Get a detailed overview of this resourceList the top 5 use cases for this resourceBuild a program using unifi.firewall.RuleRepositoryunifi pulumiverse/pulumi-unifiLicenseApache-2.0NotesThis Pulumi package is based on the unifi Terraform Provider.

Unifi v0.2.0, Feb 17 26

Viewing docs for Unifi v0.2.0

published on Tuesday, Feb 17, 2026 by Pulumiverse

Schema (JSON)

pulumiverse/pulumi-unifi

unifi.firewall.Rule Anchor

Explore with Neo

Explain this resource Show real-world scenarios Provision a new instance

Viewing docs for Unifi v0.2.0

published on Tuesday, Feb 17, 2026 by Pulumiverse

Schema (JSON)

pulumiverse/pulumi-unifi

This resource allows you to create and manage firewall rules that control traffic flow between different network segments (WAN, LAN, Guest) for both IPv4 and IPv6 traffic. Rules can be configured to allow, drop, or reject traffic based on various criteria including protocols, ports, and IP addresses.

Rules are processed in order based on their rule_index, with lower numbers being processed first. Custom rules should use indices between 2000-2999 or 4000-4999 to avoid conflicts with system rules.

Example Usage Anchor

TypeScript
Python
Go
C#
Java
YAML
HCL PREVIEW

import * as pulumi from "@pulumi/pulumi";
import * as unifi from "@pulumiverse/unifi";

const config = new pulumi.Config();
const ipAddress = config.require("ipAddress");
const dropAll = new unifi.firewall.Rule("drop_all", {
    name: "drop all",
    action: "drop",
    ruleset: "LAN_IN",
    ruleIndex: 2011,
    protocol: "all",
    dstAddress: ipAddress,
});

Copy

import pulumi
import pulumiverse_unifi as unifi

config = pulumi.Config()
ip_address = config.require("ipAddress")
drop_all = unifi.firewall.Rule("drop_all",
    name="drop all",
    action="drop",
    ruleset="LAN_IN",
    rule_index=2011,
    protocol="all",
    dst_address=ip_address)

Copy

package main

import (
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
    "github.com/pulumiverse/pulumi-unifi/sdk/go/unifi/firewall"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        cfg := config.New(ctx, "")
        ipAddress := cfg.Require("ipAddress")
        _, err := firewall.NewRule(ctx, "drop_all", &firewall.RuleArgs{
            Name:       pulumi.String("drop all"),
            Action:     pulumi.String("drop"),
            Ruleset:    pulumi.String("LAN_IN"),
            RuleIndex:  pulumi.Int(2011),
            Protocol:   pulumi.String("all"),
            DstAddress: pulumi.String(ipAddress),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

Copy

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Unifi = Pulumiverse.Unifi;

return await Deployment.RunAsync(() =>
{
    var config = new Config();
    var ipAddress = config.Require("ipAddress");
    var dropAll = new Unifi.Firewall.Rule("drop_all", new()
    {
        Name = "drop all",
        Action = "drop",
        Ruleset = "LAN_IN",
        RuleIndex = 2011,
        Protocol = "all",
        DstAddress = ipAddress,
    });

});

Copy

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumiverse.unifi.firewall.Rule;
import com.pulumiverse.unifi.firewall.RuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

public static void stack(Context ctx) {
        final var config = ctx.config();
        final var ipAddress = config.require("ipAddress");
        var dropAll = new Rule("dropAll", RuleArgs.builder()
            .name("drop all")
            .action("drop")
            .ruleset("LAN_IN")
            .ruleIndex(2011)
            .protocol("all")
            .dstAddress(ipAddress)
            .build());

}
}

Copy

configuration:
  ipAddress:
    type: string
resources:
  dropAll:
    type: unifi:firewall:Rule
    name: drop_all
    properties:
      name: drop all
      action: drop
      ruleset: LAN_IN
      ruleIndex: 2011
      protocol: all
      dstAddress: ${ipAddress}

Copy

Example coming soon!

