Firewall Rules List

{
  "type": "object",
  "description": "The inbound and outbound access rules to apply to the Firewall.\n\nA Firewall may have up to 25 rules across its inbound and outbound rulesets.\n",
  "properties": {
    "inbound": {
      "type": "array",
      "description": "The inbound rules for the firewall, as a JSON array.\n",
      "items": {
        "type": "object",
        "description": "One of a Firewall's inbound or outbound access rules. The `ports` property can be used to allow traffic on a comma-separated list of different ports.\n",
        "properties": {
          "action": {
            "type": "string",
            "description": "Controls whether traffic is accepted or dropped by this rule. Overrides the Firewall's `inbound_policy` if this is an inbound rule, or the `outbound_policy` if this is an outbound rule.\n",
            "enum": [
              "ACCEPT",
              "DROP"
            ]
          },
          "addresses": {
            "type": "object",
            "description": "Allowed IPv4 or IPv6 addresses. A Rule can have up to 255 addresses or networks listed across its IPv4 and IPv6 arrays. A network and a single IP are treated as equivalent when accounting for this limit.\n",
            "properties": {
              "ipv4": {
                "type": "array",
                "description": "A list of IPv4 addresses or networks. Must be in IP/mask format.",
                "items": {
                  "type": "string"
                }
              },
              "ipv6": {
                "type": "array",
                "description": "A list of IPv6 addresses or networks. Must be in IP/mask format.",
                "items": {
                  "type": "string"
                }
              }
            }
          },
          "description": {
            "type": "string",
            "description": "Used to describe this rule. For display purposes only.\n"
          },
          "label": {
            "type": "string",
            "description": "Used to identify this rule. For display purposes only.\n"
          },
          "ports": {
            "type": "string",
            "description": "A string representing the port or ports on which traffic will be allowed:\n\n- The string may be a single port, a range of ports, or a comma-separated list of single ports and port ranges. A space is permitted following each comma.\n- A range of ports is inclusive of the start and end values for the range. The end value of the range must be greater than the start value.\n- Ports must be within 1 and 65535, and may not contain any leading zeroes. For example, port \"080\" is not allowed.\n- Ports may not be specified if a rule's protocol is `ICMP` or `IPENCAP`.\n- At least one port must be specified if a rule's protocol is `TCP` or `UDP`.\n- The ports string can have up to 15 *pieces*, where a single port is treated as one piece, and a port range is treated as two pieces. For example, the string \"22-24, 80, 443\" has four pieces.\n"
          },
          "protocol": {
            "type": "string",
            "description": "The type of network traffic to allow.\n",
            "enum": [
              "TCP",
              "UDP",
              "ICMP",
              "IPENCAP"
            ]
          }
        }
      }
    },
    "inbound_policy": {
      "type": "string",
      "description": "The default behavior for inbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `inbound.action` property of the Firewall Rule.\n",
      "enum": [
        "ACCEPT",
        "DROP"
      ]
    },
    "outbound": {
      "type": "array",
      "description": "The outbound rules for the firewall, as a JSON array.\n",
      "items": {
        "type": "object",
        "description": "One of a Firewall's inbound or outbound access rules. The `ports` property can be used to allow traffic on a comma-separated list of different ports.\n",
        "properties": {
          "action": {
            "type": "string",
            "description": "Controls whether traffic is accepted or dropped by this rule. Overrides the Firewall's `inbound_policy` if this is an inbound rule, or the `outbound_policy` if this is an outbound rule.\n",
            "enum": [
              "ACCEPT",
              "DROP"
            ]
          },
          "addresses": {
            "type": "object",
            "description": "Allowed IPv4 or IPv6 addresses. A Rule can have up to 255 addresses or networks listed across its IPv4 and IPv6 arrays. A network and a single IP are treated as equivalent when accounting for this limit.\n",
            "properties": {
              "ipv4": {
                "type": "array",
                "description": "A list of IPv4 addresses or networks. Must be in IP/mask format.",
                "items": {
                  "type": "string"
                }
              },
              "ipv6": {
                "type": "array",
                "description": "A list of IPv6 addresses or networks. Must be in IP/mask format.",
                "items": {
                  "type": "string"
                }
              }
            }
          },
          "description": {
            "type": "string",
            "description": "Used to describe this rule. For display purposes only.\n"
          },
          "label": {
            "type": "string",
            "description": "Used to identify this rule. For display purposes only.\n"
          },
          "ports": {
            "type": "string",
            "description": "A string representing the port or ports on which traffic will be allowed:\n\n- The string may be a single port, a range of ports, or a comma-separated list of single ports and port ranges. A space is permitted following each comma.\n- A range of ports is inclusive of the start and end values for the range. The end value of the range must be greater than the start value.\n- Ports must be within 1 and 65535, and may not contain any leading zeroes. For example, port \"080\" is not allowed.\n- Ports may not be specified if a rule's protocol is `ICMP` or `IPENCAP`.\n- At least one port must be specified if a rule's protocol is `TCP` or `UDP`.\n- The ports string can have up to 15 *pieces*, where a single port is treated as one piece, and a port range is treated as two pieces. For example, the string \"22-24, 80, 443\" has four pieces.\n"
          },
          "protocol": {
            "type": "string",
            "description": "The type of network traffic to allow.\n",
            "enum": [
              "TCP",
              "UDP",
              "ICMP",
              "IPENCAP"
            ]
          }
        }
      }
    },
    "outbound_policy": {
      "type": "string",
      "description": "The default behavior for outbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `outbound.action` property of the Firewall Rule.\n",
      "enum": [
        "ACCEPT",
        "DROP"
      ]
    }
  }
}