routeros 1.83.1, Apr 28 25

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.FirewallNat

Explore with Pulumi AI

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

# routeros.FirewallNat (Resource)

This is an alias for backwards compatibility between plugin versions.

Please see documentation for routeros.IpFirewallNat

Create FirewallNat Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new FirewallNat(name: string, args: FirewallNatArgs, opts?: CustomResourceOptions);

@overload
def FirewallNat(resource_name: str,
                args: FirewallNatArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def FirewallNat(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                action: Optional[str] = None,
                chain: Optional[str] = None,
                ___id_: Optional[float] = None,
                ___path_: Optional[str] = None,
                ___skip_: Optional[str] = None,
                ___unset_: Optional[str] = None,
                address_list: Optional[str] = None,
                address_list_timeout: Optional[str] = None,
                comment: Optional[str] = None,
                connection_bytes: Optional[str] = None,
                connection_limit: Optional[str] = None,
                connection_mark: Optional[str] = None,
                connection_rate: Optional[str] = None,
                connection_type: Optional[str] = None,
                content: Optional[str] = None,
                disabled: Optional[bool] = None,
                dscp: Optional[float] = None,
                dst_address: Optional[str] = None,
                dst_address_list: Optional[str] = None,
                dst_address_type: Optional[str] = None,
                dst_limit: Optional[str] = None,
                dst_port: Optional[str] = None,
                firewall_nat_id: Optional[str] = None,
                fragment: Optional[bool] = None,
                hotspot: Optional[str] = None,
                icmp_options: Optional[str] = None,
                in_bridge_port: Optional[str] = None,
                in_bridge_port_list: Optional[str] = None,
                in_interface: Optional[str] = None,
                in_interface_list: Optional[str] = None,
                ingress_priority: Optional[float] = None,
                ipsec_policy: Optional[str] = None,
                ipv4_options: Optional[str] = None,
                jump_target: Optional[str] = None,
                layer7_protocol: Optional[str] = None,
                limit: Optional[str] = None,
                log: Optional[bool] = None,
                log_prefix: Optional[str] = None,
                nth: Optional[str] = None,
                out_bridge_port: Optional[str] = None,
                out_bridge_port_list: Optional[str] = None,
                out_interface: Optional[str] = None,
                out_interface_list: Optional[str] = None,
                packet_mark: Optional[str] = None,
                packet_size: Optional[str] = None,
                per_connection_classifier: Optional[str] = None,
                place_before: Optional[str] = None,
                port: Optional[str] = None,
                priority: Optional[float] = None,
                protocol: Optional[str] = None,
                psd: Optional[str] = None,
                random: Optional[float] = None,
                randomise_ports: Optional[bool] = None,
                routing_mark: Optional[str] = None,
                same_not_by_dst: Optional[bool] = None,
                src_address: Optional[str] = None,
                src_address_list: Optional[str] = None,
                src_address_type: Optional[str] = None,
                src_mac_address: Optional[str] = None,
                src_port: Optional[str] = None,
                tcp_mss: Optional[str] = None,
                time: Optional[str] = None,
                to_addresses: Optional[str] = None,
                to_ports: Optional[str] = None,
                ttl: Optional[str] = None)

func NewFirewallNat(ctx *Context, name string, args FirewallNatArgs, opts ...ResourceOption) (*FirewallNat, error)

public FirewallNat(string name, FirewallNatArgs args, CustomResourceOptions? opts = null)

public FirewallNat(String name, FirewallNatArgs args)
public FirewallNat(String name, FirewallNatArgs args, CustomResourceOptions options)

type: routeros:FirewallNat
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args FirewallNatArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args FirewallNatArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args FirewallNatArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FirewallNatArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args FirewallNatArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

FirewallNat Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The FirewallNat resource accepts the following input properties:

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
FirewallNatId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RandomisePorts bool: Randomize to which public port connections will be mapped.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SameNotByDst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
ToAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
ToPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
FirewallNatId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RandomisePorts bool: Randomize to which public port connections will be mapped.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SameNotByDst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
ToAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
ToPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
firewallNatId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
randomisePorts Boolean: Randomize to which public port connections will be mapped.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst Boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses String: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts String: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl String: Matches packets TTL value.