Create Rule Resource Anchor

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax Anchor

TypeScript
Python
Go
C#
Java
YAML
HCL PREVIEW

new Rule(name: string, args: RuleArgs, opts?: CustomResourceOptions);

@overload
def Rule(resource_name: str,
         args: RuleArgs,
         opts: Optional[ResourceOptions] = None)

@overload
def Rule(resource_name: str,
         opts: Optional[ResourceOptions] = None,
         action: Optional[str] = None,
         ruleset: Optional[str] = None,
         rule_index: Optional[int] = None,
         protocol_v6: Optional[str] = None,
         dst_address: Optional[str] = None,
         dst_network_type: Optional[str] = None,
         dst_port: Optional[str] = None,
         enabled: Optional[bool] = None,
         icmp_typename: Optional[str] = None,
         icmp_v6_typename: Optional[str] = None,
         ip_sec: Optional[str] = None,
         logging: Optional[bool] = None,
         name: Optional[str] = None,
         protocol: Optional[str] = None,
         dst_firewall_group_ids: Optional[Sequence[str]] = None,
         dst_address_ipv6: Optional[str] = None,
         dst_network_id: Optional[str] = None,
         site: Optional[str] = None,
         src_address: Optional[str] = None,
         src_address_ipv6: Optional[str] = None,
         src_firewall_group_ids: Optional[Sequence[str]] = None,
         src_mac: Optional[str] = None,
         src_network_id: Optional[str] = None,
         src_network_type: Optional[str] = None,
         src_port: Optional[str] = None,
         state_established: Optional[bool] = None,
         state_invalid: Optional[bool] = None,
         state_new: Optional[bool] = None,
         state_related: Optional[bool] = None)

func NewRule(ctx *Context, name string, args RuleArgs, opts ...ResourceOption) (*Rule, error)

public Rule(string name, RuleArgs args, CustomResourceOptions? opts = null)

public Rule(String name, RuleArgs args)
public Rule(String name, RuleArgs args, CustomResourceOptions options)

type: unifi:firewall:Rule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "unifi_firewall_rule" "name" {
    # resource properties
}

Parameters Anchor

nameThis property is required.stringThe unique name of the resource.argsThis property is required.RuleArgsThe arguments to resource properties.optsCustomResourceOptionsBag of options to control resource's behavior.

resource_nameThis property is required.strThe unique name of the resource.argsThis property is required.RuleArgsThe arguments to resource properties.optsResourceOptionsBag of options to control resource's behavior.

ctxContextContext object for the current deployment.nameThis property is required.stringThe unique name of the resource.argsThis property is required.RuleArgsThe arguments to resource properties.optsResourceOptionBag of options to control resource's behavior.

nameThis property is required.StringThe unique name of the resource.argsThis property is required.RuleArgsThe arguments to resource properties.optionsCustomResourceOptionsBag of options to control resource's behavior.

Constructor example Anchor

The following reference example uses placeholder values for all input properties.

TypeScript
Python
Go
C#
Java
YAML
HCL PREVIEW

var ruleResource = new Unifi.Firewall.Rule("ruleResource", new()
{
    Action = "string",
    Ruleset = "string",
    RuleIndex = 0,
    ProtocolV6 = "string",
    DstAddress = "string",
    DstNetworkType = "string",
    DstPort = "string",
    Enabled = false,
    IcmpTypename = "string",
    IcmpV6Typename = "string",
    IpSec = "string",
    Logging = false,
    Name = "string",
    Protocol = "string",
    DstFirewallGroupIds = new[]
    {
        "string",
    },
    DstAddressIpv6 = "string",
    DstNetworkId = "string",
    Site = "string",
    SrcAddress = "string",
    SrcAddressIpv6 = "string",
    SrcFirewallGroupIds = new[]
    {
        "string",
    },
    SrcMac = "string",
    SrcNetworkId = "string",
    SrcNetworkType = "string",
    SrcPort = "string",
    StateEstablished = false,
    StateInvalid = false,
    StateNew = false,
    StateRelated = false,
});

