>.{1,63}</regex>
+                  </constraint>
+                  <constraintErrorMessage>invalid alias hostname, needs to be between 1 and 63 charactes</constraintErrorMessage>
+                  <multi />
+                </properties>
+              </leafNode>
+              <leafNode name="inet">
+                <properties>
+                  <help>IP Address</help>
+                  <valueHelp>
+                    <format>ipv4</format>
+                    <description>IPv4 address</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>ipv6</format>
+                    <description>IPv6 address</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="ip-address"/>
+                  </constraint>
+                  <multi/>
+                </properties>
+              </leafNode>
+            </children>
+          </tagNode>
+        </children>
+      </node>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/system-sysctl.xml.in b/interface-definitions/system_sysctl.xml.in
similarity index 100%
rename from interface-definitions/system-sysctl.xml.in
rename to interface-definitions/system_sysctl.xml.in
diff --git a/interface-definitions/system-syslog.xml.in b/interface-definitions/system_syslog.xml.in
similarity index 99%
rename from interface-definitions/system-syslog.xml.in
rename to interface-definitions/system_syslog.xml.in
index cd5c514a8..3343e2c59 100644
--- a/interface-definitions/system-syslog.xml.in
+++ b/interface-definitions/system_syslog.xml.in
@@ -1,155 +1,155 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="syslog" owner="${vyos_conf_scripts_dir}/system-syslog.py">
+      <node name="syslog" owner="${vyos_conf_scripts_dir}/system_syslog.py">
         <properties>
           <help>System logging</help>
           <priority>400</priority>
         </properties>
         <children>
           <tagNode name="user">
             <properties>
               <help>Logging to specific terminal of given user</help>
               <completionHelp>
                 <path>system login user</path>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Local user account</description>
               </valueHelp>
               <constraint>
                 #include <include/constraint/login-username.xml.i>
               </constraint>
               <constraintErrorMessage>illegal characters in user</constraintErrorMessage>
             </properties>
             <children>
               #include <include/syslog-facility.xml.i>
             </children>
           </tagNode>
           <tagNode name="host">
             <properties>
               <help>Logging to remote host</help>
               <constraint>
                 <validator name="ip-address"/>
                 <validator name="fqdn"/>
               </constraint>
               <constraintErrorMessage>Invalid host (FQDN or IP address)</constraintErrorMessage>
               <valueHelp>
                 <format>ipv4</format>
                 <description>Remote syslog server IPv4 address</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6</format>
                 <description>Remote syslog server IPv6 address</description>
               </valueHelp>
               <valueHelp>
                 <format>hostname</format>
                 <description>Remote syslog server FQDN</description>
               </valueHelp>
             </properties>
             <children>
               #include <include/port-number.xml.i>
               <leafNode name="port">
                 <defaultValue>514</defaultValue>
               </leafNode>
               #include <include/protocol-tcp-udp.xml.i>
               #include <include/syslog-facility.xml.i>
               <node name="format">
                 <properties>
                   <help>Logging format</help>
                 </properties>
                 <children>
                   <leafNode name="octet-counted">
                     <properties>
                       <help>Allows for the transmission of all characters inside a syslog message</help>
                       <valueless/>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </tagNode>
           <node name="global">
             <properties>
               <help>Logging to system standard location</help>
             </properties>
             <children>
               #include <include/syslog-facility.xml.i>
               <node name="marker">
                 <properties>
                   <help>mark messages sent to syslog</help>
                 </properties>
                 <children>
                   <leafNode name="interval">
                     <properties>
                       <help>time interval how often a mark message is being sent in seconds</help>
                       <constraint>
                         <validator name="numeric" argument="--positive"/>
                       </constraint>
                     </properties>
                     <defaultValue>1200</defaultValue>
                   </leafNode>
                 </children>
               </node>
               <leafNode name="preserve-fqdn">
                 <properties>
                   <help>uses FQDN for logging</help>
                   <valueless/>
                 </properties>
               </leafNode>
             </children>
           </node>
           <tagNode name="file">
             <properties>
               <help>Logging to a file</help>
               <constraint>
                 <regex>[a-zA-Z0-9\-_.]{1,255}</regex>
               </constraint>
               <constraintErrorMessage>illegal characters in filename or filename longer than 255 characters</constraintErrorMessage>
             </properties>
             <children>
               <node name="archive">
                 <properties>
                   <help>Log file size and rotation characteristics</help>
                 </properties>
                 <children>
                   <leafNode name="file">
                     <properties>
                       <help>Number of saved files</help>
                       <constraint>
                         <regex>[0-9]+</regex>
                       </constraint>
                       <constraintErrorMessage>illegal characters in number of files</constraintErrorMessage>
                     </properties>
                     <defaultValue>5</defaultValue>
                   </leafNode>
                   <leafNode name="size">
                     <properties>
                       <help>Size of log files in kbytes</help>
                       <constraint>
                         <regex>[0-9]+</regex>
                       </constraint>
                       <constraintErrorMessage>illegal characters in size</constraintErrorMessage>
                     </properties>
                     <defaultValue>256</defaultValue>
                   </leafNode>
                 </children>
               </node>
               #include <include/syslog-facility.xml.i>
             </children>
           </tagNode>
           <node name="console">
             <properties>
               <help>logging to serial console</help>
             </properties>
             <children>
               #include <include/syslog-facility.xml.i>
             </children>
           </node>
           #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/cron.xml.in b/interface-definitions/system_task-scheduler.xml.in
similarity index 96%
rename from interface-definitions/cron.xml.in
rename to interface-definitions/system_task-scheduler.xml.in
index 58dcf64ac..597d58813 100644
--- a/interface-definitions/cron.xml.in
+++ b/interface-definitions/system_task-scheduler.xml.in
@@ -1,72 +1,72 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
       <node name="task-scheduler">
         <properties>
           <help>Task scheduler settings</help>
         </properties>
         <children>
-          <tagNode name="task" owner="${vyos_conf_scripts_dir}/task_scheduler.py">
+          <tagNode name="task" owner="${vyos_conf_scripts_dir}/system_task-scheduler.py">
             <properties>
               <help>Scheduled task</help>
               <valueHelp>
                 <format>txt</format>
                 <description>Task name</description>
               </valueHelp>
               <priority>999</priority>
             </properties>
             <children>
               <leafNode name="crontab-spec">
                 <properties>
                   <help>UNIX crontab time specification string</help>
                 </properties>
               </leafNode>
               <leafNode name="interval">
                 <properties>
                   <help>Execution interval</help>
                   <valueHelp>
                     <format>&lt;minutes&gt;</format>
                     <description>Execution interval in minutes</description>
                   </valueHelp>
                   <valueHelp>
                     <format>&lt;minutes&gt;m</format>
                     <description>Execution interval in minutes</description>
                   </valueHelp>
                   <valueHelp>
                     <format>&lt;hours&gt;h</format>
                     <description>Execution interval in hours</description>
                   </valueHelp>
                   <valueHelp>
                     <format>&lt;days&gt;d</format>
                     <description>Execution interval in days</description>
                   </valueHelp>
                   <constraint>
                     <regex>[1-9]([0-9]*)([mhd]{0,1})</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <node name="executable">
                 <properties>
                   <help>Executable path and arguments</help>
                 </properties>
                 <children>
                   <leafNode name="path">
                     <properties>
                       <help>Path to executable</help>
                     </properties>
                   </leafNode>
                   <leafNode name="arguments">
                     <properties>
                       <help>Arguments passed to the executable</help>
                     </properties>
                   </leafNode>
                 </children>
               </node>
             </children>
           </tagNode>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-time-zone.xml.in b/interface-definitions/system_time-zone.xml.in
similarity index 96%
rename from interface-definitions/system-time-zone.xml.in
rename to interface-definitions/system_time-zone.xml.in
index f6b291984..65cce9e95 100644
--- a/interface-definitions/system-time-zone.xml.in
+++ b/interface-definitions/system_time-zone.xml.in
@@ -1,19 +1,19 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <leafNode name="time-zone" owner="${vyos_conf_scripts_dir}/system-timezone.py">
+      <leafNode name="time-zone" owner="${vyos_conf_scripts_dir}/system_timezone.py">
         <properties>
           <help>Local time zone (default UTC)</help>
           <priority>100</priority>
           <completionHelp>
             <script>timedatectl list-timezones</script>
           </completionHelp>
           <constraint>
             <validator name="timezone" argument="--validate"/>
           </constraint>
         </properties>
       </leafNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/system-update-check.xml.in b/interface-definitions/system_update-check.xml.in
similarity index 96%
rename from interface-definitions/system-update-check.xml.in
rename to interface-definitions/system_update-check.xml.in
index a7d754003..14570b039 100644
--- a/interface-definitions/system-update-check.xml.in
+++ b/interface-definitions/system_update-check.xml.in
@@ -1,22 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <interfaceDefinition>
   <node name="system">
     <children>
-      <node name="update-check" owner="${vyos_conf_scripts_dir}/system_update_check.py">
+      <node name="update-check" owner="${vyos_conf_scripts_dir}/system_update-check.py">
         <properties>
           <help>Check available update images</help>
           <priority>9999</priority>
         </properties>
         <children>
           <leafNode name="auto-check">
             <properties>
               <help>Enable auto check for new images</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/url-http-https.xml.i>
         </children>
       </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/interface-definitions/vpn-ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
similarity index 100%
rename from interface-definitions/vpn-ipsec.xml.in
rename to interface-definitions/vpn_ipsec.xml.in
diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in
similarity index 100%
rename from interface-definitions/vpn-l2tp.xml.in
rename to interface-definitions/vpn_l2tp.xml.in
diff --git a/interface-definitions/vpn-openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in
similarity index 100%
rename from interface-definitions/vpn-openconnect.xml.in
rename to interface-definitions/vpn_openconnect.xml.in
diff --git a/interface-definitions/vpn-pptp.xml.in b/interface-definitions/vpn_pptp.xml.in
similarity index 100%
rename from interface-definitions/vpn-pptp.xml.in
rename to interface-definitions/vpn_pptp.xml.in
diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn_sstp.xml.in
similarity index 100%
rename from interface-definitions/vpn-sstp.xml.in
rename to interface-definitions/vpn_sstp.xml.in
diff --git a/python/vyos/ifconfig/vxlan.py b/python/vyos/ifconfig/vxlan.py
index 23b6daa3a..a2c4aad50 100644
--- a/python/vyos/ifconfig/vxlan.py
+++ b/python/vyos/ifconfig/vxlan.py
@@ -1,197 +1,197 @@
 # Copyright 2019-2023 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
 # License as published by the Free Software Foundation; either
 # version 2.1 of the License, or (at your option) any later version.
 #
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from json import loads
 
 from vyos import ConfigError
 from vyos.configdict import list_diff
 from vyos.ifconfig import Interface
 from vyos.utils.assertion import assert_list
 from vyos.utils.dict import dict_search
 from vyos.utils.network import get_interface_config
 from vyos.utils.network import get_vxlan_vlan_tunnels
 from vyos.utils.network import get_vxlan_vni_filter
 
 @Interface.register
 class VXLANIf(Interface):
     """
     The VXLAN protocol is a tunnelling protocol designed to solve the
     problem of limited VLAN IDs (4096) in IEEE 802.1q. With VXLAN the
     size of the identifier is expanded to 24 bits (16777216).
 
     VXLAN is described by IETF RFC 7348, and has been implemented by a
     number of vendors.  The protocol runs over UDP using a single
     destination port.  This document describes the Linux kernel tunnel
     device, there is also a separate implementation of VXLAN for
     Openvswitch.
 
     Unlike most tunnels, a VXLAN is a 1 to N network, not just point to
     point. A VXLAN device can learn the IP address of the other endpoint
     either dynamically in a manner similar to a learning bridge, or make
     use of statically-configured forwarding entries.
 
