routeros 1.89.0, Oct 15 25

routeros 1.89.0 published on Wednesday, Oct 15, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.Ipv6FirewallFilter

routeros 1.89.0 published on Wednesday, Oct 15, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const rule = new routeros.Ipv6FirewallFilter("rule", {
    action: "accept",
    chain: "forward",
    dstAddress: "2001:DB8:2000::1",
    dstPort: "443",
    protocol: "tcp",
    srcAddress: "2001:DB8:1000::1",
});

import pulumi
import pulumi_routeros as routeros

rule = routeros.Ipv6FirewallFilter("rule",
    action="accept",
    chain="forward",
    dst_address="2001:DB8:2000::1",
    dst_port="443",
    protocol="tcp",
    src_address="2001:DB8:1000::1")

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpv6FirewallFilter(ctx, "rule", &routeros.Ipv6FirewallFilterArgs{
			Action:     pulumi.String("accept"),
			Chain:      pulumi.String("forward"),
			DstAddress: pulumi.String("2001:DB8:2000::1"),
			DstPort:    pulumi.String("443"),
			Protocol:   pulumi.String("tcp"),
			SrcAddress: pulumi.String("2001:DB8:1000::1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var rule = new Routeros.Ipv6FirewallFilter("rule", new()
    {
        Action = "accept",
        Chain = "forward",
        DstAddress = "2001:DB8:2000::1",
        DstPort = "443",
        Protocol = "tcp",
        SrcAddress = "2001:DB8:1000::1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.Ipv6FirewallFilter;
import com.pulumi.routeros.Ipv6FirewallFilterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rule = new Ipv6FirewallFilter("rule", Ipv6FirewallFilterArgs.builder()
            .action("accept")
            .chain("forward")
            .dstAddress("2001:DB8:2000::1")
            .dstPort("443")
            .protocol("tcp")
            .srcAddress("2001:DB8:1000::1")
            .build());

    }
}

resources:
  rule:
    type: routeros:Ipv6FirewallFilter
    properties:
      action: accept
      chain: forward
      dstAddress: 2001:DB8:2000::1
      dstPort: '443'
      protocol: tcp
      srcAddress: 2001:DB8:1000::1

Create Ipv6FirewallFilter Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Ipv6FirewallFilter(name: string, args: Ipv6FirewallFilterArgs, opts?: CustomResourceOptions);

@overload
def Ipv6FirewallFilter(resource_name: str,
                       args: Ipv6FirewallFilterArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def Ipv6FirewallFilter(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       action: Optional[str] = None,
                       chain: Optional[str] = None,
                       ___id_: Optional[float] = None,
                       ___path_: Optional[str] = None,
                       ___skip_: Optional[str] = None,
                       ___unset_: Optional[str] = None,
                       address_list_timeout: Optional[str] = None,
                       comment: Optional[str] = None,
                       connection_bytes: Optional[str] = None,
                       connection_limit: Optional[str] = None,
                       connection_mark: Optional[str] = None,
                       connection_rate: Optional[str] = None,
                       connection_state: Optional[str] = None,
                       connection_type: Optional[str] = None,
                       content: Optional[str] = None,
                       disabled: Optional[bool] = None,
                       dscp: Optional[float] = None,
                       dst_address: Optional[str] = None,
                       dst_address_list: Optional[str] = None,
                       dst_address_type: Optional[str] = None,
                       dst_limit: Optional[str] = None,
                       dst_port: Optional[str] = None,
                       headers: Optional[str] = None,
                       hop_limit: Optional[str] = None,
                       icmp_options: Optional[str] = None,
                       in_bridge_port: Optional[str] = None,
                       in_bridge_port_list: Optional[str] = None,
                       in_interface: Optional[str] = None,
                       in_interface_list: Optional[str] = None,
                       ingress_priority: Optional[float] = None,
                       ipsec_policy: Optional[str] = None,
                       ipv6_firewall_filter_id: Optional[str] = None,
                       jump_target: Optional[str] = None,
                       limit: Optional[str] = None,
                       log: Optional[bool] = None,
                       log_prefix: Optional[str] = None,
                       nth: Optional[str] = None,
                       out_bridge_port: Optional[str] = None,
                       out_bridge_port_list: Optional[str] = None,
                       out_interface: Optional[str] = None,
                       out_interface_list: Optional[str] = None,
                       packet_mark: Optional[str] = None,
                       packet_size: Optional[str] = None,
                       per_connection_classifier: Optional[str] = None,
                       place_before: Optional[str] = None,
                       port: Optional[str] = None,
                       priority: Optional[float] = None,
                       protocol: Optional[str] = None,
                       random: Optional[float] = None,
                       reject_with: Optional[str] = None,
                       routing_mark: Optional[str] = None,
                       src_address: Optional[str] = None,
                       src_address_list: Optional[str] = None,
                       src_address_type: Optional[str] = None,
                       src_mac_address: Optional[str] = None,
                       src_port: Optional[str] = None,
                       tcp_flags: Optional[str] = None,
                       tcp_mss: Optional[str] = None,
                       time: Optional[str] = None,
                       tls_host: Optional[str] = None)