Copy

example, err := firewall.NewRule(ctx, "ruleResource", &firewall.RuleArgs{
    Action:         pulumi.String("string"),
    Ruleset:        pulumi.String("string"),
    RuleIndex:      pulumi.Int(0),
    ProtocolV6:     pulumi.String("string"),
    DstAddress:     pulumi.String("string"),
    DstNetworkType: pulumi.String("string"),
    DstPort:        pulumi.String("string"),
    Enabled:        pulumi.Bool(false),
    IcmpTypename:   pulumi.String("string"),
    IcmpV6Typename: pulumi.String("string"),
    IpSec:          pulumi.String("string"),
    Logging:        pulumi.Bool(false),
    Name:           pulumi.String("string"),
    Protocol:       pulumi.String("string"),
    DstFirewallGroupIds: pulumi.StringArray{
        pulumi.String("string"),
    },
    DstAddressIpv6: pulumi.String("string"),
    DstNetworkId:   pulumi.String("string"),
    Site:           pulumi.String("string"),
    SrcAddress:     pulumi.String("string"),
    SrcAddressIpv6: pulumi.String("string"),
    SrcFirewallGroupIds: pulumi.StringArray{
        pulumi.String("string"),
    },
    SrcMac:           pulumi.String("string"),
    SrcNetworkId:     pulumi.String("string"),
    SrcNetworkType:   pulumi.String("string"),
    SrcPort:          pulumi.String("string"),
    StateEstablished: pulumi.Bool(false),
    StateInvalid:     pulumi.Bool(false),
    StateNew:         pulumi.Bool(false),
    StateRelated:     pulumi.Bool(false),
})

Copy

resource "unifi_firewall_rule" "ruleResource" {
  action                 = "string"
  ruleset                = "string"
  rule_index             = 0
  protocol_v6            = "string"
  dst_address            = "string"
  dst_network_type       = "string"
  dst_port               = "string"
  enabled                = false
  icmp_typename          = "string"
  icmp_v6_typename       = "string"
  ip_sec                 = "string"
  logging                = false
  name                   = "string"
  protocol               = "string"
  dst_firewall_group_ids = ["string"]
  dst_address_ipv6       = "string"
  dst_network_id         = "string"
  site                   = "string"
  src_address            = "string"
  src_address_ipv6       = "string"
  src_firewall_group_ids = ["string"]
  src_mac                = "string"
  src_network_id         = "string"
  src_network_type       = "string"
  src_port               = "string"
  state_established      = false
  state_invalid          = false
  state_new              = false
  state_related          = false
}

Copy

var ruleResource = new Rule("ruleResource", RuleArgs.builder()
    .action("string")
    .ruleset("string")
    .ruleIndex(0)
    .protocolV6("string")
    .dstAddress("string")
    .dstNetworkType("string")
    .dstPort("string")
    .enabled(false)
    .icmpTypename("string")
    .icmpV6Typename("string")
    .ipSec("string")
    .logging(false)
    .name("string")
    .protocol("string")
    .dstFirewallGroupIds("string")
    .dstAddressIpv6("string")
    .dstNetworkId("string")
    .site("string")
    .srcAddress("string")
    .srcAddressIpv6("string")
    .srcFirewallGroupIds("string")
    .srcMac("string")
    .srcNetworkId("string")
    .srcNetworkType("string")
    .srcPort("string")
    .stateEstablished(false)
    .stateInvalid(false)
    .stateNew(false)
    .stateRelated(false)
    .build());

Copy

rule_resource = unifi.firewall.Rule("ruleResource",
    action="string",
    ruleset="string",
    rule_index=0,
    protocol_v6="string",
    dst_address="string",
    dst_network_type="string",
    dst_port="string",
    enabled=False,
    icmp_typename="string",
    icmp_v6_typename="string",
    ip_sec="string",
    logging=False,
    name="string",
    protocol="string",
    dst_firewall_group_ids=["string"],
    dst_address_ipv6="string",
    dst_network_id="string",
    site="string",
    src_address="string",
    src_address_ipv6="string",
    src_firewall_group_ids=["string"],
    src_mac="string",
    src_network_id="string",
    src_network_type="string",
    src_port="string",
    state_established=False,
    state_invalid=False,
    state_new=False,
    state_related=False)