action string: Action to take if a packet is matched by the rule
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
firewallNatId string
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
randomisePorts boolean: Randomize to which public port connections will be mapped.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl string: Matches packets TTL value.

action str: Action to take if a packet is matched by the rule
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
firewall_nat_id str
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
randomise_ports bool: Randomize to which public port connections will be mapped.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
same_not_by_dst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
to_addresses str: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
to_ports str: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl str: Matches packets TTL value.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
firewallNatId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
randomisePorts Boolean: Randomize to which public port connections will be mapped.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst Boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses String: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts String: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl String: Matches packets TTL value.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallNat resource produces the following output properties:

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string: The provider-assigned unique ID for this managed resource.
invalid boolean

dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str: The provider-assigned unique ID for this managed resource.
invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing FirewallNat Resource

Get an existing FirewallNat resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallNatState, opts?: CustomResourceOptions): FirewallNat

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        firewall_nat_id: Optional[str] = None,
        fragment: Optional[bool] = None,
        hotspot: Optional[str] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ipsec_policy: Optional[str] = None,
        ipv4_options: Optional[str] = None,
        jump_target: Optional[str] = None,
        layer7_protocol: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        priority: Optional[float] = None,
        protocol: Optional[str] = None,
        psd: Optional[str] = None,
        random: Optional[float] = None,
        randomise_ports: Optional[bool] = None,
        routing_mark: Optional[str] = None,
        same_not_by_dst: Optional[bool] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        to_addresses: Optional[str] = None,
        to_ports: Optional[str] = None,
        ttl: Optional[str] = None) -> FirewallNat

func GetFirewallNat(ctx *Context, name string, id IDInput, state *FirewallNatState, opts ...ResourceOption) (*FirewallNat, error)

public static FirewallNat Get(string name, Input<string> id, FirewallNatState? state, CustomResourceOptions? opts = null)

public static FirewallNat get(String name, Output<String> id, FirewallNatState state, CustomResourceOptions options)

resources:  _:    type: routeros:FirewallNat    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: Action to take if a packet is matched by the rule
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
FirewallNatId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RandomisePorts bool: Randomize to which public port connections will be mapped.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SameNotByDst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
ToAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
ToPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
FirewallNatId string
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RandomisePorts bool: Randomize to which public port connections will be mapped.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SameNotByDst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
ToAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
ToPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallNatId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
randomisePorts Boolean: Randomize to which public port connections will be mapped.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst Boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses String: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts String: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl String: Matches packets TTL value.

___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string: Action to take if a packet is matched by the rule
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallNatId string
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
randomisePorts boolean: Randomize to which public port connections will be mapped.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses string: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts string: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl string: Matches packets TTL value.

___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str: Action to take if a packet is matched by the rule
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewall_nat_id str
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
randomise_ports bool: Randomize to which public port connections will be mapped.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
same_not_by_dst bool: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
to_addresses str: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
to_ports str: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl str: Matches packets TTL value.

___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
firewallNatId String
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
randomisePorts Boolean: Randomize to which public port connections will be mapped.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
sameNotByDst Boolean: Specifies whether to take into account or not destination IP address when selecting a new source IP address. Applicable if action=same
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
toAddresses String: Replace original address with specified one. Applicable if action is dst-nat, netmap, same, src-nat.
toPorts String: Replace the original port with the specified one. Applicable if action is dst-nat, redirect, masquerade, netmap, same, src-nat.
ttl String: Matches packets TTL value.

Package Details

Repository: routeros terraform-routeros/terraform-provider-routeros
License
Notes: This Pulumi package is based on the routeros Terraform Provider.

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.FirewallNat

On this page

On this page

# routeros.FirewallNat (Resource)

This is an alias for backwards compatibility between plugin versions.

Create FirewallNat Resource

Constructor syntax

Parameters

FirewallNat Resource Properties

Inputs

Outputs

Look up Existing FirewallNat Resource

Package Details

On this page

On this page