nodes / firewall
9 operations.
GET /nodes/{node}/firewall
ts
proxmox.nodes.$(node).firewall.$get()Directory index.
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
node | string | yes | The cluster node name. — format pve-node |
GET /nodes/{node}/firewall/log
ts
proxmox.nodes.$(node).firewall.log.$get()Read firewall log
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
limit | number | min 0 | |
node | string | yes | The cluster node name. — format pve-node |
since | number | Display log since this UNIX epoch. — min 0 | |
start | number | min 0 | |
until | number | Display log until this UNIX epoch. — min 0 |
GET /nodes/{node}/firewall/options
ts
proxmox.nodes.$(node).firewall.options.$get()Get host firewall options.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
node | string | yes | The cluster node name. — format pve-node |
PUT /nodes/{node}/firewall/options
ts
proxmox.nodes.$(node).firewall.options.$put()Set Firewall options.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
delete | string | A list of settings you want to delete. — format pve-configid-list | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
enable | boolean | Enable host firewall rules. — default 1 | |
log_level_forward | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for forwarded traffic. | |
log_level_in | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for incoming traffic. | |
log_level_out | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for outgoing traffic. | |
log_nf_conntrack | boolean | Enable logging of conntrack information. — default 0 | |
ndp | boolean | Enable NDP (Neighbor Discovery Protocol). — default 1 | |
nf_conntrack_allow_invalid | boolean | Allow invalid packets on connection tracking. — default 0 | |
nf_conntrack_helpers | string | Enable conntrack helpers for specific protocols. Supported protocols: amanda, ftp, irc, netbios-ns, pptp, sane, sip, snmp, tftp — format pve-fw-conntrack-helper, default "" | |
nf_conntrack_max | number | Maximum number of tracked connections. — min 32768, default 262144 | |
nf_conntrack_tcp_timeout_established | number | Conntrack established timeout. — min 7875, default 432000 | |
nf_conntrack_tcp_timeout_syn_recv | number | Conntrack syn recv timeout. — min 30, max 60, default 60 | |
nftables | boolean | Enable nftables based firewall (tech preview) — default 0 | |
node | string | yes | The cluster node name. — format pve-node |
nosmurfs | boolean | Enable SMURFS filter. | |
protection_synflood | boolean | Enable synflood protection — default 0 | |
protection_synflood_burst | number | Synflood protection rate burst by ip src. — default 1000 | |
protection_synflood_rate | number | Synflood protection rate syn/sec by ip src. — default 200 | |
smurf_log_level | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for SMURFS filter. | |
tcp_flags_log_level | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for illegal tcp flags filter. | |
tcpflags | boolean | Filter illegal combinations of TCP flags. — default 0 |
GET /nodes/{node}/firewall/rules
ts
proxmox.nodes.$(node).firewall.rules.$get()List rules.
Returns an array of object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
node | string | yes | The cluster node name. — format pve-node |
POST /nodes/{node}/firewall/rules
ts
proxmox.nodes.$(node).firewall.rules.$post()Create new rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | yes | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
node | string | yes | The cluster node name. — format pve-node |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | yes | Rule type. |
GET /nodes/{node}/firewall/rules/{pos}
ts
proxmox.nodes.$(node).firewall.rules.$(pos).$get()Get single rule data.
Returns object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
node | string | yes | The cluster node name. — format pve-node |
pos | number | Update rule at position <pos>. — min 0 |
PUT /nodes/{node}/firewall/rules/{pos}
ts
proxmox.nodes.$(node).firewall.rules.$(pos).$put()Modify rule data.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
action | string | Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name. — ≤ 20 chars | |
comment | string | Descriptive comment. — format pve-fw-comment-spec | |
delete | string | A list of settings you want to delete. — format pve-configid-list | |
dest | string | Restrict packet destination address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
dport | string | Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-dport-spec | |
enable | number | Flag to enable/disable a rule. — min 0 | |
icmp-type | string | Specify icmp-type. Only valid if proto equals 'icmp' or 'icmpv6'/'ipv6-icmp'. — format pve-fw-icmp-type-spec | |
iface | string | Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings. — format pve-iface, ≤ 20 chars | |
log | emerg | alert | crit | err | warning | notice | info | debug | … (1 more) | Log level for firewall rule. | |
macro | string | Use predefined standard macro. — ≤ 128 chars | |
moveto | number | Move rule to new position <moveto>. Other arguments are ignored. — min 0 | |
node | string | yes | The cluster node name. — format pve-node |
pos | number | Update rule at position <pos>. — min 0 | |
proto | string | IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'. — format pve-fw-protocol-spec | |
source | string | Restrict packet source address. This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists. — format pve-fw-addr-spec, ≤ 512 chars | |
sport | string | Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\d+:\d+', for example '80:85', and you can use comma separated list to match several ports or ranges. — format pve-fw-sport-spec | |
type | in | out | forward | group | Rule type. |
DELETE /nodes/{node}/firewall/rules/{pos}
ts
proxmox.nodes.$(node).firewall.rules.$(pos).$delete()Delete rule.
Returns nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
digest | string | Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars | |
node | string | yes | The cluster node name. — format pve-node |
pos | number | Update rule at position <pos>. — min 0 |