routeros 1.83.1, Apr 28 25

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.Ipv6FirewallMangle

Explore with Pulumi AI

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const rule = new routeros.Ipv6FirewallMangle("rule", {
    action: "change-mss",
    chain: "forward",
    newMss: "1130",
    outInterface: "pppoe-out",
    protocol: "tcp",
    tcpFlags: "syn",
    tcpMss: "1301-65535",
});

import pulumi
import pulumi_routeros as routeros

rule = routeros.Ipv6FirewallMangle("rule",
    action="change-mss",
    chain="forward",
    new_mss="1130",
    out_interface="pppoe-out",
    protocol="tcp",
    tcp_flags="syn",
    tcp_mss="1301-65535")

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpv6FirewallMangle(ctx, "rule", &routeros.Ipv6FirewallMangleArgs{
			Action:       pulumi.String("change-mss"),
			Chain:        pulumi.String("forward"),
			NewMss:       pulumi.String("1130"),
			OutInterface: pulumi.String("pppoe-out"),
			Protocol:     pulumi.String("tcp"),
			TcpFlags:     pulumi.String("syn"),
			TcpMss:       pulumi.String("1301-65535"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var rule = new Routeros.Ipv6FirewallMangle("rule", new()
    {
        Action = "change-mss",
        Chain = "forward",
        NewMss = "1130",
        OutInterface = "pppoe-out",
        Protocol = "tcp",
        TcpFlags = "syn",
        TcpMss = "1301-65535",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.Ipv6FirewallMangle;
import com.pulumi.routeros.Ipv6FirewallMangleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rule = new Ipv6FirewallMangle("rule", Ipv6FirewallMangleArgs.builder()
            .action("change-mss")
            .chain("forward")
            .newMss("1130")
            .outInterface("pppoe-out")
            .protocol("tcp")
            .tcpFlags("syn")
            .tcpMss("1301-65535")
            .build());

    }
}

resources:
  rule:
    type: routeros:Ipv6FirewallMangle
    properties:
      action: change-mss
      chain: forward
      newMss: '1130'
      outInterface: pppoe-out
      protocol: tcp
      tcpFlags: syn
      tcpMss: 1301-65535

Create Ipv6FirewallMangle Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Ipv6FirewallMangle(name: string, args: Ipv6FirewallMangleArgs, opts?: CustomResourceOptions);

@overload
def Ipv6FirewallMangle(resource_name: str,
                       args: Ipv6FirewallMangleArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def Ipv6FirewallMangle(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       action: Optional[str] = None,
                       chain: Optional[str] = None,
                       ___id_: Optional[float] = None,
                       ___path_: Optional[str] = None,
                       ___skip_: Optional[str] = None,
                       ___unset_: Optional[str] = None,
                       address_list: Optional[str] = None,
                       address_list_timeout: Optional[str] = None,
                       comment: Optional[str] = None,
                       connection_bytes: Optional[str] = None,
                       connection_limit: Optional[str] = None,
                       connection_mark: Optional[str] = None,
                       connection_nat_state: Optional[str] = None,
                       connection_rate: Optional[str] = None,
                       connection_state: Optional[str] = None,
                       connection_type: Optional[str] = None,
                       content: Optional[str] = None,
                       disabled: Optional[bool] = None,
                       dscp: Optional[float] = None,
                       dst_address: Optional[str] = None,
                       dst_address_list: Optional[str] = None,
                       dst_address_type: Optional[str] = None,
                       dst_limit: Optional[str] = None,
                       dst_port: Optional[str] = None,
                       icmp_options: Optional[str] = None,
                       in_bridge_port: Optional[str] = None,
                       in_bridge_port_list: Optional[str] = None,
                       in_interface: Optional[str] = None,
                       in_interface_list: Optional[str] = None,
                       ingress_priority: Optional[float] = None,
                       ipsec_policy: Optional[str] = None,
                       ipv6_firewall_mangle_id: Optional[str] = None,
                       limit: Optional[str] = None,
                       log: Optional[bool] = None,
                       log_prefix: Optional[str] = None,
                       new_connection_mark: Optional[str] = None,
                       new_dscp: Optional[float] = None,
                       new_mss: Optional[str] = None,
                       new_packet_mark: Optional[str] = None,
                       new_priority: Optional[str] = None,
                       new_routing_mark: Optional[str] = None,
                       new_ttl: Optional[str] = None,
                       nth: Optional[str] = None,
                       out_bridge_port: Optional[str] = None,
                       out_bridge_port_list: Optional[str] = None,
                       out_interface: Optional[str] = None,
                       out_interface_list: Optional[str] = None,
                       packet_mark: Optional[str] = None,
                       packet_size: Optional[str] = None,
                       passthrough: Optional[bool] = None,
                       per_connection_classifier: Optional[str] = None,
                       place_before: Optional[str] = None,
                       port: Optional[str] = None,
                       priority: Optional[float] = None,
                       protocol: Optional[str] = None,
                       random: Optional[float] = None,
                       routing_mark: Optional[str] = None,
                       src_address: Optional[str] = None,
                       src_address_list: Optional[str] = None,
                       src_address_type: Optional[str] = None,
                       src_mac_address: Optional[str] = None,
                       src_port: Optional[str] = None,
                       tcp_flags: Optional[str] = None,
                       tcp_mss: Optional[str] = None,
                       time: Optional[str] = None,
                       tls_host: Optional[str] = None,
                       ttl: Optional[str] = None)

