routeros 1.83.1, Apr 28 25

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.IpFirewallFilter

Explore with Pulumi AI

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const rule = new routeros.IpFirewallFilter("rule", {
    action: "accept",
    chain: "forward",
    dstAddress: "10.0.1.1",
    dstPort: "443",
    protocol: "tcp",
    srcAddress: "10.0.0.1",
});

import pulumi
import pulumi_routeros as routeros

rule = routeros.IpFirewallFilter("rule",
    action="accept",
    chain="forward",
    dst_address="10.0.1.1",
    dst_port="443",
    protocol="tcp",
    src_address="10.0.0.1")

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpFirewallFilter(ctx, "rule", &routeros.IpFirewallFilterArgs{
			Action:     pulumi.String("accept"),
			Chain:      pulumi.String("forward"),
			DstAddress: pulumi.String("10.0.1.1"),
			DstPort:    pulumi.String("443"),
			Protocol:   pulumi.String("tcp"),
			SrcAddress: pulumi.String("10.0.0.1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var rule = new Routeros.IpFirewallFilter("rule", new()
    {
        Action = "accept",
        Chain = "forward",
        DstAddress = "10.0.1.1",
        DstPort = "443",
        Protocol = "tcp",
        SrcAddress = "10.0.0.1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.IpFirewallFilter;
import com.pulumi.routeros.IpFirewallFilterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rule = new IpFirewallFilter("rule", IpFirewallFilterArgs.builder()
            .action("accept")
            .chain("forward")
            .dstAddress("10.0.1.1")
            .dstPort("443")
            .protocol("tcp")
            .srcAddress("10.0.0.1")
            .build());

    }
}

resources:
  rule:
    type: routeros:IpFirewallFilter
    properties:
      action: accept
      chain: forward
      dstAddress: 10.0.1.1
      dstPort: '443'
      protocol: tcp
      srcAddress: 10.0.0.1

Create IpFirewallFilter Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new IpFirewallFilter(name: string, args: IpFirewallFilterArgs, opts?: CustomResourceOptions);

@overload
def IpFirewallFilter(resource_name: str,
                     args: IpFirewallFilterArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def IpFirewallFilter(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     action: Optional[str] = None,
                     chain: Optional[str] = None,
                     ___id_: Optional[float] = None,
                     ___path_: Optional[str] = None,
                     ___skip_: Optional[str] = None,
                     ___unset_: Optional[str] = None,
                     address_list: Optional[str] = None,
                     address_list_timeout: Optional[str] = None,
                     comment: Optional[str] = None,
                     connection_bytes: Optional[str] = None,
                     connection_limit: Optional[str] = None,
                     connection_mark: Optional[str] = None,
                     connection_nat_state: Optional[str] = None,
                     connection_rate: Optional[str] = None,
                     connection_state: Optional[str] = None,
                     connection_type: Optional[str] = None,
                     content: Optional[str] = None,
                     disabled: Optional[bool] = None,
                     dscp: Optional[float] = None,
                     dst_address: Optional[str] = None,
                     dst_address_list: Optional[str] = None,
                     dst_address_type: Optional[str] = None,
                     dst_limit: Optional[str] = None,
                     dst_port: Optional[str] = None,
                     fragment: Optional[bool] = None,
                     hotspot: Optional[str] = None,
                     hw_offload: Optional[bool] = None,
                     icmp_options: Optional[str] = None,
                     in_bridge_port: Optional[str] = None,
                     in_bridge_port_list: Optional[str] = None,
                     in_interface: Optional[str] = None,
                     in_interface_list: Optional[str] = None,
                     ingress_priority: Optional[float] = None,
                     ip_firewall_filter_id: Optional[str] = None,
                     ipsec_policy: Optional[str] = None,
                     ipv4_options: Optional[str] = None,
                     jump_target: Optional[str] = None,
                     layer7_protocol: Optional[str] = None,
                     limit: Optional[str] = None,
                     log: Optional[bool] = None,
                     log_prefix: Optional[str] = None,
                     nth: Optional[str] = None,
                     out_bridge_port: Optional[str] = None,
                     out_bridge_port_list: Optional[str] = None,
                     out_interface: Optional[str] = None,
                     out_interface_list: Optional[str] = None,
                     packet_mark: Optional[str] = None,
                     packet_size: Optional[str] = None,
                     per_connection_classifier: Optional[str] = None,
                     place_before: Optional[str] = None,
                     port: Optional[str] = None,
                     priority: Optional[float] = None,
                     protocol: Optional[str] = None,
                     psd: Optional[str] = None,
                     random: Optional[float] = None,
                     reject_with: Optional[str] = None,
                     routing_mark: Optional[str] = None,
                     routing_table: Optional[str] = None,
                     src_address: Optional[str] = None,
                     src_address_list: Optional[str] = None,
                     src_address_type: Optional[str] = None,
                     src_mac_address: Optional[str] = None,
                     src_port: Optional[str] = None,
                     tcp_flags: Optional[str] = None,
                     tcp_mss: Optional[str] = None,
                     time: Optional[str] = None,
                     tls_host: Optional[str] = None,
                     ttl: Optional[str] = None)

func NewIpFirewallFilter(ctx *Context, name string, args IpFirewallFilterArgs, opts ...ResourceOption) (*IpFirewallFilter, error)

public IpFirewallFilter(string name, IpFirewallFilterArgs args, CustomResourceOptions? opts = null)

public IpFirewallFilter(String name, IpFirewallFilterArgs args)
public IpFirewallFilter(String name, IpFirewallFilterArgs args, CustomResourceOptions options)

type: routeros:IpFirewallFilter
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args IpFirewallFilterArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args IpFirewallFilterArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args IpFirewallFilterArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IpFirewallFilterArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args IpFirewallFilterArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