     For more information please refer to:
     https://www.kernel.org/doc/Documentation/networking/vxlan.txt
     """
 
     iftype = 'vxlan'
     definition = {
         **Interface.definition,
         **{
             'section': 'vxlan',
             'prefixes': ['vxlan', ],
             'bridgeable': True,
         }
     }
 
     _command_set = {**Interface._command_set, **{
         'neigh_suppress': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'shellcmd': 'bridge link set dev {ifname} neigh_suppress {value} learning off',
         },
         'vlan_tunnel': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'shellcmd': 'bridge link set dev {ifname} vlan_tunnel {value}',
         },
     }}
 
     def _create(self):
         # This table represents a mapping from VyOS internal config dict to
         # arguments used by iproute2. For more information please refer to:
         # - https://man7.org/linux/man-pages/man8/ip-link.8.html
         mapping = {
             'group'                      : 'group',
             'gpe'                        : 'gpe',
             'parameters.external'        : 'external',
             'parameters.ip.df'           : 'df',
             'parameters.ip.tos'          : 'tos',
             'parameters.ip.ttl'          : 'ttl',
             'parameters.ipv6.flowlabel'  : 'flowlabel',
             'parameters.nolearning'      : 'nolearning',
             'parameters.vni_filter'      : 'vnifilter',
             'remote'                     : 'remote',
             'source_address'             : 'local',
             'source_interface'           : 'dev',
             'vni'                        : 'id',
         }
 
         # IPv6 flowlabels can only be used on IPv6 tunnels, thus we need to
         # ensure that at least the first remote IP address is passed to the
         # tunnel creation command. Subsequent tunnel remote addresses can later
         # be added to the FDB
         remote_list = None
         if 'remote' in self.config:
             # skip first element as this is already configured as remote
             remote_list = self.config['remote'][1:]
             self.config['remote'] = self.config['remote'][0]
 
         cmd = 'ip link add {ifname} type {type} dstport {port}'
         for vyos_key, iproute2_key in mapping.items():
             # dict_search will return an empty dict "{}" for valueless nodes like
             # "parameters.nolearning" - thus we need to test the nodes existence
             # by using isinstance()
             tmp = dict_search(vyos_key, self.config)
             if isinstance(tmp, dict):
                 cmd += f' {iproute2_key}'
             elif tmp != None:
                 cmd += f' {iproute2_key} {tmp}'
 
         self._cmd(cmd.format(**self.config))
         # interface is always A/D down. It needs to be enabled explicitly
         self.set_admin_state('down')
 
-        # VXLAN tunnel is always recreated on any change - see interfaces-vxlan.py
+        # VXLAN tunnel is always recreated on any change - see interfaces_vxlan.py
         if remote_list:
             for remote in remote_list:
                 cmd = f'bridge fdb append to 00:00:00:00:00:00 dst {remote} ' \
                        'port {port} dev {ifname}'
                 self._cmd(cmd.format(**self.config))
 
     def set_neigh_suppress(self, state):
         """
         Controls whether neigh discovery (arp and nd) proxy and suppression
         is enabled on the port. By default this flag is off.
         """
 
         # Determine current OS Kernel neigh_suppress setting - only adjust when needed
         tmp = get_interface_config(self.ifname)
         cur_state = 'on' if dict_search(f'linkinfo.info_slave_data.neigh_suppress', tmp) == True else 'off'
         new_state = 'on' if state else 'off'
         if cur_state != new_state:
             self.set_interface('neigh_suppress', state)
 
     def set_vlan_vni_mapping(self, state):
         """
         Controls whether vlan to tunnel mapping is enabled on the port.
         By default this flag is off.
         """
         if not isinstance(state, bool):
             raise ValueError('Value out of range')
 
         if 'vlan_to_vni_removed' in self.config:
             cur_vni_filter = get_vxlan_vni_filter(self.ifname)
             for vlan, vlan_config in self.config['vlan_to_vni_removed'].items():
                 # If VNI filtering is enabled, remove matching VNI filter
                 if dict_search('parameters.vni_filter', self.config) != None:
                     vni = vlan_config['vni']
                     if vni in cur_vni_filter:
                         self._cmd(f'bridge vni delete dev {self.ifname} vni {vni}')
                 self._cmd(f'bridge vlan del dev {self.ifname} vid {vlan}')
 
         # Determine current OS Kernel vlan_tunnel setting - only adjust when needed
         tmp = get_interface_config(self.ifname)
         cur_state = 'on' if dict_search(f'linkinfo.info_slave_data.vlan_tunnel', tmp) == True else 'off'
         new_state = 'on' if state else 'off'
         if cur_state != new_state:
             self.set_interface('vlan_tunnel', new_state)
 
         if 'vlan_to_vni' in self.config:
             # Determine current OS Kernel configured VLANs
             os_configured_vlan_ids = get_vxlan_vlan_tunnels(self.ifname)
             add_vlan = list_diff(list(self.config['vlan_to_vni'].keys()), os_configured_vlan_ids)
 
             for vlan, vlan_config in self.config['vlan_to_vni'].items():
                 # VLAN mapping already exists - skip
                 if vlan not in add_vlan:
                     continue
 
                 vni = vlan_config['vni']
                 # The following commands must be run one after another,
                 # they can not be combined with linux 6.1 and iproute2 6.1
                 self._cmd(f'bridge vlan add dev {self.ifname} vid {vlan}')
                 self._cmd(f'bridge vlan add dev {self.ifname} vid {vlan} tunnel_info id {vni}')
 
                 # If VNI filtering is enabled, install matching VNI filter
                 if dict_search('parameters.vni_filter', self.config) != None:
                     self._cmd(f'bridge vni add dev {self.ifname} vni {vni}')
 
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
         interface setup code and provide a single point of entry when workin
         on any interface. """
 
         # call base class last
         super().update(config)
 
         # Enable/Disable VLAN tunnel mapping
         # This is only possible after the interface was assigned to the bridge
         self.set_vlan_vni_mapping(dict_search('vlan_to_vni', config) != None)
 
         # Enable/Disable neighbor suppression and learning, there is no need to
         # explicitly "disable" it, as VXLAN interface will be recreated if anything
         # under "parameters" changes.
         if dict_search('parameters.neighbor_suppress', config) != None:
             self.set_neigh_suppress('on')
diff --git a/smoketest/scripts/cli/test_ha_virtual_server.py b/smoketest/scripts/cli/test_high-availability_virtual-server.py
similarity index 100%
rename from smoketest/scripts/cli/test_ha_virtual_server.py
rename to smoketest/scripts/cli/test_high-availability_virtual-server.py
diff --git a/smoketest/scripts/cli/test_ha_vrrp.py b/smoketest/scripts/cli/test_high-availability_vrrp.py
similarity index 100%
rename from smoketest/scripts/cli/test_ha_vrrp.py
rename to smoketest/scripts/cli/test_high-availability_vrrp.py
diff --git a/smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py b/smoketest/scripts/cli/test_interfaces_pseudo-ethernet.py
similarity index 100%
rename from smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py
rename to smoketest/scripts/cli/test_interfaces_pseudo-ethernet.py
diff --git a/smoketest/scripts/cli/test_interfaces_virtual_ethernet.py b/smoketest/scripts/cli/test_interfaces_virtual-ethernet.py
similarity index 100%
rename from smoketest/scripts/cli/test_interfaces_virtual_ethernet.py
rename to smoketest/scripts/cli/test_interfaces_virtual-ethernet.py
diff --git a/smoketest/scripts/cli/test_load_balancing_reverse_proxy.py b/smoketest/scripts/cli/test_load-balancing_reverse-proxy.py
similarity index 100%
rename from smoketest/scripts/cli/test_load_balancing_reverse_proxy.py
rename to smoketest/scripts/cli/test_load-balancing_reverse-proxy.py
diff --git a/smoketest/scripts/cli/test_load_balancing_wan.py b/smoketest/scripts/cli/test_load-balancing_wan.py
similarity index 100%
rename from smoketest/scripts/cli/test_load_balancing_wan.py
rename to smoketest/scripts/cli/test_load-balancing_wan.py
diff --git a/smoketest/scripts/cli/test_protocols_segment_routing.py b/smoketest/scripts/cli/test_protocols_segment-routing.py
similarity index 100%
rename from smoketest/scripts/cli/test_protocols_segment_routing.py
rename to smoketest/scripts/cli/test_protocols_segment-routing.py
diff --git a/smoketest/scripts/cli/test_service_bcast-relay.py b/smoketest/scripts/cli/test_service_broadcast-relay.py
similarity index 100%
rename from smoketest/scripts/cli/test_service_bcast-relay.py
rename to smoketest/scripts/cli/test_service_broadcast-relay.py
diff --git a/smoketest/scripts/cli/test_service_ids.py b/smoketest/scripts/cli/test_service_ids_ddos-protection.py
similarity index 100%
rename from smoketest/scripts/cli/test_service_ids.py
rename to smoketest/scripts/cli/test_service_ids_ddos-protection.py
diff --git a/smoketest/scripts/cli/test_service_mdns-repeater.py b/smoketest/scripts/cli/test_service_mdns_repeater.py
similarity index 100%
rename from smoketest/scripts/cli/test_service_mdns-repeater.py
rename to smoketest/scripts/cli/test_service_mdns_repeater.py
diff --git a/smoketest/scripts/cli/test_service_salt.py b/smoketest/scripts/cli/test_service_salt-minion.py
similarity index 100%
rename from smoketest/scripts/cli/test_service_salt.py
rename to smoketest/scripts/cli/test_service_salt-minion.py
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index da6724fde..acb7dfa41 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -1,508 +1,505 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2021-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 import re
 
 from glob import glob
 from json import loads
 from sys import exit
 
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import is_node_changed
 from vyos.configdiff import get_config_diff, Diff
 from vyos.configdep import set_dependents, call_dependents
 from vyos.configverify import verify_interface_exists
 from vyos.ethtool import Ethtool
 from vyos.firewall import fqdn_config_parse
 from vyos.firewall import geoip_update
 from vyos.template import render
 from vyos.utils.process import call
 from vyos.utils.process import cmd
 from vyos.utils.dict import dict_search_args
 from vyos.utils.dict import dict_search_recursive
 from vyos.utils.process import process_named_running
 from vyos.utils.process import rc_cmd
 from vyos import ConfigError
 from vyos import airbag
 
 airbag.enable()
 
-nat_conf_script = 'nat.py'
-policy_route_conf_script = 'policy-route.py'
-
 nftables_conf = '/run/nftables.conf'
 
 sysfs_config = {
     'all_ping': {'sysfs': '/proc/sys/net/ipv4/icmp_echo_ignore_all', 'enable': '0', 'disable': '1'},
     'broadcast_ping': {'sysfs': '/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts', 'enable': '0', 'disable': '1'},
     'ip_src_route': {'sysfs': '/proc/sys/net/ipv4/conf/*/accept_source_route'},
     'ipv6_receive_redirects': {'sysfs': '/proc/sys/net/ipv6/conf/*/accept_redirects'},
     'ipv6_src_route': {'sysfs': '/proc/sys/net/ipv6/conf/*/accept_source_route', 'enable': '0', 'disable': '-1'},
     'log_martians': {'sysfs': '/proc/sys/net/ipv4/conf/all/log_martians'},
     'receive_redirects': {'sysfs': '/proc/sys/net/ipv4/conf/*/accept_redirects'},
     'send_redirects': {'sysfs': '/proc/sys/net/ipv4/conf/*/send_redirects'},
     'syn_cookies': {'sysfs': '/proc/sys/net/ipv4/tcp_syncookies'},
     'twa_hazards_protection': {'sysfs': '/proc/sys/net/ipv4/tcp_rfc1337'}
 }
 
 valid_groups = [
     'address_group',
     'domain_group',
     'network_group',
     'port_group',
     'interface_group'
 ]
 
 nested_group_types = [
     'address_group', 'network_group', 'mac_group',
     'port_group', 'ipv6_address_group', 'ipv6_network_group'
 ]
 
 snmp_change_type = {
     'unknown': 0,
     'add': 1,
     'delete': 2,
     'change': 3
 }
 snmp_event_source = 1
 snmp_trap_mib = 'VYATTA-TRAP-MIB'
 snmp_trap_name = 'mgmtEventTrap'
 
 def geoip_updated(conf, firewall):
     diff = get_config_diff(conf)
     node_diff = diff.get_child_nodes_diff(['firewall'], expand_nodes=Diff.DELETE, recursive=True)
 
     out = {
         'name': [],
         'ipv6_name': [],
         'deleted_name': [],
         'deleted_ipv6_name': []
     }
     updated = False
 
     for key, path in dict_search_recursive(firewall, 'geoip'):
         set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
         if (path[0] == 'ipv4'):
             out['name'].append(set_name)
         elif (path[0] == 'ipv6'):
             set_name = f'GEOIP_CC6_{path[1]}_{path[2]}_{path[4]}'
             out['ipv6_name'].append(set_name)
 
         updated = True
 
     if 'delete' in node_diff:
         for key, path in dict_search_recursive(node_diff['delete'], 'geoip'):
             set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
             if (path[0] == 'ipv4'):
                 out['deleted_name'].append(set_name)
             elif (path[0] == 'ipv6'):
                 set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
                 out['deleted_ipv6_name'].append(set_name)
             updated = True
 
     if updated:
         return out
 
     return False
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
     base = ['firewall']
 
     firewall = conf.get_config_dict(base, key_mangling=('-', '_'),
                                     no_tag_node_value_mangle=True,
                                     get_first_key=True,
                                     with_recursive_defaults=True)
 
 
     firewall['group_resync'] = bool('group' in firewall or is_node_changed(conf, base + ['group']))
     if firewall['group_resync']:
         # Update nat and policy-route as firewall groups were updated
         set_dependents('group_resync', conf)
 
     firewall['geoip_updated'] = geoip_updated(conf, firewall)
 
     fqdn_config_parse(firewall)
 
     set_dependents('conntrack', conf)
 
