Firewall View

{
  "type": "object",
  "description": "A resource that controls incoming and outgoing network traffic to a Linode service. Only one Firewall can be attached to a Linode at any given time. [Create a Firewall Device](/docs/api/networking/#firewall-create) to assign a Firewall to a Linode service. Currently, Firewalls can only be assigned to Linode instances.\n",
  "properties": {
    "created": {
      "type": "string",
      "format": "date-time",
      "description": "When this Firewall was created.\n"
    },
    "id": {
      "type": "integer",
      "description": "The Firewall's unique ID.\n"
    },
    "label": {
      "type": "string",
      "description": "The Firewall's label, for display purposes only.\n\nFirewall labels have the following constraints:\n\n  * Must begin and end with an alphanumeric character.\n  * May only consist of alphanumeric characters, dashes (`-`), underscores (`_`) or periods (`.`).\n  * Cannot have two dashes (`--`), underscores (`__`) or periods (`..`) in a row.\n  * Must be between 3 and 32 characters.\n  * Must be unique.\n"
    },
    "rules": {
      "type": "object",
      "description": "The inbound and outbound access rules to apply to the Firewall.\n\nA Firewall may have up to 25 rules across its inbound and outbound rulesets.\n",
      "properties": {
        "inbound": {
          "type": "array",
          "description": "The inbound rules for the firewall, as a JSON array.\n",
          "items": {
            "type": "object",
            "description": "One of a Firewall's inbound or outbound access rules. The `ports` property can be used to allow traffic on a comma-separated list of different ports.\n",
            "properties": {
              "action": {
                "type": "string",
                "description": "Controls whether traffic is accepted or dropped by this rule. Overrides the Firewall's `inbound_policy` if this is an inbound rule, or the `outbound_policy` if this is an outbound rule.\n",
                "enum": [
                  "ACCEPT",
                  "DROP"
                ]
              },
              "addresses": {
                "type": "object",
                "description": "Allowed IPv4 or IPv6 addresses. A Rule can have up to 255 addresses or networks listed across its IPv4 and IPv6 arrays. A network and a single IP are treated as equivalent when accounting for this limit.\n",
                "properties": {
                  "ipv4": {
                    "type": "array",
                    "description": "A list of IPv4 addresses or networks. Must be in IP/mask format.",
                    "items": {
                      "type": "string"
                    }
                  },
                  "ipv6": {
                    "type": "array",
                    "description": "A list of IPv6 addresses or networks. Must be in IP/mask format.",
                    "items": {
                      "type": "string"
                    }
                  }
                }
              },
              "description": {
                "type": "string",
                "description": "Used to describe this rule. For display purposes only.\n"
              },
              "label": {
                "type": "string",
                "description": "Used to identify this rule. For display purposes only.\n"
              },
              "ports": {
                "type": "string",
                "description": "A string representing the port or ports on which traffic will be allowed:\n\n- The string may be a single port, a range of ports, or a comma-separated list of single ports and port ranges. A space is permitted following each comma.\n- A range of ports is inclusive of the start and end values for the range. The end value of the range must be greater than the start value.\n- Ports must be within 1 and 65535, and may not contain any leading zeroes. For example, port \"080\" is not allowed.\n- Ports may not be specified if a rule's protocol is `ICMP` or `IPENCAP`.\n- At least one port must be specified if a rule's protocol is `TCP` or `UDP`.\n- The ports string can have up to 15 *pieces*, where a single port is treated as one piece, and a port range is treated as two pieces. For example, the string \"22-24, 80, 443\" has four pieces.\n"
              },
              "protocol": {
                "type": "string",
                "description": "The type of network traffic to allow.\n",
                "enum": [
                  "TCP",
                  "UDP",
                  "ICMP",
                  "IPENCAP"
                ]
              }
            }
          }
        },
        "inbound_policy": {
          "type": "string",
          "description": "The default behavior for inbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `inbound.action` property of the Firewall Rule.\n",
          "enum": [
            "ACCEPT",
            "DROP"
          ]
        },
        "outbound": {
          "type": "array",
          "description": "The outbound rules for the firewall, as a JSON array.\n",
          "items": {
            "type": "object",
            "description": "One of a Firewall's inbound or outbound access rules. The `ports` property can be used to allow traffic on a comma-separated list of different ports.\n",
            "properties": {
              "action": {
                "type": "string",
                "description": "Controls whether traffic is accepted or dropped by this rule. Overrides the Firewall's `inbound_policy` if this is an inbound rule, or the `outbound_policy` if this is an outbound rule.\n",
                "enum": [
                  "ACCEPT",
                  "DROP"
                ]
              },
              "addresses": {
                "type": "object",
                "description": "Allowed IPv4 or IPv6 addresses. A Rule can have up to 255 addresses or networks listed across its IPv4 and IPv6 arrays. A network and a single IP are treated as equivalent when accounting for this limit.\n",
                "properties": {
                  "ipv4": {
                    "type": "array",
                    "description": "A list of IPv4 addresses or networks. Must be in IP/mask format.",
                    "items": {
                      "type": "string"
                    }
                  },
                  "ipv6": {
                    "type": "array",
                    "description": "A list of IPv6 addresses or networks. Must be in IP/mask format.",
                    "items": {
                      "type": "string"
                    }
                  }
                }
              },
              "description": {
                "type": "string",
                "description": "Used to describe this rule. For display purposes only.\n"
              },
              "label": {
                "type": "string",
                "description": "Used to identify this rule. For display purposes only.\n"
              },
              "ports": {
                "type": "string",
                "description": "A string representing the port or ports on which traffic will be allowed:\n\n- The string may be a single port, a range of ports, or a comma-separated list of single ports and port ranges. A space is permitted following each comma.\n- A range of ports is inclusive of the start and end values for the range. The end value of the range must be greater than the start value.\n- Ports must be within 1 and 65535, and may not contain any leading zeroes. For example, port \"080\" is not allowed.\n- Ports may not be specified if a rule's protocol is `ICMP` or `IPENCAP`.\n- At least one port must be specified if a rule's protocol is `TCP` or `UDP`.\n- The ports string can have up to 15 *pieces*, where a single port is treated as one piece, and a port range is treated as two pieces. For example, the string \"22-24, 80, 443\" has four pieces.\n"
              },
              "protocol": {
                "type": "string",
                "description": "The type of network traffic to allow.\n",
                "enum": [
                  "TCP",
                  "UDP",
                  "ICMP",
                  "IPENCAP"
                ]
              }
            }
          }
        },
        "outbound_policy": {
          "type": "string",
          "description": "The default behavior for outbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `outbound.action` property of the Firewall Rule.\n",
          "enum": [
            "ACCEPT",
            "DROP"
          ]
        }
      }
    },
    "status": {
      "type": "string",
      "description": "The status of this Firewall.\n\n  * When a Firewall is first created its status is `enabled`.\n  * Use the [Update Firewall](/docs/api/networking/#firewall-update) endpoint to set a Firewall's status to `enabled` or `disabled`.\n  * Use the [Delete Firewall](/docs/api/networking/#firewall-delete) endpoint to delete a Firewall.\n",
      "enum": [
        "enabled",
        "disabled",
        "deleted"
      ]
    },
    "tags": {
      "type": "array",
      "description": "An array of tags applied to this object. Tags are for organizational purposes only.\n",
      "items": {
        "type": "string"
      }
    },
    "updated": {
      "type": "string",
      "format": "date-time",
      "description": "When this Firewall was last updated.\n"
    }
  }
}