Copy

const ruleResource = new unifi.firewall.Rule("ruleResource", {
    action: "string",
    ruleset: "string",
    ruleIndex: 0,
    protocolV6: "string",
    dstAddress: "string",
    dstNetworkType: "string",
    dstPort: "string",
    enabled: false,
    icmpTypename: "string",
    icmpV6Typename: "string",
    ipSec: "string",
    logging: false,
    name: "string",
    protocol: "string",
    dstFirewallGroupIds: ["string"],
    dstAddressIpv6: "string",
    dstNetworkId: "string",
    site: "string",
    srcAddress: "string",
    srcAddressIpv6: "string",
    srcFirewallGroupIds: ["string"],
    srcMac: "string",
    srcNetworkId: "string",
    srcNetworkType: "string",
    srcPort: "string",
    stateEstablished: false,
    stateInvalid: false,
    stateNew: false,
    stateRelated: false,
});

Copy

type: unifi:firewall:Rule
properties:
    action: string
    dstAddress: string
    dstAddressIpv6: string
    dstFirewallGroupIds:
        - string
    dstNetworkId: string
    dstNetworkType: string
    dstPort: string
    enabled: false
    icmpTypename: string
    icmpV6Typename: string
    ipSec: string
    logging: false
    name: string
    protocol: string
    protocolV6: string
    ruleIndex: 0
    ruleset: string
    site: string
    srcAddress: string
    srcAddressIpv6: string
    srcFirewallGroupIds:
        - string
    srcMac: string
    srcNetworkId: string
    srcNetworkType: string
    srcPort: string
    stateEstablished: false
    stateInvalid: false
    stateNew: false
    stateRelated: false

Copy

Rule Resource Properties Anchor

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs Anchor

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Rule resource accepts the following input properties:

ActionThis property is required.stringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

RuleIndexThis property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

RulesetThis property is required.string

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

NETWORK can be: WAN, LAN, GUEST (or their IPv6 variants WANv6, LANv6, GUESTv6)
DIRECTION can be:
- IN - Traffic entering the network
- OUT - Traffic leaving the network
- LOCAL - Traffic destined for the USG/UDM itself

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

DstAddressstringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.DstAddressIpv6stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.DstFirewallGroupIdsListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.DstNetworkIdstringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.DstNetworkTypestringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

DstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

EnabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.IcmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

echo-request - ICMP ping requests
echo-reply - ICMP ping replies
destination-unreachable - Host/network unreachable messages
time-exceeded - TTL exceeded messages (traceroute)

IcmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

echo-request - IPv6 ping requests
echo-reply - IPv6 ping replies
neighbor-solicitation - IPv6 neighbor discovery
neighbor-advertisement - IPv6 neighbor announcements
destination-unreachable - Host/network unreachable messages
packet-too-big - Path MTU discovery messages

IpSecstringSpecify whether the rule matches on IPsec packets. Can be one of match-ipsec or match-none.LoggingboolEnable logging for the firewall rule.NamestringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.Protocolstring

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only (e.g., web, email)
udp - UDP traffic only (e.g., DNS, VoIP)
tcp_udp - Both TCP and UDP
icmp - ICMP traffic (ping, traceroute)
Protocol numbers (1-255) for other protocols

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

ProtocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

SiteChanges to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.SrcAddressstringThe source IPv4 address for the firewall rule.SrcAddressIpv6stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.SrcFirewallGroupIdsList

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

SrcMacstringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.SrcNetworkIdstringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form [site]/[network_name].SrcNetworkTypestringThe type of source network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

SrcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

StateEstablishedbool

Match established connections. When enabled:

Rule only applies to packets that are part of an existing connection
Useful for allowing return traffic without creating separate rules
Common in WAN_IN rules to allow responses to outbound connections

Example: Allow established connections from WAN while blocking new incoming connections

StateInvalidboolMatch where the state is invalid.StateNewboolMatch where the state is new.StateRelatedboolMatch where the state is related.