     return firewall
 
 def verify_rule(firewall, rule_conf, ipv6):
     if 'action' not in rule_conf:
         raise ConfigError('Rule action must be defined')
 
     if 'jump' in rule_conf['action'] and 'jump_target' not in rule_conf:
         raise ConfigError('Action set to jump, but no jump-target specified')
 
     if 'jump_target' in rule_conf:
         if 'jump' not in rule_conf['action']:
             raise ConfigError('jump-target defined, but action jump needed and it is not defined')
         target = rule_conf['jump_target']
         if not ipv6:
             if target not in dict_search_args(firewall, 'ipv4', 'name'):
                 raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
         else:
             if target not in dict_search_args(firewall, 'ipv6', 'name'):
                 raise ConfigError(f'Invalid jump-target. Firewall ipv6 name {target} does not exist on the system')
 
     if rule_conf['action'] == 'offload':
         if 'offload_target' not in rule_conf:
             raise ConfigError('Action set to offload, but no offload-target specified')
 
         offload_target = rule_conf['offload_target']
 
         if not dict_search_args(firewall, 'flowtable', offload_target):
             raise ConfigError(f'Invalid offload-target. Flowtable "{offload_target}" does not exist on the system')
 
     if rule_conf['action'] != 'synproxy' and 'synproxy' in rule_conf:
         raise ConfigError('"synproxy" option allowed only for action synproxy')
     if rule_conf['action'] == 'synproxy':
         if 'state' in rule_conf:
             raise ConfigError('For action "synproxy" state cannot be defined')
         if not rule_conf.get('synproxy', {}).get('tcp'):
             raise ConfigError('synproxy TCP MSS is not defined')
         if rule_conf.get('protocol', {}) != 'tcp':
             raise ConfigError('For action "synproxy" the protocol must be set to TCP')
 
     if 'queue_options' in rule_conf:
         if 'queue' not in rule_conf['action']:
             raise ConfigError('queue-options defined, but action queue needed and it is not defined')
         if 'fanout' in rule_conf['queue_options'] and ('queue' not in rule_conf or '-' not in rule_conf['queue']):
             raise ConfigError('queue-options fanout defined, then queue needs to be defined as a range')
 
     if 'queue' in rule_conf and 'queue' not in rule_conf['action']:
         raise ConfigError('queue defined, but action queue needed and it is not defined')
 
     if 'fragment' in rule_conf:
         if {'match_frag', 'match_non_frag'} <= set(rule_conf['fragment']):
             raise ConfigError('Cannot specify both "match-frag" and "match-non-frag"')
 
     if 'limit' in rule_conf:
         if 'rate' in rule_conf['limit']:
             rate_int = re.sub(r'\D', '', rule_conf['limit']['rate'])
             if int(rate_int) < 1:
                 raise ConfigError('Limit rate integer cannot be less than 1')
 
     if 'ipsec' in rule_conf:
         if {'match_ipsec', 'match_non_ipsec'} <= set(rule_conf['ipsec']):
             raise ConfigError('Cannot specify both "match-ipsec" and "match-non-ipsec"')
 
     if 'recent' in rule_conf:
         if not {'count', 'time'} <= set(rule_conf['recent']):
             raise ConfigError('Recent "count" and "time" values must be defined')
 
     tcp_flags = dict_search_args(rule_conf, 'tcp', 'flags')
     if tcp_flags:
         if dict_search_args(rule_conf, 'protocol') != 'tcp':
             raise ConfigError('Protocol must be tcp when specifying tcp flags')
 
         not_flags = dict_search_args(rule_conf, 'tcp', 'flags', 'not')
         if not_flags:
             duplicates = [flag for flag in tcp_flags if flag in not_flags]
             if duplicates:
                 raise ConfigError(f'Cannot match a tcp flag as set and not set')
 
     if 'protocol' in rule_conf:
         if rule_conf['protocol'] == 'icmp' and ipv6:
             raise ConfigError(f'Cannot match IPv4 ICMP protocol on IPv6, use ipv6-icmp')
         if rule_conf['protocol'] == 'ipv6-icmp' and not ipv6:
             raise ConfigError(f'Cannot match IPv6 ICMP protocol on IPv4, use icmp')
 
     for side in ['destination', 'source']:
         if side in rule_conf:
             side_conf = rule_conf[side]
 
             if len({'address', 'fqdn', 'geoip'} & set(side_conf)) > 1:
                 raise ConfigError('Only one of address, fqdn or geoip can be specified')
 
             if 'group' in side_conf:
                 if len({'address_group', 'network_group', 'domain_group'} & set(side_conf['group'])) > 1:
                     raise ConfigError('Only one address-group, network-group or domain-group can be specified')
 
                 for group in valid_groups:
                     if group in side_conf['group']:
                         group_name = side_conf['group'][group]
 
                         fw_group = f'ipv6_{group}' if ipv6 and group in ['address_group', 'network_group'] else group
                         error_group = fw_group.replace("_", "-")
 
                         if group in ['address_group', 'network_group', 'domain_group']:
                             types = [t for t in ['address', 'fqdn', 'geoip'] if t in side_conf]
                             if types:
                                 raise ConfigError(f'{error_group} and {types[0]} cannot both be defined')
 
                         if group_name and group_name[0] == '!':
                             group_name = group_name[1:]
 
                         group_obj = dict_search_args(firewall, 'group', fw_group, group_name)
 
                         if group_obj is None:
                             raise ConfigError(f'Invalid {error_group} "{group_name}" on firewall rule')
 
                         if not group_obj:
                             Warning(f'{error_group} "{group_name}" has no members!')
 
             if 'port' in side_conf or dict_search_args(side_conf, 'group', 'port_group'):
                 if 'protocol' not in rule_conf:
                     raise ConfigError('Protocol must be defined if specifying a port or port-group')
 
                 if rule_conf['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
                     raise ConfigError('Protocol must be tcp, udp, or tcp_udp when specifying a port or port-group')
 
             if 'port' in side_conf and dict_search_args(side_conf, 'group', 'port_group'):
                 raise ConfigError(f'{side} port-group and port cannot both be defined')
 
     if 'log_options' in rule_conf:
         if 'log' not in rule_conf:
             raise ConfigError('log-options defined, but log is not enable')
 
         if 'snapshot_length' in rule_conf['log_options'] and 'group' not in rule_conf['log_options']:
             raise ConfigError('log-options snapshot-length defined, but log group is not define')
 
         if 'queue_threshold' in rule_conf['log_options'] and 'group' not in rule_conf['log_options']:
             raise ConfigError('log-options queue-threshold defined, but log group is not define')
 
     for direction in ['inbound_interface','outbound_interface']:
         if direction in rule_conf:
             if 'name' in rule_conf[direction] and 'group' in rule_conf[direction]:
                 raise ConfigError(f'Cannot specify both interface group and interface name for {direction}')
 
 def verify_nested_group(group_name, group, groups, seen):
     if 'include' not in group:
         return
 
     seen.append(group_name)
 
     for g in group['include']:
         if g not in groups:
             raise ConfigError(f'Nested group "{g}" does not exist')
 
         if g in seen:
             raise ConfigError(f'Group "{group_name}" has a circular reference')
 
         if 'include' in groups[g]:
             verify_nested_group(g, groups[g], groups, seen)
 
 def verify_hardware_offload(ifname):
     ethtool = Ethtool(ifname)
     enabled, fixed = ethtool.get_hw_tc_offload()
 
     if not enabled and fixed:
         raise ConfigError(f'Interface "{ifname}" does not support hardware offload')
 
     if not enabled:
         raise ConfigError(f'Interface "{ifname}" requires "offload hw-tc-offload"')
 
 def verify(firewall):
     if 'flowtable' in firewall:
         for flowtable, flowtable_conf in firewall['flowtable'].items():
             if 'interface' not in flowtable_conf:
                 raise ConfigError(f'Flowtable "{flowtable}" requires at least one interface')
 
             for ifname in flowtable_conf['interface']:
                 verify_interface_exists(ifname)
 
             if dict_search_args(flowtable_conf, 'offload') == 'hardware':
                 interfaces = flowtable_conf['interface']
 
                 for ifname in interfaces:
                     verify_hardware_offload(ifname)
 
     if 'group' in firewall:
         for group_type in nested_group_types:
             if group_type in firewall['group']:
                 groups = firewall['group'][group_type]
                 for group_name, group in groups.items():
                     verify_nested_group(group_name, group, groups, [])
 
     if 'ipv4' in firewall:
         for name in ['name','forward','input','output']:
             if name in firewall['ipv4']:
                 for name_id, name_conf in firewall['ipv4'][name].items():
                     if 'jump' in name_conf['default_action'] and 'default_jump_target' not in name_conf:
                         raise ConfigError('default-action set to jump, but no default-jump-target specified')
                     if 'default_jump_target' in name_conf:
                         target = name_conf['default_jump_target']
                         if 'jump' not in name_conf['default_action']:
                             raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
                         if name_conf['default_jump_target'] == name_id:
                             raise ConfigError(f'Loop detected on default-jump-target.')
                         ## Now need to check that default-jump-target exists (other firewall chain/name)
                         if target not in dict_search_args(firewall['ipv4'], 'name'):
                             raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
 
                     if 'rule' in name_conf:
                         for rule_id, rule_conf in name_conf['rule'].items():
                             verify_rule(firewall, rule_conf, False)
 
     if 'ipv6' in firewall:
         for name in ['name','forward','input','output']:
             if name in firewall['ipv6']:
                 for name_id, name_conf in firewall['ipv6'][name].items():
                     if 'jump' in name_conf['default_action'] and 'default_jump_target' not in name_conf:
                         raise ConfigError('default-action set to jump, but no default-jump-target specified')
                     if 'default_jump_target' in name_conf:
                         target = name_conf['default_jump_target']
                         if 'jump' not in name_conf['default_action']:
                             raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
                         if name_conf['default_jump_target'] == name_id:
                             raise ConfigError(f'Loop detected on default-jump-target.')
                         ## Now need to check that default-jump-target exists (other firewall chain/name)
                         if target not in dict_search_args(firewall['ipv6'], 'name'):
                             raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
 
                     if 'rule' in name_conf:
                         for rule_id, rule_conf in name_conf['rule'].items():
                             verify_rule(firewall, rule_conf, True)
 
     #### ZONESSSS
     local_zone = False
     zone_interfaces = []
 
     if 'zone' in firewall:
         for zone, zone_conf in firewall['zone'].items():
             if 'local_zone' not in zone_conf and 'interface' not in zone_conf:
                 raise ConfigError(f'Zone "{zone}" has no interfaces and is not the local zone')
 
             if 'local_zone' in zone_conf:
                 if local_zone:
                     raise ConfigError('There cannot be multiple local zones')
                 if 'interface' in zone_conf:
                     raise ConfigError('Local zone cannot have interfaces assigned')
                 if 'intra_zone_filtering' in zone_conf:
                     raise ConfigError('Local zone cannot use intra-zone-filtering')
                 local_zone = True
 
             if 'interface' in zone_conf:
                 found_duplicates = [intf for intf in zone_conf['interface'] if intf in zone_interfaces]
 
                 if found_duplicates:
                     raise ConfigError(f'Interfaces cannot be assigned to multiple zones')
 
                 zone_interfaces += zone_conf['interface']
 
             if 'intra_zone_filtering' in zone_conf:
                 intra_zone = zone_conf['intra_zone_filtering']
 
                 if len(intra_zone) > 1:
                     raise ConfigError('Only one intra-zone-filtering action must be specified')
 
                 if 'firewall' in intra_zone:
                     v4_name = dict_search_args(intra_zone, 'firewall', 'name')
                     if v4_name and not dict_search_args(firewall, 'ipv4', 'name', v4_name):
                         raise ConfigError(f'Firewall name "{v4_name}" does not exist')
 
                     v6_name = dict_search_args(intra_zone, 'firewall', 'ipv6_name')
                     if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name):
                         raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist')
 
                     if not v4_name and not v6_name:
                         raise ConfigError('No firewall names specified for intra-zone-filtering')
 
             if 'from' in zone_conf:
                 for from_zone, from_conf in zone_conf['from'].items():
                     if from_zone not in firewall['zone']:
                         raise ConfigError(f'Zone "{zone}" refers to a non-existent or deleted zone "{from_zone}"')
 
                     v4_name = dict_search_args(from_conf, 'firewall', 'name')
                     if v4_name and not dict_search_args(firewall, 'ipv4', 'name', v4_name):
                         raise ConfigError(f'Firewall name "{v4_name}" does not exist')
 
                     v6_name = dict_search_args(from_conf, 'firewall', 'ipv6_name')
                     if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name):
                         raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist')
 
     return None
 
 def generate(firewall):
     if not os.path.exists(nftables_conf):
         firewall['first_install'] = True
 
     if 'zone' in firewall:
         for local_zone, local_zone_conf in firewall['zone'].items():
             if 'local_zone' not in local_zone_conf:
                 continue
 
             local_zone_conf['from_local'] = {}
 
             for zone, zone_conf in firewall['zone'].items():
                 if zone == local_zone or 'from' not in zone_conf:
                     continue
                 if local_zone in zone_conf['from']:
                     local_zone_conf['from_local'][zone] = zone_conf['from'][local_zone]
 
     render(nftables_conf, 'firewall/nftables.j2', firewall)
     return None
 
 def apply_sysfs(firewall):
     for name, conf in sysfs_config.items():
         paths = glob(conf['sysfs'])
         value = None
 
         if name in firewall['global_options']:
             conf_value = firewall['global_options'][name]
             if conf_value in conf:
                 value = conf[conf_value]
             elif conf_value == 'enable':
                 value = '1'
             elif conf_value == 'disable':
                 value = '0'
 
         if value:
             for path in paths:
                 with open(path, 'w') as f:
                     f.write(value)
 
 def apply(firewall):
     install_result, output = rc_cmd(f'nft -f {nftables_conf}')
     if install_result == 1:
         raise ConfigError(f'Failed to apply firewall: {output}')
 
     apply_sysfs(firewall)
 
     call_dependents()
 