func NewIpv6FirewallFilter(ctx *Context, name string, args Ipv6FirewallFilterArgs, opts ...ResourceOption) (*Ipv6FirewallFilter, error)

public Ipv6FirewallFilter(string name, Ipv6FirewallFilterArgs args, CustomResourceOptions? opts = null)

public Ipv6FirewallFilter(String name, Ipv6FirewallFilterArgs args)
public Ipv6FirewallFilter(String name, Ipv6FirewallFilterArgs args, CustomResourceOptions options)

type: routeros:Ipv6FirewallFilter
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args Ipv6FirewallFilterArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args Ipv6FirewallFilterArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args Ipv6FirewallFilterArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args Ipv6FirewallFilterArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args Ipv6FirewallFilterArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Ipv6FirewallFilter Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Ipv6FirewallFilter resource accepts the following input properties:

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
HopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallFilterId string
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random double: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
HopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallFilterId string
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random float64: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
headers String: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit String: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId String
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Double: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.

action string: Action to take if a packet is matched by the rule
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId string
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
random number: Matches packets randomly with a given probability.
rejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.

action str: Action to take if a packet is matched by the rule
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
headers str: Extension headers. Look at the Extras tab in the v6 filter rules.
hop_limit str: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_filter_id str
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
random float: Matches packets randomly with a given probability.
reject_with str: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.

action String: Action to take if a packet is matched by the rule
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
headers String: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit String: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId String
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Number: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.

Outputs

All input properties are implicitly available as output properties. Additionally, the Ipv6FirewallFilter resource produces the following output properties:

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string: The provider-assigned unique ID for this managed resource.
invalid boolean

dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str: The provider-assigned unique ID for this managed resource.
invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing Ipv6FirewallFilter Resource

Get an existing Ipv6FirewallFilter resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: Ipv6FirewallFilterState, opts?: CustomResourceOptions): Ipv6FirewallFilter

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_state: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        headers: Optional[str] = None,
        hop_limit: Optional[str] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ipsec_policy: Optional[str] = None,
        ipv6_firewall_filter_id: Optional[str] = None,
        jump_target: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        priority: Optional[float] = None,
        protocol: Optional[str] = None,
        random: Optional[float] = None,
        reject_with: Optional[str] = None,
        routing_mark: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_flags: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        tls_host: Optional[str] = None) -> Ipv6FirewallFilter

func GetIpv6FirewallFilter(ctx *Context, name string, id IDInput, state *Ipv6FirewallFilterState, opts ...ResourceOption) (*Ipv6FirewallFilter, error)

public static Ipv6FirewallFilter Get(string name, Input<string> id, Ipv6FirewallFilterState? state, CustomResourceOptions? opts = null)

public static Ipv6FirewallFilter get(String name, Output<String> id, Ipv6FirewallFilterState state, CustomResourceOptions options)

resources:  _:    type: routeros:Ipv6FirewallFilter    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: Action to take if a packet is matched by the rule
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
HopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallFilterId string
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random double: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
HopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallFilterId string
JumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random float64: Matches packets randomly with a given probability.
RejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
headers String: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit String: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId String
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Double: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.

___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string: Action to take if a packet is matched by the rule
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
headers string: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit string: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId string
jumpTarget string: Name of the target chain to jump to. Applicable only if action=jump.
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
random number: Matches packets randomly with a given probability.
rejectWith string: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.

___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str: Action to take if a packet is matched by the rule
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
headers str: Extension headers. Look at the Extras tab in the v6 filter rules.
hop_limit str: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_filter_id str
jump_target str: Name of the target chain to jump to. Applicable only if action=jump.
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
random float: Matches packets randomly with a given probability.
reject_with str: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.

___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
headers String: Extension headers. Look at the Extras tab in the v6 filter rules.
hopLimit String: IPv6 TTL. Look at the Extras tab in the v6 filter rules.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallFilterId String
jumpTarget String: Name of the target chain to jump to. Applicable only if action=jump.
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Number: Matches packets randomly with a given probability.
rejectWith String: Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.

Import

#The ID can be found via API or the terminal

#The command for the terminal is -> :put [/ipv6/firewall/filter get [print show-ids]]

$ pulumi import routeros:index/ipv6FirewallFilter:Ipv6FirewallFilter rule "*0"

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: routeros terraform-routeros/terraform-provider-routeros
License
Notes: This Pulumi package is based on the routeros Terraform Provider.

routeros 1.89.0 published on Wednesday, Oct 15, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.Ipv6FirewallFilter

On this page

On this page

Example Usage

Create Ipv6FirewallFilter Resource

Constructor syntax

Parameters

Ipv6FirewallFilter Resource Properties

Inputs

Outputs

Look up Existing Ipv6FirewallFilter Resource

Import

Package Details

On this page

On this page