func NewIpv6FirewallMangle(ctx *Context, name string, args Ipv6FirewallMangleArgs, opts ...ResourceOption) (*Ipv6FirewallMangle, error)

public Ipv6FirewallMangle(string name, Ipv6FirewallMangleArgs args, CustomResourceOptions? opts = null)

public Ipv6FirewallMangle(String name, Ipv6FirewallMangleArgs args)
public Ipv6FirewallMangle(String name, Ipv6FirewallMangleArgs args, CustomResourceOptions options)

type: routeros:Ipv6FirewallMangle
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args Ipv6FirewallMangleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args Ipv6FirewallMangleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args Ipv6FirewallMangleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args Ipv6FirewallMangleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args Ipv6FirewallMangleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Ipv6FirewallMangle Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Ipv6FirewallMangle resource accepts the following input properties:

Action string: Action to take if a packet is matched by the rule.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp double: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random double: Matches packets randomly with a given probability.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp float64: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random float64: Matches packets randomly with a given probability.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

action String: Action to take if a packet is matched by the rule.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Double: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Double: Matches packets randomly with a given probability.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

action string: Action to take if a packet is matched by the rule.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId string
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string: Sets a new connection-mark value.
newDscp number: Sets a new DSCP value for a packet.
newMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string: Sets a new packet-mark value.
newPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string: Sets a new routing-mark value.
newTtl string: Sets a new TTL for a packet.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
passthrough boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
random number: Matches packets randomly with a given probability.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

action str: Action to take if a packet is matched by the rule.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_mangle_id str
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str: Sets a new connection-mark value.
new_dscp float: Sets a new DSCP value for a packet.
new_mss str: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str: Sets a new packet-mark value.
new_priority str: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str: Sets a new routing-mark value.
new_ttl str: Sets a new TTL for a packet.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
random float: Matches packets randomly with a given probability.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

action String: Action to take if a packet is matched by the rule.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Number: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Number: Matches packets randomly with a given probability.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Outputs

All input properties are implicitly available as output properties. Additionally, the Ipv6FirewallMangle resource produces the following output properties:

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string: The provider-assigned unique ID for this managed resource.
Invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string: The provider-assigned unique ID for this managed resource.
invalid boolean

dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str: The provider-assigned unique ID for this managed resource.
invalid bool

dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String: The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing Ipv6FirewallMangle Resource

Get an existing Ipv6FirewallMangle resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: Ipv6FirewallMangleState, opts?: CustomResourceOptions): Ipv6FirewallMangle

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_nat_state: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_state: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ipsec_policy: Optional[str] = None,
        ipv6_firewall_mangle_id: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        new_connection_mark: Optional[str] = None,
        new_dscp: Optional[float] = None,
        new_mss: Optional[str] = None,
        new_packet_mark: Optional[str] = None,
        new_priority: Optional[str] = None,
        new_routing_mark: Optional[str] = None,
        new_ttl: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        passthrough: Optional[bool] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        priority: Optional[float] = None,
        protocol: Optional[str] = None,
        random: Optional[float] = None,
        routing_mark: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_flags: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        tls_host: Optional[str] = None,
        ttl: Optional[str] = None) -> Ipv6FirewallMangle