     # T970 Enable a resolver (systemd daemon) that checks
     # domain-group/fqdn addresses and update entries for domains by timeout
     # If router loaded without internet connection or for synchronization
     domain_action = 'stop'
     if dict_search_args(firewall, 'group', 'domain_group') or firewall['ip_fqdn'] or firewall['ip6_fqdn']:
         domain_action = 'restart'
     call(f'systemctl {domain_action} vyos-domain-resolver.service')
 
     if firewall['geoip_updated']:
         # Call helper script to Update set contents
         if 'name' in firewall['geoip_updated'] or 'ipv6_name' in firewall['geoip_updated']:
             print('Updating GeoIP. Please wait...')
             geoip_update(firewall)
 
     return None
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         exit(1)
diff --git a/src/conf_mode/interfaces-bonding.py b/src/conf_mode/interfaces_bonding.py
similarity index 100%
rename from src/conf_mode/interfaces-bonding.py
rename to src/conf_mode/interfaces_bonding.py
diff --git a/src/conf_mode/interfaces-bridge.py b/src/conf_mode/interfaces_bridge.py
similarity index 100%
rename from src/conf_mode/interfaces-bridge.py
rename to src/conf_mode/interfaces_bridge.py
diff --git a/src/conf_mode/interfaces-dummy.py b/src/conf_mode/interfaces_dummy.py
similarity index 100%
rename from src/conf_mode/interfaces-dummy.py
rename to src/conf_mode/interfaces_dummy.py
diff --git a/src/conf_mode/interfaces-ethernet.py b/src/conf_mode/interfaces_ethernet.py
similarity index 100%
rename from src/conf_mode/interfaces-ethernet.py
rename to src/conf_mode/interfaces_ethernet.py
diff --git a/src/conf_mode/interfaces-geneve.py b/src/conf_mode/interfaces_geneve.py
similarity index 100%
rename from src/conf_mode/interfaces-geneve.py
rename to src/conf_mode/interfaces_geneve.py
diff --git a/src/conf_mode/interfaces-input.py b/src/conf_mode/interfaces_input.py
similarity index 100%
rename from src/conf_mode/interfaces-input.py
rename to src/conf_mode/interfaces_input.py
diff --git a/src/conf_mode/interfaces-l2tpv3.py b/src/conf_mode/interfaces_l2tpv3.py
similarity index 100%
rename from src/conf_mode/interfaces-l2tpv3.py
rename to src/conf_mode/interfaces_l2tpv3.py
diff --git a/src/conf_mode/interfaces-loopback.py b/src/conf_mode/interfaces_loopback.py
similarity index 100%
rename from src/conf_mode/interfaces-loopback.py
rename to src/conf_mode/interfaces_loopback.py
diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces_macsec.py
similarity index 100%
rename from src/conf_mode/interfaces-macsec.py
rename to src/conf_mode/interfaces_macsec.py
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces_openvpn.py
similarity index 100%
rename from src/conf_mode/interfaces-openvpn.py
rename to src/conf_mode/interfaces_openvpn.py
diff --git a/src/conf_mode/interfaces-pppoe.py b/src/conf_mode/interfaces_pppoe.py
similarity index 100%
rename from src/conf_mode/interfaces-pppoe.py
rename to src/conf_mode/interfaces_pppoe.py
diff --git a/src/conf_mode/interfaces-pseudo-ethernet.py b/src/conf_mode/interfaces_pseudo-ethernet.py
similarity index 100%
rename from src/conf_mode/interfaces-pseudo-ethernet.py
rename to src/conf_mode/interfaces_pseudo-ethernet.py
diff --git a/src/conf_mode/interfaces-sstpc.py b/src/conf_mode/interfaces_sstpc.py
similarity index 100%
rename from src/conf_mode/interfaces-sstpc.py
rename to src/conf_mode/interfaces_sstpc.py
diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces_tunnel.py
similarity index 100%
rename from src/conf_mode/interfaces-tunnel.py
rename to src/conf_mode/interfaces_tunnel.py
diff --git a/src/conf_mode/interfaces-virtual-ethernet.py b/src/conf_mode/interfaces_virtual-ethernet.py
similarity index 100%
rename from src/conf_mode/interfaces-virtual-ethernet.py
rename to src/conf_mode/interfaces_virtual-ethernet.py
diff --git a/src/conf_mode/interfaces-vti.py b/src/conf_mode/interfaces_vti.py
similarity index 100%
rename from src/conf_mode/interfaces-vti.py
rename to src/conf_mode/interfaces_vti.py
diff --git a/src/conf_mode/interfaces-vxlan.py b/src/conf_mode/interfaces_vxlan.py
similarity index 100%
rename from src/conf_mode/interfaces-vxlan.py
rename to src/conf_mode/interfaces_vxlan.py
diff --git a/src/conf_mode/interfaces-wireguard.py b/src/conf_mode/interfaces_wireguard.py
similarity index 100%
rename from src/conf_mode/interfaces-wireguard.py
rename to src/conf_mode/interfaces_wireguard.py
diff --git a/src/conf_mode/interfaces-wireless.py b/src/conf_mode/interfaces_wireless.py
similarity index 100%
rename from src/conf_mode/interfaces-wireless.py
rename to src/conf_mode/interfaces_wireless.py
diff --git a/src/conf_mode/interfaces-wwan.py b/src/conf_mode/interfaces_wwan.py
similarity index 100%
rename from src/conf_mode/interfaces-wwan.py
rename to src/conf_mode/interfaces_wwan.py
diff --git a/src/conf_mode/load-balancing-haproxy.py b/src/conf_mode/load-balancing_reverse-proxy.py
similarity index 100%
rename from src/conf_mode/load-balancing-haproxy.py
rename to src/conf_mode/load-balancing_reverse-proxy.py
diff --git a/src/conf_mode/load-balancing-wan.py b/src/conf_mode/load-balancing_wan.py
similarity index 100%
rename from src/conf_mode/load-balancing-wan.py
rename to src/conf_mode/load-balancing_wan.py
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 34ba2fe69..f7e14aa16 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -1,305 +1,305 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from sys import exit
 
 from vyos.config import Config
 from vyos.configdep import set_dependents, call_dependents
 from vyos.configdict import node_changed
 from vyos.pki import is_ca_certificate
 from vyos.pki import load_certificate
 from vyos.pki import load_public_key
 from vyos.pki import load_private_key
 from vyos.pki import load_crl
 from vyos.pki import load_dh_parameters
 from vyos.utils.dict import dict_search_args
 from vyos.utils.dict import dict_search_recursive
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
 # keys to recursively search for under specified path, script to call if update required
 sync_search = [
     {
         'keys': ['certificate'],
         'path': ['service', 'https'],
-        'script': '/usr/libexec/vyos/conf_mode/https.py'
+        'script': '/usr/libexec/vyos/conf_mode/service_https.py'
     },
     {
         'keys': ['certificate', 'ca_certificate'],
         'path': ['interfaces', 'ethernet'],
-        'script': '/usr/libexec/vyos/conf_mode/interfaces-ethernet.py'
+        'script': '/usr/libexec/vyos/conf_mode/interfaces_ethernet.py'
     },
     {
         'keys': ['certificate', 'ca_certificate', 'dh_params', 'shared_secret_key', 'auth_key', 'crypt_key'],
         'path': ['interfaces', 'openvpn'],
-        'script': '/usr/libexec/vyos/conf_mode/interfaces-openvpn.py'
+        'script': '/usr/libexec/vyos/conf_mode/interfaces_openvpn.py'
     },
     {
         'keys': ['ca_certificate'],
         'path': ['interfaces', 'sstpc'],
-        'script': '/usr/libexec/vyos/conf_mode/interfaces-sstpc.py'
+        'script': '/usr/libexec/vyos/conf_mode/interfaces_sstpc.py'
     },
     {
         'keys': ['certificate', 'ca_certificate', 'local_key', 'remote_key'],
         'path': ['vpn', 'ipsec'],
         'script': '/usr/libexec/vyos/conf_mode/vpn_ipsec.py'
     },
     {
         'keys': ['certificate', 'ca_certificate'],
         'path': ['vpn', 'openconnect'],
         'script': '/usr/libexec/vyos/conf_mode/vpn_openconnect.py'
     },
     {
         'keys': ['certificate', 'ca_certificate'],
         'path': ['vpn', 'sstp'],
         'script': '/usr/libexec/vyos/conf_mode/vpn_sstp.py'
     }
 ]
 
 # key from other config nodes -> key in pki['changed'] and pki
 sync_translate = {
     'certificate': 'certificate',
     'ca_certificate': 'ca',
     'dh_params': 'dh',
     'local_key': 'key_pair',
     'remote_key': 'key_pair',
     'shared_secret_key': 'openvpn',
     'auth_key': 'openvpn',
     'crypt_key': 'openvpn'
 }
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
     base = ['pki']
 
     pki = conf.get_config_dict(base, key_mangling=('-', '_'),
                                      get_first_key=True,
                                      no_tag_node_value_mangle=True)
 
     pki['changed'] = {}
     tmp = node_changed(conf, base + ['ca'], key_mangling=('-', '_'), recursive=True)
     if tmp: pki['changed'].update({'ca' : tmp})
 
     tmp = node_changed(conf, base + ['certificate'], key_mangling=('-', '_'), recursive=True)
     if tmp: pki['changed'].update({'certificate' : tmp})
 
     tmp = node_changed(conf, base + ['dh'], key_mangling=('-', '_'), recursive=True)
     if tmp: pki['changed'].update({'dh' : tmp})
 
     tmp = node_changed(conf, base + ['key-pair'], key_mangling=('-', '_'), recursive=True)
     if tmp: pki['changed'].update({'key_pair' : tmp})
 
     tmp = node_changed(conf, base + ['openvpn', 'shared-secret'], key_mangling=('-', '_'), recursive=True)
     if tmp: pki['changed'].update({'openvpn' : tmp})
 
     # We only merge on the defaults of there is a configuration at all
     if conf.exists(base):
         pki = conf.merge_defaults(pki, recursive=True)
 
     # We need to get the entire system configuration to verify that we are not
     # deleting a certificate that is still referenced somewhere!
     pki['system'] = conf.get_config_dict([], key_mangling=('-', '_'),
                                          get_first_key=True,
                                          no_tag_node_value_mangle=True)
 
     if 'changed' in pki:
         for search in sync_search:
             for key in search['keys']:
                 changed_key = sync_translate[key]
 
                 if changed_key not in pki['changed']:
                     continue
 
                 for item_name in pki['changed'][changed_key]:
                     node_present = False
                     if changed_key == 'openvpn':
                         node_present = dict_search_args(pki, 'openvpn', 'shared_secret', item_name)
                     else:
                         node_present = dict_search_args(pki, changed_key, item_name)
 
                     if node_present:
                         search_dict = dict_search_args(pki['system'], *search['path'])
 
                         if not search_dict:
                             continue
 
                         for found_name, found_path in dict_search_recursive(search_dict, key):
                             if found_name == item_name:
                                 path = search['path']
                                 path_str = ' '.join(path + found_path)
                                 print(f'pki: Updating config: {path_str} {found_name}')
 