ActionThis property is required.stringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

RuleIndexThis property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

RulesetThis property is required.string

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

DstAddressstringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.DstAddressIpv6stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.DstFirewallGroupIds[]stringA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.DstNetworkIdstringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.DstNetworkTypestringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

DstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

EnabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.IcmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

IcmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

ProtocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

SrcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

StateEstablishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

StateInvalidboolMatch where the state is invalid.StateNewboolMatch where the state is new.StateRelatedboolMatch where the state is related.

actionThis property is required.stringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

rule_indexThis property is required.numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetThis property is required.string

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

dst_addressstringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.dst_address_ipv6stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.dst_firewall_group_idslist(string)A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.dst_network_idstringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.dst_network_typestringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dst_portstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmp_typenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmp_v6_typenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

ip_secstringSpecify whether the rule matches on IPsec packets. Can be one of match-ipsec or match-none.loggingboolEnable logging for the firewall rule.namestringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.protocolstring

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocol_v6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

siteChanges to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.src_addressstringThe source IPv4 address for the firewall rule.src_address_ipv6stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.src_firewall_group_idslist(string)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

src_macstringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.src_network_idstringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form [site]/[network_name].src_network_typestringThe type of source network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

src_portstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

state_establishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

state_invalidboolMatch where the state is invalid.state_newboolMatch where the state is new.state_relatedboolMatch where the state is related.

actionThis property is required.StringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ruleIndexThis property is required.IntegerThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetThis property is required.String

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

dstAddressStringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.dstAddressIpv6StringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.dstFirewallGroupIdsListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.dstNetworkIdStringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.dstNetworkTypeStringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortStringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledBooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenameStringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenameStringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

ipSecStringSpecify whether the rule matches on IPsec packets. Can be one of match-ipsec or match-none.loggingBooleanEnable logging for the firewall rule.nameStringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.protocolString

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

siteChanges to this property will trigger replacement.StringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.srcAddressStringThe source IPv4 address for the firewall rule.srcAddressIpv6StringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.srcFirewallGroupIdsList

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

srcMacStringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.srcNetworkIdStringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form [site]/[network_name].srcNetworkTypeStringThe type of source network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortStringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedBoolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidBooleanMatch where the state is invalid.stateNewBooleanMatch where the state is new.stateRelatedBooleanMatch where the state is related.

actionThis property is required.stringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ruleIndexThis property is required.numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetThis property is required.string

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

dstAddressstringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.dstAddressIpv6stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.dstFirewallGroupIdsstring[]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.dstNetworkIdstringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.dstNetworkTypestringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledbooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

ipSecstringSpecify whether the rule matches on IPsec packets. Can be one of match-ipsec or match-none.loggingbooleanEnable logging for the firewall rule.namestringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.protocolstring

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

siteChanges to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.srcAddressstringThe source IPv4 address for the firewall rule.srcAddressIpv6stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.srcFirewallGroupIdsstring[]

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

srcMacstringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.srcNetworkIdstringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form [site]/[network_name].srcNetworkTypestringThe type of source network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedboolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidbooleanMatch where the state is invalid.stateNewbooleanMatch where the state is new.stateRelatedbooleanMatch where the state is related.

actionThis property is required.strThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

rule_indexThis property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetThis property is required.str

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

dst_addressstrThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.dst_address_ipv6strThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.dst_firewall_group_idsSequence[str]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.dst_network_idstrThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.dst_network_typestrThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dst_portstrThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmp_typenamestrThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmp_v6_typenamestrThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

ip_secstrSpecify whether the rule matches on IPsec packets. Can be one of match-ipsec or match-none.loggingboolEnable logging for the firewall rule.namestrA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.protocolstr

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocol_v6strThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

siteChanges to this property will trigger replacement.strThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.src_addressstrThe source IPv4 address for the firewall rule.src_address_ipv6strThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.src_firewall_group_idsSequence[str]

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

src_macstrThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.src_network_idstrThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form [site]/[network_name].src_network_typestrThe type of source network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

src_portstrThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

state_establishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

state_invalidboolMatch where the state is invalid.state_newboolMatch where the state is new.state_relatedboolMatch where the state is related.

actionThis property is required.StringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ruleIndexThis property is required.NumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetThis property is required.String

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortStringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledBooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenameStringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenameStringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortStringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedBoolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidBooleanMatch where the state is invalid.stateNewBooleanMatch where the state is new.stateRelatedBooleanMatch where the state is related.

