cluster / firewall
31 operations.
GET /cluster/firewall
ts
proxmox.cluster.firewall.$get()Directory index.
Returns an array of object.
GET /cluster/firewall/aliases
ts
proxmox.cluster.firewall.aliases.$get()List aliases
Returns an array of object.
POST /cluster/firewall/aliases
ts
proxmox.cluster.firewall.aliases.$post()Create IP or Network Alias.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDR |
comment | string | format pve-fw-comment-spec | |
name | string | yes | Alias name. — ≤ 64 chars |
GET /cluster/firewall/aliases/{name}
ts
proxmox.cluster.firewall.aliases.$(name).$get()Read alias.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
name | string | yes | Alias name. — ≤ 64 chars |
PUT /cluster/firewall/aliases/{name}
ts
proxmox.cluster.firewall.aliases.$(name).$put()Update IP or Network alias.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDR |
comment | string | format pve-fw-comment-spec | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
name | string | yes | Alias name. — ≤ 64 chars |
rename | string | Rename an existing alias. — ≤ 64 chars |
DELETE /cluster/firewall/aliases/{name}
ts
proxmox.cluster.firewall.aliases.$(name).$delete()Remove IP or Network alias.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
name | string | yes | Alias name. — ≤ 64 chars |
GET /cluster/firewall/groups
ts
proxmox.cluster.firewall.groups.$get()List security groups.
Returns an array of object.
POST /cluster/firewall/groups
ts
proxmox.cluster.firewall.groups.$post()Create new security group.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
comment | string | format pve-fw-comment-spec | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
group | string | yes | Security Group name. — ≤ 18 chars |
rename | string | Rename/update an existing security group. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing group. — ≤ 18 chars |
GET /cluster/firewall/groups/{group}
ts
proxmox.cluster.firewall.groups.$(group).$get()List rules.
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
group | string | yes | Security Group name. — ≤ 18 chars |
POST /cluster/firewall/groups/{group}
ts
proxmox.cluster.firewall.groups.$(group).$post()Create new rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | yes | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
group | string | yes | Security Group name. — ≤ 18 chars |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | yes | Rule type. |
DELETE /cluster/firewall/groups/{group}
ts
proxmox.cluster.firewall.groups.$(group).$delete()Delete security group.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
group | string | yes | Security Group name. — ≤ 18 chars |
GET /cluster/firewall/groups/{group}/{pos}
ts
proxmox.cluster.firewall.groups.$(group).$(pos).$get()Get single rule data.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
group | string | yes | Security Group name. — ≤ 18 chars |
pos | number | Update rule at position <pos>. — min 0 |
PUT /cluster/firewall/groups/{group}/{pos}
ts
proxmox.cluster.firewall.groups.$(group).$(pos).$put()Modify rule data.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars | |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
delete | string | A list of settings you want to delete. — format pve-configid-list | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
group | string | yes | Security Group name. — ≤ 18 chars |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
moveto | number | Move rule to new position <moveto>. Other arguments are ignored. — min 0 | |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | Rule type. |
DELETE /cluster/firewall/groups/{group}/{pos}
ts
proxmox.cluster.firewall.groups.$(group).$(pos).$delete()Delete rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
group | string | yes | Security Group name. — ≤ 18 chars |
pos | number | Update rule at position <pos>. — min 0 |
GET /cluster/firewall/ipset
ts
proxmox.cluster.firewall.ipset.$get()List IPSets
Returns an array of object.
POST /cluster/firewall/ipset
ts
proxmox.cluster.firewall.ipset.$post()Create new IPSet
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
comment | string | format pve-fw-comment-spec | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
name | string | yes | IP set name. — ≤ 64 chars |
rename | string | Rename an existing IPSet. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing IPSet. — ≤ 64 chars |
GET /cluster/firewall/ipset/{name}
ts
proxmox.cluster.firewall.ipset.$(name).$get()List IPSet content
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
name | string | yes | IP set name. — ≤ 64 chars |
POST /cluster/firewall/ipset/{name}
ts
proxmox.cluster.firewall.ipset.$(name).$post()Add IP or Network to IPSet.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDRorAlias |
comment | string | format pve-fw-comment-spec | |
name | string | yes | IP set name. — ≤ 64 chars |
nomatch | boolean |
DELETE /cluster/firewall/ipset/{name}
ts
proxmox.cluster.firewall.ipset.$(name).$delete()Delete IPSet
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
force | boolean | Delete all members of the IPSet, if there are any. | |
name | string | yes | IP set name. — ≤ 64 chars |
GET /cluster/firewall/ipset/{name}/{cidr}
ts
proxmox.cluster.firewall.ipset.$(name).$(cidr).$get()Read IP or Network settings from IPSet.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDRorAlias |
name | string | yes | IP set name. — ≤ 64 chars |
PUT /cluster/firewall/ipset/{name}/{cidr}
ts
proxmox.cluster.firewall.ipset.$(name).$(cidr).$put()Update IP or Network settings
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDRorAlias |
comment | string | format pve-fw-comment-spec | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
name | string | yes | IP set name. — ≤ 64 chars |
nomatch | boolean |
DELETE /cluster/firewall/ipset/{name}/{cidr}
ts
proxmox.cluster.firewall.ipset.$(name).$(cidr).$delete()Remove IP or Network from IPSet.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
cidr | string | yes | Network/IP specification in CIDR format. — format IPorCIDRorAlias |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
name | string | yes | IP set name. — ≤ 64 chars |
GET /cluster/firewall/macros
ts
proxmox.cluster.firewall.macros.$get()List available macros
Returns an array of object.
GET /cluster/firewall/options
ts
proxmox.cluster.firewall.options.$get()Get Firewall options.
Returns object.
PUT /cluster/firewall/options
ts
proxmox.cluster.firewall.options.$put()Set Firewall options.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
delete | string | A list of settings you want to delete. — format pve-configid-list | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
ebtables | boolean | Enable ebtables rules cluster wide. — default 1 | |
enable | number | Enable or disable the firewall cluster wide. — min 0, default 0 | |
log_ratelimit | string | Log ratelimiting settings | |
policy_forward | ACCEPT | DROP | Forward policy. | |
policy_in | ACCEPT | REJECT | DROP | Input policy. | |
policy_out | ACCEPT | REJECT | DROP | Output policy. |
GET /cluster/firewall/refs
ts
proxmox.cluster.firewall.refs.$get()Lists possible IPSet/Alias reference which are allowed in source/dest properties.
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
type | alias | ipset | Only list references of specified type. |
GET /cluster/firewall/rules
ts
proxmox.cluster.firewall.rules.$get()List rules.
Returns an array of object.
POST /cluster/firewall/rules
ts
proxmox.cluster.firewall.rules.$post()Create new rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | yes | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | yes | Rule type. |
GET /cluster/firewall/rules/{pos}
ts
proxmox.cluster.firewall.rules.$(pos).$get()Get single rule data.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
pos | number | Update rule at position <pos>. — min 0 |
PUT /cluster/firewall/rules/{pos}
ts
proxmox.cluster.firewall.rules.$(pos).$put()Modify rule data.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars | |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
delete | string | A list of settings you want to delete. — format pve-configid-list | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
moveto | number | Move rule to new position <moveto>. Other arguments are ignored. — min 0 | |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | Rule type. |
DELETE /cluster/firewall/rules/{pos}
ts
proxmox.cluster.firewall.rules.$(pos).$delete()Delete rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
pos | number | Update rule at position <pos>. — min 0 |