                                 if path[0] == 'interfaces':
                                     ifname = found_path[0]
                                     set_dependents(path[1], conf, ifname)
                                 else:
                                     set_dependents(path[1], conf)
 
     return pki
 
 def is_valid_certificate(raw_data):
     # If it loads correctly we're good, or return False
     return load_certificate(raw_data, wrap_tags=True)
 
 def is_valid_ca_certificate(raw_data):
     # Check if this is a valid certificate with CA attributes
     cert = load_certificate(raw_data, wrap_tags=True)
     if not cert:
         return False
     return is_ca_certificate(cert)
 
 def is_valid_public_key(raw_data):
     # If it loads correctly we're good, or return False
     return load_public_key(raw_data, wrap_tags=True)
 
 def is_valid_private_key(raw_data, protected=False):
     # If it loads correctly we're good, or return False
     # With encrypted private keys, we always return true as we cannot ask for password to verify
     if protected:
         return True
     return load_private_key(raw_data, passphrase=None, wrap_tags=True)
 
 def is_valid_crl(raw_data):
     # If it loads correctly we're good, or return False
     return load_crl(raw_data, wrap_tags=True)
 
 def is_valid_dh_parameters(raw_data):
     # If it loads correctly we're good, or return False
     return load_dh_parameters(raw_data, wrap_tags=True)
 
 def verify(pki):
     if not pki:
         return None
 
     if 'ca' in pki:
         for name, ca_conf in pki['ca'].items():
             if 'certificate' in ca_conf:
                 if not is_valid_ca_certificate(ca_conf['certificate']):
                     raise ConfigError(f'Invalid certificate on CA certificate "{name}"')
 
             if 'private' in ca_conf and 'key' in ca_conf['private']:
                 private = ca_conf['private']
                 protected = 'password_protected' in private
 
                 if not is_valid_private_key(private['key'], protected):
                     raise ConfigError(f'Invalid private key on CA certificate "{name}"')
 
             if 'crl' in ca_conf:
                 ca_crls = ca_conf['crl']
                 if isinstance(ca_crls, str):
                     ca_crls = [ca_crls]
 
                 for crl in ca_crls:
                     if not is_valid_crl(crl):
                         raise ConfigError(f'Invalid CRL on CA certificate "{name}"')
 
     if 'certificate' in pki:
         for name, cert_conf in pki['certificate'].items():
             if 'certificate' in cert_conf:
                 if not is_valid_certificate(cert_conf['certificate']):
                     raise ConfigError(f'Invalid certificate on certificate "{name}"')
 
             if 'private' in cert_conf and 'key' in cert_conf['private']:
                 private = cert_conf['private']
                 protected = 'password_protected' in private
 
                 if not is_valid_private_key(private['key'], protected):
                     raise ConfigError(f'Invalid private key on certificate "{name}"')
 
     if 'dh' in pki:
         for name, dh_conf in pki['dh'].items():
             if 'parameters' in dh_conf:
                 if not is_valid_dh_parameters(dh_conf['parameters']):
                     raise ConfigError(f'Invalid DH parameters on "{name}"')
 
     if 'key_pair' in pki:
         for name, key_conf in pki['key_pair'].items():
             if 'public' in key_conf and 'key' in key_conf['public']:
                 if not is_valid_public_key(key_conf['public']['key']):
                     raise ConfigError(f'Invalid public key on key-pair "{name}"')
 
             if 'private' in key_conf and 'key' in key_conf['private']:
                 private = key_conf['private']
                 protected = 'password_protected' in private
                 if not is_valid_private_key(private['key'], protected):
                     raise ConfigError(f'Invalid private key on key-pair "{name}"')
 
     if 'x509' in pki:
         if 'default' in pki['x509']:
             default_values = pki['x509']['default']
             if 'country' in default_values:
                 country = default_values['country']
                 if len(country) != 2 or not country.isalpha():
                     raise ConfigError(f'Invalid default country value. Value must be 2 alpha characters.')
 
     if 'changed' in pki:
         # if the list is getting longer, we can move to a dict() and also embed the
         # search key as value from line 173 or 176
         for search in sync_search:
             for key in search['keys']:
                 changed_key = sync_translate[key]
 
                 if changed_key not in pki['changed']:
                     continue
 
                 for item_name in pki['changed'][changed_key]:
                     node_present = False
                     if changed_key == 'openvpn':
                         node_present = dict_search_args(pki, 'openvpn', 'shared_secret', item_name)
                     else:
                         node_present = dict_search_args(pki, changed_key, item_name)
 
                     if not node_present:
                         search_dict = dict_search_args(pki['system'], *search['path'])
 
                         if not search_dict:
                             continue
 
                         for found_name, found_path in dict_search_recursive(search_dict, key):
                             if found_name == item_name:
                                 path_str = " ".join(search['path'] + found_path)
                                 raise ConfigError(f'PKI object "{item_name}" still in use by "{path_str}"')
 
     return None
 
 def generate(pki):
     if not pki:
         return None
 
     return None
 
 def apply(pki):
     if not pki:
         return None
 
     if 'changed' in pki:
         call_dependents()
 
     return None
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         exit(1)
diff --git a/src/conf_mode/policy-local-route.py b/src/conf_mode/policy_local-route.py
similarity index 100%
rename from src/conf_mode/policy-local-route.py
rename to src/conf_mode/policy_local-route.py
diff --git a/src/conf_mode/policy-route.py b/src/conf_mode/policy_route.py
similarity index 100%
rename from src/conf_mode/policy-route.py
rename to src/conf_mode/policy_route.py
diff --git a/src/conf_mode/igmp_proxy.py b/src/conf_mode/protocols_igmp-proxy.py
similarity index 100%
rename from src/conf_mode/igmp_proxy.py
rename to src/conf_mode/protocols_igmp-proxy.py
diff --git a/src/conf_mode/protocols_segment_routing.py b/src/conf_mode/protocols_segment-routing.py
similarity index 100%
rename from src/conf_mode/protocols_segment_routing.py
rename to src/conf_mode/protocols_segment-routing.py
diff --git a/src/conf_mode/arp.py b/src/conf_mode/protocols_static_arp.py
similarity index 100%
rename from src/conf_mode/arp.py
rename to src/conf_mode/protocols_static_arp.py
diff --git a/src/conf_mode/bcast_relay.py b/src/conf_mode/service_broadcast-relay.py
similarity index 100%
rename from src/conf_mode/bcast_relay.py
rename to src/conf_mode/service_broadcast-relay.py
diff --git a/src/conf_mode/service_config_sync.py b/src/conf_mode/service_config-sync.py
similarity index 100%
rename from src/conf_mode/service_config_sync.py
rename to src/conf_mode/service_config-sync.py
diff --git a/src/conf_mode/conntrack_sync.py b/src/conf_mode/service_conntrack-sync.py
similarity index 100%
rename from src/conf_mode/conntrack_sync.py
rename to src/conf_mode/service_conntrack-sync.py
diff --git a/src/conf_mode/dhcp_relay.py b/src/conf_mode/service_dhcp-relay.py
similarity index 100%
rename from src/conf_mode/dhcp_relay.py
rename to src/conf_mode/service_dhcp-relay.py
diff --git a/src/conf_mode/dhcp_server.py b/src/conf_mode/service_dhcp-server.py
similarity index 100%
rename from src/conf_mode/dhcp_server.py
rename to src/conf_mode/service_dhcp-server.py
diff --git a/src/conf_mode/dhcpv6_relay.py b/src/conf_mode/service_dhcpv6-relay.py
similarity index 100%
rename from src/conf_mode/dhcpv6_relay.py
rename to src/conf_mode/service_dhcpv6-relay.py
diff --git a/src/conf_mode/dhcpv6_server.py b/src/conf_mode/service_dhcpv6-server.py
similarity index 100%
rename from src/conf_mode/dhcpv6_server.py
rename to src/conf_mode/service_dhcpv6-server.py
diff --git a/src/conf_mode/dns_dynamic.py b/src/conf_mode/service_dns_dynamic.py
similarity index 100%
rename from src/conf_mode/dns_dynamic.py
rename to src/conf_mode/service_dns_dynamic.py
diff --git a/src/conf_mode/dns_forwarding.py b/src/conf_mode/service_dns_forwarding.py
similarity index 100%
rename from src/conf_mode/dns_forwarding.py
rename to src/conf_mode/service_dns_forwarding.py
diff --git a/src/conf_mode/service_event_handler.py b/src/conf_mode/service_event-handler.py
similarity index 100%
rename from src/conf_mode/service_event_handler.py
rename to src/conf_mode/service_event-handler.py
diff --git a/src/conf_mode/https.py b/src/conf_mode/service_https.py
similarity index 100%
rename from src/conf_mode/https.py
rename to src/conf_mode/service_https.py
diff --git a/src/conf_mode/le_cert.py b/src/conf_mode/service_https_certificates_certbot.py
similarity index 99%
rename from src/conf_mode/le_cert.py
rename to src/conf_mode/service_https_certificates_certbot.py
index 06c7e7b72..1a6a498de 100755
--- a/src/conf_mode/le_cert.py
+++ b/src/conf_mode/service_https_certificates_certbot.py
@@ -1,115 +1,114 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2019-2020 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import sys
 import os
 
 import vyos.defaults
 from vyos.config import Config
 from vyos import ConfigError
 from vyos.utils.process import cmd
 from vyos.utils.process import call
 from vyos.utils.process import is_systemd_service_running
 
 from vyos import airbag
 airbag.enable()
 
 vyos_conf_scripts_dir = vyos.defaults.directories['conf_mode']
 vyos_certbot_dir = vyos.defaults.directories['certbot']
 
 dependencies = [
-    'https.py',
+    'service_https.py',
 ]
 
 def request_certbot(cert):
     email = cert.get('email')
     if email is not None:
         email_flag = '-m {0}'.format(email)
     else:
         email_flag = ''
 
     domains = cert.get('domains')
     if domains is not None:
         domain_flag = '-d ' + ' -d '.join(domains)
     else:
         domain_flag = ''
 
     certbot_cmd = f'certbot certonly --config-dir {vyos_certbot_dir} -n --nginx --agree-tos --no-eff-email --expand {email_flag} {domain_flag}'
 
     cmd(certbot_cmd,
         raising=ConfigError,
         message="The certbot request failed for the specified domains.")
 
 def get_config():
     conf = Config()
     if not conf.exists('service https certificates certbot'):
         return None
     else:
         conf.set_level('service https certificates certbot')
 
     cert = {}
 
     if conf.exists('domain-name'):
         cert['domains'] = conf.return_values('domain-name')
 
     if conf.exists('email'):
         cert['email'] = conf.return_value('email')
 
     return cert
 
 def verify(cert):
     if cert is None:
         return None
 
     if 'domains' not in cert:
         raise ConfigError("At least one domain name is required to"
                           " request a letsencrypt certificate.")
 
     if 'email' not in cert:
         raise ConfigError("An email address is required to request"
                           " a letsencrypt certificate.")
 
 def generate(cert):
     if cert is None:
         return None
 
     # certbot will attempt to reload nginx, even with 'certonly';
     # start nginx if not active
     if not is_systemd_service_running('nginx.service'):
         call('systemctl start nginx.service')
 
     request_certbot(cert)
 
 def apply(cert):
     if cert is not None:
         call('systemctl restart certbot.timer')
     else:
         call('systemctl stop certbot.timer')
         return None
 