func GetIpv6FirewallMangle(ctx *Context, name string, id IDInput, state *Ipv6FirewallMangleState, opts ...ResourceOption) (*Ipv6FirewallMangle, error)

public static Ipv6FirewallMangle Get(string name, Input<string> id, Ipv6FirewallMangleState? state, CustomResourceOptions? opts = null)

public static Ipv6FirewallMangle get(String name, Output<String> id, Ipv6FirewallMangleState state, CustomResourceOptions options)

resources:  _:    type: routeros:Ipv6FirewallMangle    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: Action to take if a packet is matched by the rule.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp double: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp double: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random double: Matches packets randomly with a given probability.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

Action string: Action to take if a packet is matched by the rule.
AddressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string: Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string: Interprets the connection tracking analysis data for a particular packet.
ConnectionType string: Matches packets from related connections based on information from their connection tracking helpers.
Content string: Match packets that contain specified text.
Disabled bool
Dscp float64: Matches DSCP IP header field.
DstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string: Matches destination address of a packet against user-defined address list.
DstAddressType string: Matches destination address type.
DstLimit string: Matches packets until a given rate is exceeded.
DstPort string: List of destination port numbers or port number ranges.
Dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
IcmpOptions string: Matches ICMP type: code fields.
InBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string: Interface the packet has entered the router.
InInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool: Add a message to the system log.
LogPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string: Sets a new connection-mark value.
NewDscp float64: Sets a new DSCP value for a packet.
NewMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string: Sets a new packet-mark value.
NewPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string: Sets a new routing-mark value.
NewTtl string: Sets a new TTL for a packet.
Nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string: Interface the packet is leaving the router.
OutInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string: Matches packets of specified size or size range in bytes.
Passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string: Matches particular IP protocol specified by protocol name or number.
Random float64: Matches packets randomly with a given probability.
RoutingMark string: Matches packets marked by mangle facility with particular routing mark.
SrcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string: Matches source address of a packet against user-defined address list.
SrcAddressType string: Matches source address type.
SrcMacAddress string: Matches source MAC address of the packet.
SrcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string: Matches specified TCP flags.
TcpMss string: Matches TCP MSS value of an IP packet.
Time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string: Matches packets TTL value.
___id_ float64: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.

___id_ Double: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Double: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Double: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Double: Matches packets randomly with a given probability.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

___id_ number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string: Action to take if a packet is matched by the rule.
addressList string: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string: Can match connections that are srcnatted, dstnatted or both.
connectionRate string: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string: Interprets the connection tracking analysis data for a particular packet.
connectionType string: Matches packets from related connections based on information from their connection tracking helpers.
content string: Match packets that contain specified text.
disabled boolean
dscp number: Matches DSCP IP header field.
dstAddress string: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string: Matches destination address of a packet against user-defined address list.
dstAddressType string: Matches destination address type.
dstLimit string: Matches packets until a given rate is exceeded.
dstPort string: List of destination port numbers or port number ranges.
dynamic boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions string: Matches ICMP type: code fields.
inBridgePort string: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string: Interface the packet has entered the router.
inInterfaceList string: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipsecPolicy string: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId string
limit string: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean: Add a message to the system log.
logPrefix string: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string: Sets a new connection-mark value.
newDscp number: Sets a new DSCP value for a packet.
newMss string: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string: Sets a new packet-mark value.
newPriority string: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string: Sets a new routing-mark value.
newTtl string: Sets a new TTL for a packet.
nth string: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string: Interface the packet is leaving the router.
outInterfaceList string: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string: Matches packets of specified size or size range in bytes.
passthrough boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string: Matches particular IP protocol specified by protocol name or number.
random number: Matches packets randomly with a given probability.
routingMark string: Matches packets marked by mangle facility with particular routing mark.
srcAddress string: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string: Matches source address of a packet against user-defined address list.
srcAddressType string: Matches source address type.
srcMacAddress string: Matches source MAC address of the packet.
srcPort string: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string: Matches specified TCP flags.
tcpMss string: Matches TCP MSS value of an IP packet.
time string: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string: Matches packets TTL value.