Outputs Anchor

All input properties are implicitly available as output properties. Additionally, the Rule resource produces the following output properties:

IdstringThe provider-assigned unique ID for this managed resource.

idstringThe provider-assigned unique ID for this managed resource.

idStringThe provider-assigned unique ID for this managed resource.

idstringThe provider-assigned unique ID for this managed resource.

idstrThe provider-assigned unique ID for this managed resource.

idStringThe provider-assigned unique ID for this managed resource.

Look up Existing Rule Resource Anchor

Get an existing Rule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

TypeScript
Python
Go
C#
Java
YAML
HCL PREVIEW

public static get(name: string, id: Input<ID>, state?: RuleState, opts?: CustomResourceOptions): Rule

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[str] = None,
        dst_address: Optional[str] = None,
        dst_address_ipv6: Optional[str] = None,
        dst_firewall_group_ids: Optional[Sequence[str]] = None,
        dst_network_id: Optional[str] = None,
        dst_network_type: Optional[str] = None,
        dst_port: Optional[str] = None,
        enabled: Optional[bool] = None,
        icmp_typename: Optional[str] = None,
        icmp_v6_typename: Optional[str] = None,
        ip_sec: Optional[str] = None,
        logging: Optional[bool] = None,
        name: Optional[str] = None,
        protocol: Optional[str] = None,
        protocol_v6: Optional[str] = None,
        rule_index: Optional[int] = None,
        ruleset: Optional[str] = None,
        site: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_ipv6: Optional[str] = None,
        src_firewall_group_ids: Optional[Sequence[str]] = None,
        src_mac: Optional[str] = None,
        src_network_id: Optional[str] = None,
        src_network_type: Optional[str] = None,
        src_port: Optional[str] = None,
        state_established: Optional[bool] = None,
        state_invalid: Optional[bool] = None,
        state_new: Optional[bool] = None,
        state_related: Optional[bool] = None) -> Rule

func GetRule(ctx *Context, name string, id IDInput, state *RuleState, opts ...ResourceOption) (*Rule, error)

public static Rule Get(string name, Input<string> id, RuleState? state, CustomResourceOptions? opts = null)

public static Rule get(String name, Output<String> id, RuleState state, CustomResourceOptions options)

resources:  _:    type: unifi:firewall:Rule    get:      id: ${id}

import {
  to = unifi_firewall_rule.example
  id = "${id}"
}

nameThis property is required.The unique name of the resulting resource.idThis property is required.The unique provider ID of the resource to lookup.stateAny extra arguments used during the lookup.optsA bag of options that control this resource's behavior.

resource_nameThis property is required.The unique name of the resulting resource.idThis property is required.The unique provider ID of the resource to lookup.

The following state arguments are supported:

ActionstringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

DstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

EnabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.IcmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

IcmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

ProtocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

RuleIndexintThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

Rulesetstring

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

SrcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

StateEstablishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

StateInvalidboolMatch where the state is invalid.StateNewboolMatch where the state is new.StateRelatedboolMatch where the state is related.

ActionstringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

DstAddressstringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst_network_type - use a single IP for ADDRv4 or CIDR for NETv4.DstAddressIpv6stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.DstFirewallGroupIds[]stringA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.DstNetworkIdstringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.DstNetworkTypestringThe type of destination network address. Valid values are:

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

DstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

EnabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.IcmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

IcmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

ProtocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

RuleIndexintThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

Rulesetstring

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

SrcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

StateEstablishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

StateInvalidboolMatch where the state is invalid.StateNewboolMatch where the state is new.StateRelatedboolMatch where the state is related.

actionstringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dst_portstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmp_typenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmp_v6_typenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocol_v6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

rule_indexnumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetstring

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

src_portstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

state_establishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

state_invalidboolMatch where the state is invalid.state_newboolMatch where the state is new.state_relatedboolMatch where the state is related.

actionStringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortStringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledBooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenameStringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenameStringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

ruleIndexIntegerThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetString

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortStringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedBoolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidBooleanMatch where the state is invalid.stateNewBooleanMatch where the state is new.stateRelatedBooleanMatch where the state is related.

actionstringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortstringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledbooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenamestringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenamestringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

ruleIndexnumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetstring

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

siteChanges to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.srcAddressstringThe source IPv4 address for the firewall rule.srcAddressIpv6stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.srcFirewallGroupIdsstring[]

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortstringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedboolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidbooleanMatch where the state is invalid.stateNewbooleanMatch where the state is new.stateRelatedbooleanMatch where the state is related.

actionstrThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dst_portstrThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledboolWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmp_typenamestrThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmp_v6_typenamestrThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocol_v6strThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

rule_indexintThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetstr

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

src_portstrThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

state_establishedbool

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

state_invalidboolMatch where the state is invalid.state_newboolMatch where the state is new.state_relatedboolMatch where the state is related.

actionStringThe action to take when traffic matches this rule. Valid values are:

accept - Allow the traffic
drop - Silently block the traffic
reject - Block the traffic and send an ICMP rejection message

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

dstPortStringThe destination port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

enabledBooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.icmpTypenameStringThe ICMP type name when protocol is set to 'icmp'. Common values include:

icmpV6TypenameStringThe ICMPv6 type name when protocol_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include:

The IPv4 protocol this rule applies to. Common values (not all are listed) include:

Examples:

Use 'tcp' for web server rules (ports 80, 443)
Use 'udp' for VoIP or gaming traffic
Use 'all' for general network access rules

protocolV6StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include:

all - Match all protocols
tcp - TCP traffic only
udp - UDP traffic only
tcp_udp - Both TCP and UDP traffic
ipv6-icmp - ICMPv6 traffic

ruleIndexNumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use:

2000-2999 for rules processed before auto-generated rules
4000-4999 for rules processed after auto-generated rules

rulesetString

Defines which traffic flow this rule applies to. The format is [NETWORK]_[DIRECTION], where:

Examples: WAN_IN (incoming WAN traffic), LAN_OUT (outgoing LAN traffic), GUEST_LOCAL (traffic to Controller from guest network)

A list of firewall group IDs to use as sources. Groups can contain:

IP Address Groups - For matching specific IP addresses
Network Groups - For matching entire subnets
Port Groups - For matching specific port numbers

Example uses:

Group of trusted admin IPs for remote access
Group of IoT device networks for isolation
Group of common service ports for allowing specific applications

ADDRv4 - Single IPv4 address
NETv4 - IPv4 network in CIDR notation

srcPortStringThe source port(s) for this rule. Can be:

A single port number (e.g., '80')
A port range (e.g., '8000:8080')
A list of ports/ranges separated by commas

stateEstablishedBoolean

Match established connections. When enabled:

Example: Allow established connections from WAN while blocking new incoming connections

stateInvalidBooleanMatch where the state is invalid.stateNewBooleanMatch where the state is new.stateRelatedBooleanMatch where the state is related.

Import Anchor

import using the ID from the controller API/UI

$ pulumi import unifi:firewall/rule:Rule my_rule 5f7080eb6b8969064f80494f

Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details Anchor

Viewing docs for Unifi v0.2.0

published on Tuesday, Feb 17, 2026 by Pulumiverse

Schema (JSON)

pulumiverse/pulumi-unifi

unifi.firewall.Rule Anchor

On this page

On this page

Example Usage Anchor

Create Rule Resource Anchor

Constructor syntax Anchor

Parameters Anchor

Constructor example Anchor

Rule Resource Properties Anchor

Inputs Anchor

Outputs Anchor

Look up Existing Rule Resource Anchor

Import Anchor

Package Details Anchor

On this page

On this page

Try Pulumi Cloud free. Your team will thank you.