     for dep in dependencies:
         cmd(f'{vyos_conf_scripts_dir}/{dep}', raising=ConfigError)
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         sys.exit(1)
-
diff --git a/src/conf_mode/service_ids_fastnetmon.py b/src/conf_mode/service_ids_ddos-protection.py
similarity index 100%
rename from src/conf_mode/service_ids_fastnetmon.py
rename to src/conf_mode/service_ids_ddos-protection.py
diff --git a/src/conf_mode/lldp.py b/src/conf_mode/service_lldp.py
similarity index 100%
rename from src/conf_mode/lldp.py
rename to src/conf_mode/service_lldp.py
diff --git a/src/conf_mode/service_mdns-repeater.py b/src/conf_mode/service_mdns_repeater.py
similarity index 100%
rename from src/conf_mode/service_mdns-repeater.py
rename to src/conf_mode/service_mdns_repeater.py
diff --git a/src/conf_mode/ntp.py b/src/conf_mode/service_ntp.py
similarity index 100%
rename from src/conf_mode/ntp.py
rename to src/conf_mode/service_ntp.py
diff --git a/src/conf_mode/salt-minion.py b/src/conf_mode/service_salt-minion.py
similarity index 100%
rename from src/conf_mode/salt-minion.py
rename to src/conf_mode/service_salt-minion.py
diff --git a/src/conf_mode/snmp.py b/src/conf_mode/service_snmp.py
similarity index 100%
rename from src/conf_mode/snmp.py
rename to src/conf_mode/service_snmp.py
diff --git a/src/conf_mode/ssh.py b/src/conf_mode/service_ssh.py
similarity index 100%
rename from src/conf_mode/ssh.py
rename to src/conf_mode/service_ssh.py
diff --git a/src/conf_mode/tftp_server.py b/src/conf_mode/service_tftp-server.py
similarity index 100%
rename from src/conf_mode/tftp_server.py
rename to src/conf_mode/service_tftp-server.py
diff --git a/src/conf_mode/intel_qat.py b/src/conf_mode/system_acceleration.py
similarity index 100%
rename from src/conf_mode/intel_qat.py
rename to src/conf_mode/system_acceleration.py
diff --git a/src/conf_mode/config_mgmt.py b/src/conf_mode/system_config-management.py
similarity index 100%
rename from src/conf_mode/config_mgmt.py
rename to src/conf_mode/system_config-management.py
diff --git a/src/conf_mode/conntrack.py b/src/conf_mode/system_conntrack.py
similarity index 100%
rename from src/conf_mode/conntrack.py
rename to src/conf_mode/system_conntrack.py
diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/system_flow-accounting.py
similarity index 100%
rename from src/conf_mode/flow_accounting_conf.py
rename to src/conf_mode/system_flow-accounting.py
diff --git a/src/conf_mode/host_name.py b/src/conf_mode/system_host-name.py
similarity index 100%
rename from src/conf_mode/host_name.py
rename to src/conf_mode/system_host-name.py
diff --git a/src/conf_mode/system-ip.py b/src/conf_mode/system_ip.py
similarity index 100%
rename from src/conf_mode/system-ip.py
rename to src/conf_mode/system_ip.py
diff --git a/src/conf_mode/system-ipv6.py b/src/conf_mode/system_ipv6.py
similarity index 100%
rename from src/conf_mode/system-ipv6.py
rename to src/conf_mode/system_ipv6.py
diff --git a/src/conf_mode/system-login.py b/src/conf_mode/system_login.py
similarity index 100%
rename from src/conf_mode/system-login.py
rename to src/conf_mode/system_login.py
diff --git a/src/conf_mode/system-login-banner.py b/src/conf_mode/system_login_banner.py
similarity index 100%
rename from src/conf_mode/system-login-banner.py
rename to src/conf_mode/system_login_banner.py
diff --git a/src/conf_mode/system-logs.py b/src/conf_mode/system_logs.py
similarity index 100%
rename from src/conf_mode/system-logs.py
rename to src/conf_mode/system_logs.py
diff --git a/src/conf_mode/system-option.py b/src/conf_mode/system_option.py
similarity index 100%
rename from src/conf_mode/system-option.py
rename to src/conf_mode/system_option.py
diff --git a/src/conf_mode/system-proxy.py b/src/conf_mode/system_proxy.py
similarity index 100%
rename from src/conf_mode/system-proxy.py
rename to src/conf_mode/system_proxy.py
diff --git a/src/conf_mode/system-syslog.py b/src/conf_mode/system_syslog.py
similarity index 100%
rename from src/conf_mode/system-syslog.py
rename to src/conf_mode/system_syslog.py
diff --git a/src/conf_mode/task_scheduler.py b/src/conf_mode/system_task-scheduler.py
similarity index 100%
rename from src/conf_mode/task_scheduler.py
rename to src/conf_mode/system_task-scheduler.py
diff --git a/src/conf_mode/system-timezone.py b/src/conf_mode/system_timezone.py
similarity index 100%
rename from src/conf_mode/system-timezone.py
rename to src/conf_mode/system_timezone.py
diff --git a/src/conf_mode/system_update_check.py b/src/conf_mode/system_update-check.py
similarity index 100%
rename from src/conf_mode/system_update_check.py
rename to src/conf_mode/system_update-check.py
diff --git a/src/etc/ppp/ip-down.d/98-vyos-pppoe-cleanup-nameservers b/src/etc/ppp/ip-down.d/98-vyos-pppoe-cleanup-nameservers
index 222c75f21..5157469f4 100755
--- a/src/etc/ppp/ip-down.d/98-vyos-pppoe-cleanup-nameservers
+++ b/src/etc/ppp/ip-down.d/98-vyos-pppoe-cleanup-nameservers
@@ -1,15 +1,14 @@
 #!/bin/bash
-### Autogenerated by interfaces-pppoe.py ###
 
 interface=$6
 if [ -z "$interface" ]; then
     exit
 fi
 
 if ! /usr/bin/systemctl -q is-active vyos-hostsd; then
     exit  # vyos-hostsd is not running
 fi
 
 hostsd_client="/usr/bin/vyos-hostsd-client"
 $hostsd_client --delete-name-servers --tag "dhcp-$interface"
 $hostsd_client --apply
diff --git a/src/etc/ppp/ip-up.d/98-vyos-pppoe-setup-nameservers b/src/etc/ppp/ip-up.d/98-vyos-pppoe-setup-nameservers
index 0fcedbedc..4affaeb5c 100755
--- a/src/etc/ppp/ip-up.d/98-vyos-pppoe-setup-nameservers
+++ b/src/etc/ppp/ip-up.d/98-vyos-pppoe-setup-nameservers
@@ -1,24 +1,23 @@
 #!/bin/bash
-### Autogenerated by interfaces-pppoe.py ###
 
 interface=$6
 if [ -z "$interface" ]; then
     exit
 fi
 
 if ! /usr/bin/systemctl -q is-active vyos-hostsd; then
     exit  # vyos-hostsd is not running
 fi
 
 hostsd_client="/usr/bin/vyos-hostsd-client"
 
 $hostsd_client --delete-name-servers --tag "dhcp-$interface"
 
 if [ "$USEPEERDNS" ] && [ -n "$DNS1" ]; then
 $hostsd_client --add-name-servers "$DNS1" --tag "dhcp-$interface"
 fi
 if [ "$USEPEERDNS" ] && [ -n "$DNS2" ]; then
 $hostsd_client --add-name-servers "$DNS2" --tag "dhcp-$interface"
 fi
 
 $hostsd_client --apply
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 711681a8e..aaecbf2a1 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -1,484 +1,484 @@
 #!/bin/bash
 # Copyright (C) 2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 . /lib/lsb/init-functions
 
 : ${vyatta_env:=/etc/default/vyatta}
 source $vyatta_env
 
 declare progname=${0##*/}
 declare action=$1; shift
 
 declare -x BOOTFILE=$vyatta_sysconfdir/config/config.boot
 
 # If vyos-config= boot option is present, use that file instead
 for x in $(cat /proc/cmdline); do
     [[ $x = vyos-config=* ]] || continue
     VYOS_CONFIG="${x#vyos-config=}"
 done
 
 if [ ! -z "$VYOS_CONFIG" ]; then
     if [ -r "$VYOS_CONFIG" ]; then
         echo "Config selected manually: $VYOS_CONFIG"
         declare -x BOOTFILE="$VYOS_CONFIG"
     else
         echo "WARNING: Could not read selected config file, using default!"
     fi
 fi
 
 declare -a subinit
 declare -a all_subinits=( firewall )
 
 if [ $# -gt 0 ] ; then
     for s in $@ ; do
         [ -x ${vyatta_sbindir}/${s}.init ] && subinit[${#subinit}]=$s
     done
 else
     for s in ${all_subinits[@]} ; do
         [ -x ${vyatta_sbindir}/${s}.init ] && subinit[${#subinit}]=$s
     done
 fi
 
 GROUP=vyattacfg
 
 # easy way to make empty file without any command
 empty()
 {
     >$1
 }
 
 # check if bootup of this portion is disabled
 disabled () {
     grep -q -w no-vyos-$1 /proc/cmdline
 }
 
 # if necessary, provide initial config
 init_bootfile () {
     if [ ! -r $BOOTFILE ] ; then
         if [ -f $vyatta_sysconfdir/config.boot.default ]; then
             cp $vyatta_sysconfdir/config.boot.default $BOOTFILE
         else
             $vyos_libexec_dir/system-versions-foot.py > $BOOTFILE
         fi
         chgrp ${GROUP} $BOOTFILE
         chmod 660 $BOOTFILE
     fi
 }
 
 # if necessary, migrate initial config
 migrate_bootfile ()
 {
     if [ -x $vyos_libexec_dir/run-config-migration.py ]; then
         log_progress_msg migrate
         sg ${GROUP} -c "$vyos_libexec_dir/run-config-migration.py $BOOTFILE"
     fi
 }
 
 # load the initial config
 load_bootfile ()
 {
     log_progress_msg configure
     (
         if [ -f /etc/default/vyatta-load-boot ]; then
             # build-specific environment for boot-time config loading
             source /etc/default/vyatta-load-boot
         fi
         if [ -x $vyos_libexec_dir/vyos-boot-config-loader.py ]; then
             sg ${GROUP} -c "$vyos_libexec_dir/vyos-boot-config-loader.py $BOOTFILE"
         fi
     )
 }
 
 # restore if missing pre-config script
 restore_if_missing_preconfig_script ()
 {
     if [ ! -x ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script ]; then
         mkdir -p ${vyatta_sysconfdir}/config/scripts
         chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts
         chmod 775 ${vyatta_sysconfdir}/config/scripts
         cp ${vyos_rootfs_dir}/opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script ${vyatta_sysconfdir}/config/scripts/
         chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script
         chmod 750 ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script
     fi
 }
 
 # execute the pre-config script
 run_preconfig_script ()
 {
     if [ -x $vyatta_sysconfdir/config/scripts/vyos-preconfig-bootup.script ]; then
         $vyatta_sysconfdir/config/scripts/vyos-preconfig-bootup.script
     fi
 }
 
 # restore if missing post-config script
 restore_if_missing_postconfig_script ()
 {
     if [ ! -x ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script ]; then
         mkdir -p ${vyatta_sysconfdir}/config/scripts
         chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts
         chmod 775 ${vyatta_sysconfdir}/config/scripts
         cp ${vyos_rootfs_dir}/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script ${vyatta_sysconfdir}/config/scripts/
         chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script
         chmod 750 ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script
     fi
 }
 
 # execute the post-config scripts
 run_postconfig_scripts ()
 {
     if [ -x $vyatta_sysconfdir/config/scripts/vyatta-postconfig-bootup.script ]; then
         $vyatta_sysconfdir/config/scripts/vyatta-postconfig-bootup.script
     fi
     if [ -x $vyatta_sysconfdir/config/scripts/vyos-postconfig-bootup.script ]; then
         $vyatta_sysconfdir/config/scripts/vyos-postconfig-bootup.script
     fi
 }
 
 run_postupgrade_script ()
 {
     if [ -f $vyatta_sysconfdir/config/.upgraded ]; then
         # Run the system script
         /usr/libexec/vyos/system/post-upgrade
 
         # Run user scripts
         if [ -d $vyatta_sysconfdir/config/scripts/post-upgrade.d ]; then
             run-parts $vyatta_sysconfdir/config/scripts/post-upgrade.d
         fi
         rm -f $vyatta_sysconfdir/config/.upgraded
     fi
 }
 
 #
 # On image booted machines, we need to mount /boot from the image-specific
 # boot directory so that kernel package installation will put the
 # files in the right place.  We also have to mount /boot/grub from the
 # system-wide grub directory so that tools that edit the grub.cfg
 # file will find it in the expected location.
 #
 bind_mount_boot ()
 {
     persist_path=$(/opt/vyatta/sbin/vyos-persistpath)
     if [ $? == 0 ]; then
         if [ -e $persist_path/boot ]; then
             image_name=$(cat /proc/cmdline | sed -e s+^.*vyos-union=/boot/++ | sed -e 's/ .*$//')
 
             if [ -n "$image_name" ]; then
                 mount --bind $persist_path/boot/$image_name /boot
                 if [ $? -ne 0 ]; then
                     echo "Couldn't bind mount /boot"
                 fi
 
                 if [ ! -d /boot/grub ]; then
                     mkdir /boot/grub
                 fi
 
                 mount --bind $persist_path/boot/grub /boot/grub
                 if [ $? -ne 0 ]; then
                     echo "Couldn't bind mount /boot/grub"
                 fi
             fi
         fi
     fi
 }
 
 clear_or_override_config_files ()
 {
     for conf in snmp/snmpd.conf snmp/snmptrapd.conf snmp/snmp.conf \
         keepalived/keepalived.conf cron.d/vyos-crontab \
         ipvsadm.rules default/ipvsadm resolv.conf
     do
     if [ -s /etc/$conf ] ; then
         empty /etc/$conf
         chmod 0644 /etc/$conf
     fi
     done
 }
 
 update_interface_config ()
 {
     if [ -d /run/udev/vyos ]; then
         $vyos_libexec_dir/vyos-interface-rescan.py $BOOTFILE
     fi
 }
 
 cleanup_post_commit_hooks () {
     # Remove links from the post-commit hooks directory.
     # note that this approach only supports hooks that are "configured",
     # i.e., it does not support hooks that need to always be present.
     cpostdir=$(cli-shell-api getPostCommitHookDir)
     # exclude commits hooks from vyatta-cfg
     excluded="10vyatta-log-commit.pl 99vyos-user-postcommit-hooks"
     if [ -d "$cpostdir" ]; then
 	    for f in $cpostdir/*; do
 	        if [[ ! $excluded =~ $(basename $f) ]]; then
 		        rm -f $cpostdir/$(basename $f)
 	        fi
 	    done
     fi
 }
 
 # These are all the default security setting which are later
 # overridden when configuration is read. These are the values the
 # system defaults.
 security_reset ()
 {
 
     # restore NSS cofniguration back to sane system defaults
     # will be overwritten later when configuration is loaded
     cat <<EOF >/etc/nsswitch.conf
 passwd:         files
 group:          files
 shadow:         files
 gshadow:        files
 
 # Per T2678, commenting out myhostname
 hosts:          files dns #myhostname
 networks:       files
 
 protocols:      db files
 services:       db files
 ethers:         db files
 rpc:            db files
 
 netgroup:       nis
 EOF
 
     # restore PAM back to virgin state (no radius/tacacs services)
     pam-auth-update --disable radius-mandatory radius-optional
     rm -f /etc/pam_radius_auth.conf
     pam-auth-update --disable tacplus-mandatory tacplus-optional
     rm -f /etc/tacplus_nss.conf /etc/tacplus_servers
     # and no Google authenticator for 2FA/MFA
     pam-auth-update --disable mfa-google-authenticator
 
     # Certain configuration files are re-generated by the configuration
     # subsystem and must reside under /etc and can not easily be moved to /run.
     # So on every boot we simply delete any remaining files and let the CLI
     # regenearte them.
 