IpFirewallFilter Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The IpFirewallFilter resource accepts the following input properties:

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
HwOffload bool: Connection offloading for Fasttrack.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpFirewallFilterId string
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
RoutingTable string: Matches packets which destination address is resolved in specific a routing table.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
HwOffload bool: Connection offloading for Fasttrack.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpFirewallFilterId string
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
RoutingTable string: Matches packets which destination address is resolved in specific a routing table.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload Boolean: Connection offloading for Fasttrack.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipFirewallFilterId String
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
routingTable String: Matches packets which destination address is resolved in specific a routing table.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

action string: Action to take if a packet is matched by the rule
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload boolean: Connection offloading for Fasttrack.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipFirewallFilterId string
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
rejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
routingTable string: Matches packets which destination address is resolved in specific a routing table.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

action str: Action to take if a packet is matched by the rule
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list str: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
hw_offload bool: Connection offloading for Fasttrack.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ip_firewall_filter_id str
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
reject_with str: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
routing_table str: Matches packets which destination address is resolved in specific a routing table.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload Boolean: Connection offloading for Fasttrack.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipFirewallFilterId String
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
routingTable String: Matches packets which destination address is resolved in specific a routing table.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Outputs

All input properties are implicitly available as output properties. Additionally, the IpFirewallFilter resource produces the following output properties:

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string: The provider-assigned unique ID for this managed resource.
invalid boolean

dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str: The provider-assigned unique ID for this managed resource.
invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing IpFirewallFilter Resource

Get an existing IpFirewallFilter resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IpFirewallFilterState, opts?: CustomResourceOptions): IpFirewallFilter

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_nat_state: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_state: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        fragment: Optional[bool] = None,
        hotspot: Optional[str] = None,
        hw_offload: Optional[bool] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ip_firewall_filter_id: Optional[str] = None,
        ipsec_policy: Optional[str] = None,
        ipv4_options: Optional[str] = None,
        jump_target: Optional[str] = None,
        layer7_protocol: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        priority: Optional[float] = None,
        protocol: Optional[str] = None,
        psd: Optional[str] = None,
        random: Optional[float] = None,
        reject_with: Optional[str] = None,
        routing_mark: Optional[str] = None,
        routing_table: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_flags: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        tls_host: Optional[str] = None,
        ttl: Optional[str] = None) -> IpFirewallFilter

func GetIpFirewallFilter(ctx *Context, name string, id IDInput, state *IpFirewallFilterState, opts ...ResourceOption) (*IpFirewallFilter, error)

public static IpFirewallFilter Get(string name, Input<string> id, IpFirewallFilterState? state, CustomResourceOptions? opts = null)

public static IpFirewallFilter get(String name, Output<String> id, IpFirewallFilterState state, CustomResourceOptions options)

resources:  _:    type: routeros:IpFirewallFilter    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: Action to take if a packet is matched by the rule
AddressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
HwOffload bool: Connection offloading for Fasttrack.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpFirewallFilterId string
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random double: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
RoutingTable string: Matches packets which destination address is resolved in specific a routing table.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
AddressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
Hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
HwOffload bool: Connection offloading for Fasttrack.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpFirewallFilterId string
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv4Options string: Matches IPv4 header options.
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Layer7Protocol string: Layer7 filter name.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
Random float64: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
RoutingTable string: Matches packets which destination address is resolved in specific a routing table.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressList String: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload Boolean: Connection offloading for Fasttrack.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipFirewallFilterId String
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Double: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
routingTable String: Matches packets which destination address is resolved in specific a routing table.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string: Action to take if a packet is matched by the rule
addressList string: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
fragment boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot string: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload boolean: Connection offloading for Fasttrack.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipFirewallFilterId string
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options string: Matches IPv4 header options.
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol string: Layer7 filter name.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
psd string: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random number: Matches packets randomly with a given probability.
rejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
routingTable string: Matches packets which destination address is resolved in specific a routing table.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str: Action to take if a packet is matched by the rule
address_list str: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
fragment bool: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot str: Matches packets received from HotSpot clients against various HotSpot matchers.
hw_offload bool: Connection offloading for Fasttrack.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ip_firewall_filter_id str
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4_options str: Matches IPv4 header options.
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
layer7_protocol str: Layer7 filter name.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
psd str: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random float: Matches packets randomly with a given probability.
reject_with str: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
routing_table str: Matches packets which destination address is resolved in specific a routing table.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressList String: Name of the address list used in 'add-dst-to-address-list' and 'add-src-to-address-list' actions.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
fragment Boolean: Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot String: Matches packets received from HotSpot clients against various HotSpot matchers.
hwOffload Boolean: Connection offloading for Fasttrack.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipFirewallFilterId String
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv4Options String: Matches IPv4 header options.
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
layer7Protocol String: Layer7 filter name.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
psd String: Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight.
random Number: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
routingTable String: Matches packets which destination address is resolved in specific a routing table.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Import

#The ID can be found via API or the terminal

#The command for the terminal is -> :put [/ip/firewall/filter get [print show-ids]]

$ pulumi import routeros:index/ipFirewallFilter:IpFirewallFilter rule "*0"

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: routeros terraform-routeros/terraform-provider-routeros
License
Notes: This Pulumi package is based on the routeros Terraform Provider.

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.IpFirewallFilter

On this page

On this page

Example Usage

Create IpFirewallFilter Resource

Constructor syntax

Parameters

IpFirewallFilter Resource Properties

Inputs

Outputs

Look up Existing IpFirewallFilter Resource

Import

Package Details

On this page

On this page