___id_ float: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str: Action to take if a packet is matched by the rule.
address_list str: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str: Can match connections that are srcnatted, dstnatted or both.
connection_rate str: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str: Interprets the connection tracking analysis data for a particular packet.
connection_type str: Matches packets from related connections based on information from their connection tracking helpers.
content str: Match packets that contain specified text.
disabled bool
dscp float: Matches DSCP IP header field.
dst_address str: Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str: Matches destination address of a packet against user-defined address list.
dst_address_type str: Matches destination address type.
dst_limit str: Matches packets until a given rate is exceeded.
dst_port str: List of destination port numbers or port number ranges.
dynamic bool: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmp_options str: Matches ICMP type: code fields.
in_bridge_port str: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str: Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str: Interface the packet has entered the router.
in_interface_list str: Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ipsec_policy str: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_mangle_id str
limit str: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool: Add a message to the system log.
log_prefix str: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str: Sets a new connection-mark value.
new_dscp float: Sets a new DSCP value for a packet.
new_mss str: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str: Sets a new packet-mark value.
new_priority str: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str: Sets a new routing-mark value.
new_ttl str: Sets a new TTL for a packet.
nth str: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str: Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str: Interface the packet is leaving the router.
out_interface_list str: Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str: Matches packets of specified size or size range in bytes.
passthrough bool: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str: Matches particular IP protocol specified by protocol name or number.
random float: Matches packets randomly with a given probability.
routing_mark str: Matches packets marked by mangle facility with particular routing mark.
src_address str: Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str: Matches source address of a packet against user-defined address list.
src_address_type str: Matches source address type.
src_mac_address str: Matches source MAC address of the packet.
src_port str: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str: Matches specified TCP flags.
tcp_mss str: Matches TCP MSS value of an IP packet.
time str: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str: Matches packets TTL value.

___id_ Number: Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String: Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String: A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String: A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String: Action to take if a packet is matched by the rule.
addressList String: Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String: Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String: Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String: Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String: Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String: Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String: Can match connections that are srcnatted, dstnatted or both.
connectionRate String: Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String: Interprets the connection tracking analysis data for a particular packet.
connectionType String: Matches packets from related connections based on information from their connection tracking helpers.
content String: Match packets that contain specified text.
disabled Boolean
dscp Number: Matches DSCP IP header field.
dstAddress String: Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String: Matches destination address of a packet against user-defined address list.
dstAddressType String: Matches destination address type.
dstLimit String: Matches packets until a given rate is exceeded.
dstPort String: List of destination port numbers or port number ranges.
dynamic Boolean: Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions String: Matches ICMP type: code fields.
inBridgePort String: Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String: Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String: Interface the packet has entered the router.
inInterfaceList String: Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number: Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String: Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String: Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean: Add a message to the system log.
logPrefix String: Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String: Sets a new connection-mark value.
newDscp Number: Sets a new DSCP value for a packet.
newMss String: Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String: Sets a new packet-mark value.
newPriority String: Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String: Sets a new routing-mark value.
newTtl String: Sets a new TTL for a packet.
nth String: Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String: Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String: Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String: Interface the packet is leaving the router.
outInterfaceList String: Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String: Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String: Matches packets of specified size or size range in bytes.
passthrough Boolean: Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String: PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String: Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String: Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number: Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String: Matches particular IP protocol specified by protocol name or number.
random Number: Matches packets randomly with a given probability.
routingMark String: Matches packets marked by mangle facility with particular routing mark.
srcAddress String: Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String: Matches source address of a packet against user-defined address list.
srcAddressType String: Matches source address type.
srcMacAddress String: Matches source MAC address of the packet.
srcPort String: List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String: Matches specified TCP flags.
tcpMss String: Matches TCP MSS value of an IP packet.
time String: Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String: Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String: Matches packets TTL value.

Import

#The ID can be found via API or the terminal

#The command for the terminal is -> :put [/ipv6/firewall/mangle get [print show-ids]]

$ pulumi import routeros:index/ipv6FirewallMangle:Ipv6FirewallMangle rule "*0"

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: routeros terraform-routeros/terraform-provider-routeros
License
Notes: This Pulumi package is based on the routeros Terraform Provider.

routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros

terraform-routeros/terraform-provider-routeros

routeros.Ipv6FirewallMangle

On this page

On this page

Example Usage

Create Ipv6FirewallMangle Resource

Constructor syntax

Parameters

Ipv6FirewallMangle Resource Properties

Inputs

Outputs

Look up Existing Ipv6FirewallMangle Resource

Import

Package Details

On this page

On this page