     # PPPoE
     rm -f /etc/ppp/peers/pppoe* /etc/ppp/peers/wlm*
 
     # IPSec
     rm -rf /etc/ipsec.conf /etc/ipsec.secrets
     find /etc/swanctl -type f | xargs rm -f
 
     # limit cleanup
     rm -f /etc/security/limits.d/10-vyos.conf
 
     # iproute2 cleanup
     rm -f /etc/iproute2/rt_tables.d/vyos-*.conf
 
     # Container
     rm -f /etc/containers/storage.conf /etc/containers/registries.conf /etc/containers/containers.conf
     # Clean all networks and re-create them from our CLI
     rm -f /etc/containers/networks/*
 
     # System Options (SSH/cURL)
     rm -f /etc/ssh/ssh_config.d/*vyos*.conf
     rm -f /etc/curlrc
 }
 
 # XXX: T3885 - generate persistend DHCPv6 DUID (Type4 - UUID based)
 gen_duid ()
 {
     DUID_FILE="/var/lib/dhcpv6/dhcp6c_duid"
     UUID_FILE="/sys/class/dmi/id/product_uuid"
     UUID_FILE_ALT="/sys/class/dmi/id/product_serial"
     if [ ! -f ${UUID_FILE} ] && [ ! -f ${UUID_FILE_ALT} ]; then
         return 1
     fi
 
     # DUID is based on the BIOS/EFI UUID. We omit additional - characters
     if [ -f ${UUID_FILE} ]; then
         UUID=$(cat ${UUID_FILE} | tr -d -)
     fi
     if [ -z ${UUID} ]; then
         UUID=$(uuidgen --sha1 --namespace @dns --name $(cat ${UUID_FILE_ALT}) | tr -d -)
     fi
     # Add DUID type4 (UUID) information
     DUID_TYPE="0004"
 
     # The length-information (as per RFC6355 UUID is 128 bits long) is in big-endian
     # format - beware when porting to ARM64. The length field consists out of the
     # UUID (128 bit + 16 bits DUID type) resulting in hex 12.
     DUID_LEN="0012"
     if [ "$(echo -n I | od -to2 | head -n1 | cut -f2 -d" " | cut -c6 )" -eq 1 ]; then
         # true on little-endian (x86) systems
         DUID_LEN="1200"
     fi
 
     for i in $(echo -n ${DUID_LEN}${DUID_TYPE}${UUID} | sed 's/../& /g'); do
         echo -ne "\x$i"
     done > ${DUID_FILE}
 }
 
 start ()
 {
     # reset and clean config files
     security_reset || log_failure_msg "security reset failed"
 
     # some legacy directories migrated over from old rl-system.init
     mkdir -p /var/run/vyatta /var/log/vyatta
     chgrp vyattacfg /var/run/vyatta /var/log/vyatta
     chmod 775 /var/run/vyatta /var/log/vyatta
 
     log_daemon_msg "Waiting for NICs to settle down"
     # On boot time udev migth take a long time to reorder nic's, this will ensure that
     # all udev activity is completed and all nics presented at boot-time will have their
     # final name before continuing with vyos-router initialization.
     SECONDS=0
     udevadm settle
     STATUS=$?
     log_progress_msg "settled in ${SECONDS}sec."
     log_end_msg ${STATUS}
 
     # mountpoint for bpf maps required by xdp
     mount -t bpf none /sys/fs/bpf
 
     # Clear out Debian APT source config file
     empty /etc/apt/sources.list
 
     # Generate DHCPv6 DUID
     gen_duid || log_failure_msg "could not generate DUID"
 
     # Mount a temporary filesystem for container networks.
     # Configuration should be loaded from VyOS cli.
     cni_dir="/etc/cni/net.d"
     [ ! -d ${cni_dir} ] && mkdir -p ${cni_dir}
     mount -t tmpfs none ${cni_dir}
 
     # Init firewall
     nfct helper add rpc inet tcp
     nfct helper add rpc inet udp
     nfct helper add tns inet tcp
     nfct helper add rpc inet6 tcp
     nfct helper add rpc inet6 udp
     nfct helper add tns inet6 tcp
     nft -f /usr/share/vyos/vyos-firewall-init.conf || log_failure_msg "could not initiate firewall rules"
 
     # As VyOS does not execute commands that are not present in the CLI we call
     # the script by hand to have a single source for the login banner and MOTD
     ${vyos_conf_scripts_dir}/system_console.py || log_failure_msg "could not reset serial console"
-    ${vyos_conf_scripts_dir}/system-login-banner.py || log_failure_msg "could not reset motd and issue files"
-    ${vyos_conf_scripts_dir}/system-option.py || log_failure_msg "could not reset system option files"
-    ${vyos_conf_scripts_dir}/system-ip.py || log_failure_msg "could not reset system IPv4 options"
-    ${vyos_conf_scripts_dir}/system-ipv6.py || log_failure_msg "could not reset system IPv6 options"
-    ${vyos_conf_scripts_dir}/conntrack.py || log_failure_msg "could not reset conntrack subsystem"
+    ${vyos_conf_scripts_dir}/system_login_banner.py || log_failure_msg "could not reset motd and issue files"
+    ${vyos_conf_scripts_dir}/system_option.py || log_failure_msg "could not reset system option files"
+    ${vyos_conf_scripts_dir}/system_ip.py || log_failure_msg "could not reset system IPv4 options"
+    ${vyos_conf_scripts_dir}/system_ipv6.py || log_failure_msg "could not reset system IPv6 options"
+    ${vyos_conf_scripts_dir}/system_conntrack.py || log_failure_msg "could not reset conntrack subsystem"
     ${vyos_conf_scripts_dir}/container.py || log_failure_msg "could not reset container subsystem"
 
     clear_or_override_config_files || log_failure_msg "could not reset config files"
 
     # enable some debugging before loading the configuration
     if grep -q vyos-debug /proc/cmdline; then
         log_action_begin_msg "Enable runtime debugging options"
         touch /tmp/vyos.container.debug
         touch /tmp/vyos.ifconfig.debug
         touch /tmp/vyos.frr.debug
         touch /tmp/vyos.container.debug
     fi
 
     log_action_begin_msg "Mounting VyOS Config"
     # ensure the vyatta_configdir supports a large number of inodes since
     # the config hierarchy is often inode-bound (instead of size).
     # impose a minimum and then scale up dynamically with the actual size
     # of the system memory.
     local tmem=$(sed -n 's/^MemTotal: \+\([0-9]\+\) kB$/\1/p' /proc/meminfo)
     local tpages
     local tmpfs_opts="nosuid,nodev,mode=775,nr_inodes=0" #automatically allocate inodes
     mount -o $tmpfs_opts -t tmpfs none ${vyatta_configdir} \
       && chgrp ${GROUP} ${vyatta_configdir}
     log_action_end_msg $?
 
     # T5239: early read of system hostname as this value is read-only once during
     # FRR initialisation
     tmp=$(${vyos_libexec_dir}/read-saved-value.py --path "system host-name")
     hostnamectl set-hostname --static "$tmp"
 
     ${vyos_conf_scripts_dir}/system_frr.py || log_failure_msg "could not reset FRR config"
     # If for any reason FRR was not started by system_frr.py - start it anyways.
     # This is a safety net!
     systemctl start frr.service
 
     disabled bootfile || init_bootfile
 
     cleanup_post_commit_hooks
 
     log_daemon_msg "Starting VyOS router"
     disabled migrate || migrate_bootfile
 
     restore_if_missing_preconfig_script
 
     run_preconfig_script
 
     run_postupgrade_script
 
     update_interface_config
 
     for s in ${subinit[@]} ; do
     if ! disabled $s; then
         log_progress_msg $s
         if ! ${vyatta_sbindir}/${s}.init start
         then log_failure_msg
          exit 1
         fi
     fi
     done
 
     bind_mount_boot
 
     disabled configure || load_bootfile
     log_end_msg $?
 
     telinit q
     chmod g-w,o-w /
 
     restore_if_missing_postconfig_script
 
     run_postconfig_scripts
 }
 
 stop()
 {
     local -i status=0
     log_daemon_msg "Stopping VyOS router"
     for ((i=${#sub_inits[@]} - 1; i >= 0; i--)) ; do
     s=${subinit[$i]}
     log_progress_msg $s
     ${vyatta_sbindir}/${s}.init stop
     let status\|=$?
     done
     log_end_msg $status
     log_action_begin_msg "Un-mounting VyOS Config"
     umount ${vyatta_configdir}
     log_action_end_msg $?
 
     systemctl stop frr.service
 }
 
 case "$action" in
     start) start ;;
     stop)  stop ;;
     restart|force-reload) stop && start ;;
     *)  log_failure_msg "usage: $progname [ start|stop|restart ] [ subinit ... ]" ;
     false ;;
 esac
 
 exit $?
 
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 4
 # End:
diff --git a/src/migration-scripts/https/1-to-2 b/src/migration-scripts/https/1-to-2
index b1cf37ea6..1a2cdc1e7 100755
--- a/src/migration-scripts/https/1-to-2
+++ b/src/migration-scripts/https/1-to-2
@@ -1,54 +1,54 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2020 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 # * Move 'api virtual-host' list to 'api-restrict virtual-host' so it
-#   is owned by https.py instead of http-api.py
+#   is owned by service_https.py
 
 import sys
 
 from vyos.configtree import ConfigTree
 
 if (len(sys.argv) < 2):
     print("Must specify file name!")
     sys.exit(1)
 
 file_name = sys.argv[1]
 
 with open(file_name, 'r') as f:
     config_file = f.read()
 
 config = ConfigTree(config_file)
 
 old_base = ['service', 'https', 'api', 'virtual-host']
 if not config.exists(old_base):
     # Nothing to do
     sys.exit(0)
 else:
     new_base = ['service', 'https', 'api-restrict', 'virtual-host']
     config.set(new_base)
 
     names = config.return_values(old_base)
     for name in names:
         config.set(new_base, value=name, replace=False)
 
     config.delete(old_base)
 
     try:
         with open(file_name, 'w') as f:
             f.write(config.to_string())
     except OSError as e:
         print("Failed to save the modified config: {}".format(e))
         sys.exit(1)
diff --git a/src/op_mode/connect_disconnect.py b/src/op_mode/connect_disconnect.py
index 89f929be7..10034e499 100755
--- a/src/op_mode/connect_disconnect.py
+++ b/src/op_mode/connect_disconnect.py
@@ -1,103 +1,103 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2020-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 import argparse
 
 from psutil import process_iter
 
 from vyos.utils.process import call
 from vyos.utils.commit import commit_in_progress
 from vyos.utils.network import is_wwan_connected
 from vyos.utils.process import DEVNULL
 
 def check_ppp_interface(interface):
     if not os.path.isfile(f'/etc/ppp/peers/{interface}'):
         print(f'Interface {interface} does not exist!')
         exit(1)
 
 def check_ppp_running(interface):
     """ Check if PPP process is running in the interface in question """
     for p in process_iter():
         if "pppd" in p.name():
             if interface in p.cmdline():
                 return True
 
     return False
 
 def connect(interface):
     """ Connect dialer interface """
 
     if interface.startswith('pppoe') or interface.startswith('sstpc'):
         check_ppp_interface(interface)
         # Check if interface is already dialed
         if os.path.isdir(f'/sys/class/net/{interface}'):
             print(f'Interface {interface}: already connected!')
         elif check_ppp_running(interface):
             print(f'Interface {interface}: connection is beeing established!')
         else:
             print(f'Interface {interface}: connecting...')
             call(f'systemctl restart ppp@{interface}.service')
     elif interface.startswith('wwan'):
         if is_wwan_connected(interface):
             print(f'Interface {interface}: already connected!')
         else:
-            call(f'VYOS_TAGNODE_VALUE={interface} /usr/libexec/vyos/conf_mode/interfaces-wwan.py')
+            call(f'VYOS_TAGNODE_VALUE={interface} /usr/libexec/vyos/conf_mode/interfaces_wwan.py')
     else:
         print(f'Unknown interface {interface}, can not connect. Aborting!')
 
