routeros 1.83.1, Apr 28 25

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.FirewallMangle

Explore with Pulumi AI

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

# routeros.FirewallMangle (Resource)

This is an alias for backwards compatibility between plugin versions.

Please see documentation for routeros.IpFirewallMangle

Create FirewallMangle Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new FirewallMangle(name: string, args: FirewallMangleArgs, opts?: CustomResourceOptions);

@overload
def FirewallMangle(resource_name: str,
                   args: FirewallMangleArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def FirewallMangle(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   action: Optional[str] = None,
                   chain: Optional[str] = None,
                   ___id_: Optional[float] = None,
                   ___path_: Optional[str] = None,
                   ___skip_: Optional[str] = None,
                   ___unset_: Optional[str] = None,
                   address_list: Optional[str] = None,
                   address_list_timeout: Optional[str] = None,
                   comment: Optional[str] = None,
                   connection_bytes: Optional[str] = None,
                   connection_limit: Optional[str] = None,
                   connection_mark: Optional[str] = None,
                   connection_nat_state: Optional[str] = None,
                   connection_rate: Optional[str] = None,
                   connection_state: Optional[str] = None,
                   connection_type: Optional[str] = None,
                   content: Optional[str] = None,
                   disabled: Optional[bool] = None,
                   dscp: Optional[float] = None,
                   dst_address: Optional[str] = None,
                   dst_address_list: Optional[str] = None,
                   dst_address_type: Optional[str] = None,
                   dst_limit: Optional[str] = None,
                   dst_port: Optional[str] = None,
                   firewall_mangle_id: Optional[str] = None,
                   fragment: Optional[bool] = None,
                   hotspot: Optional[str] = None,
                   icmp_options: Optional[str] = None,
                   in_bridge_port: Optional[str] = None,
                   in_bridge_port_list: Optional[str] = None,
                   in_interface: Optional[str] = None,
                   in_interface_list: Optional[str] = None,
                   ingress_priority: Optional[float] = None,
                   ipsec_policy: Optional[str] = None,
                   ipv4_options: Optional[str] = None,
                   jump_target: Optional[str] = None,
                   layer7_protocol: Optional[str] = None,
                   limit: Optional[str] = None,
                   log: Optional[bool] = None,
                   log_prefix: Optional[str] = None,
                   new_connection_mark: Optional[str] = None,
                   new_dscp: Optional[float] = None,
                   new_mss: Optional[str] = None,
                   new_packet_mark: Optional[str] = None,
                   new_priority: Optional[str] = None,
                   new_routing_mark: Optional[str] = None,
                   new_ttl: Optional[str] = None,
                   nth: Optional[str] = None,
                   out_bridge_port: Optional[str] = None,
                   out_bridge_port_list: Optional[str] = None,
                   out_interface: Optional[str] = None,
                   out_interface_list: Optional[str] = None,
                   packet_mark: Optional[str] = None,
                   packet_size: Optional[str] = None,
                   passthrough: Optional[bool] = None,
                   per_connection_classifier: Optional[str] = None,
                   place_before: Optional[str] = None,
                   port: Optional[str] = None,
                   protocol: Optional[str] = None,
                   psd: Optional[str] = None,
                   random: Optional[float] = None,
                   route_dst: Optional[str] = None,
                   routing_mark: Optional[str] = None,
                   src_address: Optional[str] = None,
                   src_address_list: Optional[str] = None,
                   src_address_type: Optional[str] = None,
                   src_mac_address: Optional[str] = None,
                   src_port: Optional[str] = None,
                   tcp_flags: Optional[str] = None,
                   tcp_mss: Optional[str] = None,
                   time: Optional[str] = None,
                   tls_host: Optional[str] = None,
                   ttl: Optional[str] = None)

func NewFirewallMangle(ctx *Context, name string, args FirewallMangleArgs, opts ...ResourceOption) (*FirewallMangle, error)

public FirewallMangle(string name, FirewallMangleArgs args, CustomResourceOptions? opts = null)

public FirewallMangle(String name, FirewallMangleArgs args)
public FirewallMangle(String name, FirewallMangleArgs args, CustomResourceOptions options)

type: routeros:FirewallMangle
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args FirewallMangleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args FirewallMangleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args FirewallMangleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FirewallMangleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args FirewallMangleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

FirewallMangle Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The FirewallMangle resource accepts the following input properties:

Action string: Action to take if a packet is matched by the rule.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
FirewallMangleId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp double: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RouteDst string: Matches packets with a specific gateway.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
FirewallMangleId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp float64: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RouteDst string: Matches packets with a specific gateway.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

action String: Action to take if a packet is matched by the rule.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
firewallMangleId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Double: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
routeDst String: Matches packets with a specific gateway.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

action string: Action to take if a packet is matched by the rule.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
firewallMangleId string
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string: Sets a new connection-mark value.
newDscp number: Sets a new DSCP value for a packet.
newMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string: Sets a new packet-mark value.
newPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string: Sets a new routing-mark value.
newTtl string: Sets a new TTL for a packet.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
passthrough boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
routeDst string: Matches packets with a specific gateway.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

action str: Action to take if a packet is matched by the rule.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
firewall_mangle_id str
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str: Sets a new connection-mark value.
new_dscp float: Sets a new DSCP value for a packet.
new_mss str: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str: Sets a new packet-mark value.
new_priority str: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str: Sets a new routing-mark value.
new_ttl str: Sets a new TTL for a packet.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
route_dst str: Matches packets with a specific gateway.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

action String: Action to take if a packet is matched by the rule.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
firewallMangleId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Number: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
routeDst String: Matches packets with a specific gateway.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallMangle resource produces the following output properties:

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string: The provider-assigned unique ID for this managed resource.
invalid boolean

dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str: The provider-assigned unique ID for this managed resource.
invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing FirewallMangle Resource

Get an existing FirewallMangle resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallMangleState, opts?: CustomResourceOptions): FirewallMangle

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_nat_state: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_state: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        firewall_mangle_id: Optional[str] = None,
        fragment: Optional[bool] = None,
        hotspot: Optional[str] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ipsec_policy: Optional[str] = None,
        ipv4_options: Optional[str] = None,
        jump_target: Optional[str] = None,
        layer7_protocol: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        new_connection_mark: Optional[str] = None,
        new_dscp: Optional[float] = None,
        new_mss: Optional[str] = None,
        new_packet_mark: Optional[str] = None,
        new_priority: Optional[str] = None,
        new_routing_mark: Optional[str] = None,
        new_ttl: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        passthrough: Optional[bool] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        protocol: Optional[str] = None,
        psd: Optional[str] = None,
        random: Optional[float] = None,
        route_dst: Optional[str] = None,
        routing_mark: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_flags: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        tls_host: Optional[str] = None,
        ttl: Optional[str] = None) -> FirewallMangle

func GetFirewallMangle(ctx *Context, name string, id IDInput, state *FirewallMangleState, opts ...ResourceOption) (*FirewallMangle, error)

public static FirewallMangle Get(string name, Input<string> id, FirewallMangleState? state, CustomResourceOptions? opts = null)

public static FirewallMangle get(String name, Output<String> id, FirewallMangleState state, CustomResourceOptions options)

resources:  _:    type: routeros:FirewallMangle    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: Action to take if a packet is matched by the rule.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
FirewallMangleId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp double: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RouteDst string: Matches packets with a specific gateway.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
FirewallMangleId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp float64: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RouteDst string: Matches packets with a specific gateway.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallMangleId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Double: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
routeDst String: Matches packets with a specific gateway.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string: Action to take if a packet is matched by the rule.
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallMangleId string
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string: Sets a new connection-mark value.
newDscp number: Sets a new DSCP value for a packet.
newMss string: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string: Sets a new packet-mark value.
newPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string: Sets a new routing-mark value.
newTtl string: Sets a new TTL for a packet.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
passthrough boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
routeDst string: Matches packets with a specific gateway.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str: Action to take if a packet is matched by the rule.
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewall_mangle_id str
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str: Sets a new connection-mark value.
new_dscp float: Sets a new DSCP value for a packet.
new_mss str: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str: Sets a new packet-mark value.
new_priority str: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str: Sets a new routing-mark value.
new_ttl str: Sets a new TTL for a packet.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
route_dst str: Matches packets with a specific gateway.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallMangleId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Number: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. * clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. * Host sends all datagrams on that path with the DF bit set until receives ICMP. * Destination Unreachable messages with a code meaning fragmentation needed and DF set. * Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
routeDst String: Matches packets with a specific gateway.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Package Details

Repository: routeros terraform-routeros/terraform-provider-routeros
License
Notes: This Pulumi package is based on the routeros Terraform Provider.

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.FirewallMangle

On this page

On this page

# routeros.FirewallMangle (Resource)

This is an alias for backwards compatibility between plugin versions.

Create FirewallMangle Resource

Constructor syntax

Parameters

FirewallMangle Resource Properties

Inputs

Outputs

Look up Existing FirewallMangle Resource

Package Details

On this page

On this page