 def disconnect(interface):
     """ Disconnect dialer interface """
 
     if interface.startswith('pppoe') or interface.startswith('sstpc'):
         check_ppp_interface(interface)
 
         # Check if interface is already down
         if not check_ppp_running(interface):
             print(f'Interface {interface}: connection is already down')
         else:
             print(f'Interface {interface}: disconnecting...')
             call(f'systemctl stop ppp@{interface}.service')
     elif interface.startswith('wwan'):
         if not is_wwan_connected(interface):
             print(f'Interface {interface}: connection is already down')
         else:
             modem = interface.lstrip('wwan')
             call(f'mmcli --modem {modem} --simple-disconnect', stdout=DEVNULL)
     else:
         print(f'Unknown interface {interface}, can not disconnect. Aborting!')
 
 def main():
     parser = argparse.ArgumentParser()
     group = parser.add_mutually_exclusive_group()
     group.add_argument("--connect", help="Bring up a connection-oriented network interface", action="store")
     group.add_argument("--disconnect", help="Take down connection-oriented network interface", action="store")
     args = parser.parse_args()
 
     if args.connect:
         if commit_in_progress():
             print('Cannot connect while a commit is in progress')
             exit(1)
         connect(args.connect)
     elif args.disconnect:
         disconnect(args.disconnect)
     else:
         parser.print_help()
 
     exit(0)
 
 if __name__ == '__main__':
      main()
diff --git a/src/system/keepalived-fifo.py b/src/system/keepalived-fifo.py
index 5e19bdbad..6d33e372d 100755
--- a/src/system/keepalived-fifo.py
+++ b/src/system/keepalived-fifo.py
@@ -1,196 +1,196 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2020-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 import time
 import signal
 import argparse
 import threading
 import re
 import json
 import logging
 
 from queue import Queue
 from logging.handlers import SysLogHandler
 
 from vyos.ifconfig.vrrp import VRRP
 from vyos.configquery import ConfigTreeQuery
 from vyos.utils.process import cmd
 from vyos.utils.dict import dict_search
 from vyos.utils.commit import commit_in_progress
 
 # configure logging
 logger = logging.getLogger(__name__)
 logs_format = logging.Formatter('%(filename)s: %(message)s')
 logs_handler_syslog = SysLogHandler('/dev/log')
 logs_handler_syslog.setFormatter(logs_format)
 logger.addHandler(logs_handler_syslog)
 logger.setLevel(logging.DEBUG)
 
 mdns_running_file = '/run/mdns_vrrp_active'
-mdns_update_command = 'sudo /usr/libexec/vyos/conf_mode/service_mdns-repeater.py'
+mdns_update_command = 'sudo /usr/libexec/vyos/conf_mode/service_mdns_repeater.py'
 
 # class for all operations
 class KeepalivedFifo:
     # init - read command arguments
     def __init__(self):
         logger.info('Starting FIFO pipe for Keepalived')
         # define program arguments
         cmd_args_parser = argparse.ArgumentParser(description='Create FIFO pipe for keepalived and process notify events', add_help=False)
         cmd_args_parser.add_argument('PIPE', help='path to the FIFO pipe')
         # parse arguments
         cmd_args = cmd_args_parser.parse_args()
 
         self._config_load()
         self.pipe_path = cmd_args.PIPE
 
         # create queue for messages and events for syncronization
         self.message_queue = Queue(maxsize=100)
         self.stopme = threading.Event()
         self.message_event = threading.Event()
 
     # load configuration
     def _config_load(self):
         # For VRRP configuration to be read, the commit must be finished
         count = 1
         while commit_in_progress():
             if ( count <= 20 ):
                 logger.debug(f'Attempt to load keepalived configuration aborted due to a commit in progress (attempt {count}/20)')
             else:
                 logger.error(f'Forced keepalived configuration loading despite a commit in progress ({count} wait time expired, not waiting further)')
                 break
             count += 1
             time.sleep(1)
 
         try:
             base = ['high-availability', 'vrrp']
             conf = ConfigTreeQuery()
             if not conf.exists(base):
                 raise ValueError()
 
             # Read VRRP configuration directly from CLI
             self.vrrp_config_dict = conf.get_config_dict(base,
                                      key_mangling=('-', '_'), get_first_key=True,
                                      no_tag_node_value_mangle=True)
 
             logger.debug(f'Loaded configuration: {self.vrrp_config_dict}')
         except Exception as err:
             logger.error(f'Unable to load configuration: {err}')
 
     # run command
     def _run_command(self, command):
         logger.debug(f'Running the command: {command}')
         try:
             cmd(command)
         except OSError as err:
             logger.error(f'Unable to execute command "{command}": {err}')
 
     # create FIFO pipe
     def pipe_create(self):
         if os.path.exists(self.pipe_path):
             logger.info(f'PIPE already exist: {self.pipe_path}')
         else:
             os.mkfifo(self.pipe_path)
 
     # process message from pipe
     def pipe_process(self):
         logger.debug('Message processing start')
         regex_notify = re.compile(r'^(?P<type>\w+) "(?P<name>[\w-]+)" (?P<state>\w+) (?P<priority>\d+)$', re.MULTILINE)
         while self.stopme.is_set() is False:
             # wait for a new message event from pipe_wait
             self.message_event.wait()
             try:
                 # clear mesage event flag
                 self.message_event.clear()
                 # get all messages from queue and try to process them
                 while self.message_queue.empty() is not True:
                     message = self.message_queue.get()
                     logger.debug(f'Received message: {message}')
                     notify_message = regex_notify.search(message)
                     # try to process a message if it looks valid
                     if notify_message:
                         n_type = notify_message.group('type')
                         n_name = notify_message.group('name')
                         n_state = notify_message.group('state')
                         logger.info(f'{n_type} {n_name} changed state to {n_state}')
                         # check and run commands for VRRP instances
                         if n_type == 'INSTANCE':
                             if os.path.exists(mdns_running_file):
                                 cmd(mdns_update_command)
 
                             tmp = dict_search(f'group.{n_name}.transition_script.{n_state.lower()}', self.vrrp_config_dict)
                             if tmp != None:
                                 self._run_command(tmp)
                         # check and run commands for VRRP sync groups
                         elif n_type == 'GROUP':
                             if os.path.exists(mdns_running_file):
                                 cmd(mdns_update_command)
 
                             tmp = dict_search(f'sync_group.{n_name}.transition_script.{n_state.lower()}', self.vrrp_config_dict)
                             if tmp != None:
                                 self._run_command(tmp)
                     # mark task in queue as done
                     self.message_queue.task_done()
             except Exception as err:
                 logger.error(f'Error processing message: {err}')
         logger.debug('Terminating messages processing thread')
 
     # wait for messages
     def pipe_wait(self):
         logger.debug('Message reading start')
         self.pipe_read = os.open(self.pipe_path, os.O_RDONLY | os.O_NONBLOCK)
         while self.stopme.is_set() is False:
             # sleep a bit to not produce 100% CPU load
             time.sleep(0.250)
             try:
                 # try to read a message from PIPE
                 message = os.read(self.pipe_read, 500)
                 if message:
                     # split PIPE content by lines and put them into queue
                     for line in message.decode().strip().splitlines():
                         self.message_queue.put(line)
                     # set new message flag to start processing
                     self.message_event.set()
             except Exception as err:
                 # ignore the "Resource temporarily unavailable" error
                 if err.errno != 11:
                     logger.error(f'Error receiving message: {err}')
 
         logger.debug('Closing FIFO pipe')
         os.close(self.pipe_read)
 
 # handle SIGTERM signal to allow finish all messages processing
 def sigterm_handle(signum, frame):
     logger.info('Ending processing: Received SIGTERM signal')
     fifo.stopme.set()
     thread_wait_message.join()
     fifo.message_event.set()
     thread_process_message.join()
 
 signal.signal(signal.SIGTERM, sigterm_handle)
 
 # init our class
 fifo = KeepalivedFifo()
 # try to create PIPE if it is not exist yet
 # It looks like keepalived do it before the script will be running, but if we
 # will decide to run this not from keepalived config, then we may get in
 # trouble. So it is betteer to leave this here.
 fifo.pipe_create()
 # create and run dedicated threads for reading and processing messages
 thread_wait_message = threading.Thread(target=fifo.pipe_wait)
 thread_process_message = threading.Thread(target=fifo.pipe_process)
 thread_wait_message.start()
 thread_process_message.start()
diff --git a/src/tests/test_task_scheduler.py b/src/tests/test_task_scheduler.py
index f15fcde88..130f825e6 100644
--- a/src/tests/test_task_scheduler.py
+++ b/src/tests/test_task_scheduler.py
@@ -1,129 +1,129 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 import tempfile
 import unittest
+import importlib
 
 from vyos import ConfigError
 
 try:
-    from src.conf_mode import task_scheduler
+    task_scheduler = importlib.import_module("src.conf_mode.system_task-scheduler")
 except ModuleNotFoundError:  # for unittest.main()
     import sys
     sys.path.append(os.path.join(os.path.dirname(__file__), '../..'))
-    from src.conf_mode import task_scheduler
-
+    task_scheduler = importlib.import_module("src.conf_mode.system_task-scheduler")
 
 class TestUpdateCrontab(unittest.TestCase):
 
     def test_verify(self):
         tests = [
             {'name': 'one_task',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': None
              },
             {'name': 'has_interval_and_spec',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '0 * * * *', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'has_no_interval_and_spec',
              'tasks': [{'name': 'aaa', 'interval': '', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'invalid_interval',
              'tasks': [{'name': 'aaa', 'interval': '1y', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'invalid_interval_min',
              'tasks': [{'name': 'aaa', 'interval': '61m', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'invalid_interval_hour',
              'tasks': [{'name': 'aaa', 'interval': '25h', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'invalid_interval_day',
              'tasks': [{'name': 'aaa', 'interval': '32d', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': ConfigError
              },
             {'name': 'no_executable',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '', 'executable': '', 'args': ''}],
              'expected': ConfigError
              },
             {'name': 'invalid_executable',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '', 'executable': '/bin/aaa', 'args': ''}],
              'expected': ConfigError
              }
         ]
         for t in tests:
             with self.subTest(msg=t['name'], tasks=t['tasks'], expected=t['expected']):
                 if t['expected'] is not None:
                     with self.assertRaises(t['expected']):
                         task_scheduler.verify(t['tasks'])
                 else:
                     task_scheduler.verify(t['tasks'])
 
     def test_generate(self):
         tests = [
             {'name': 'zero_task',
              'tasks': [],
              'expected': []
              },
             {'name': 'one_task',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': [
                  '### Generated by vyos-update-crontab.py ###',
                  '*/60 * * * * root sg vyattacfg \"/bin/ls -l\"']
              },
             {'name': 'one_task_with_hour',
              'tasks': [{'name': 'aaa', 'interval': '10h', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': [
                  '### Generated by vyos-update-crontab.py ###',
                  '0 */10 * * * root sg vyattacfg \"/bin/ls -l\"']
              },
             {'name': 'one_task_with_day',
              'tasks': [{'name': 'aaa', 'interval': '10d', 'spec': '', 'executable': '/bin/ls', 'args': '-l'}],
              'expected': [
                  '### Generated by vyos-update-crontab.py ###',
                  '0 0 */10 * * root sg vyattacfg \"/bin/ls -l\"']
              },
             {'name': 'multiple_tasks',
              'tasks': [{'name': 'aaa', 'interval': '60m', 'spec': '', 'executable': '/bin/ls', 'args': '-l'},
                        {'name': 'bbb', 'interval': '', 'spec': '0 0 * * *', 'executable': '/bin/ls', 'args': '-ltr'}
                        ],
              'expected': [
                  '### Generated by vyos-update-crontab.py ###',
                  '*/60 * * * * root sg vyattacfg \"/bin/ls -l\"',
                  '0 0 * * * root sg vyattacfg \"/bin/ls -ltr\"']
              }
         ]
         for t in tests:
             with self.subTest(msg=t['name'], tasks=t['tasks'], expected=t['expected']):
                 task_scheduler.crontab_file = tempfile.mkstemp()[1]
                 task_scheduler.generate(t['tasks'])
                 if len(t['expected']) > 0:
                     self.assertTrue(os.path.isfile(task_scheduler.crontab_file))
                     with open(task_scheduler.crontab_file) as f:
                         actual = f.read()
                         self.assertEqual(t['expected'], actual.splitlines())
                     os.remove(task_scheduler.crontab_file)
                 else:
                     self.assertFalse(os.path.isfile(task_scheduler.crontab_file))
 
 
 if __name__ == "__main__":
     unittest.main()