Get a detailed overview of this resourceList the top 5 use cases for this resourceBuild a program using unifi.firewall.RuleRepository[unifi pulumiverse/pulumi-unifi](https://github.com/pulumiverse/pulumi-unifi)LicenseApache-2.0NotesThis Pulumi package is based on the [`unifi` Terraform Provider](https://github.com/filipowm/terraform-provider-unifi). 1. [Packages](/content/registry/index.html) 2. [Packages](/content/registry/packages/index.html) 3. [Unifi](/content/registry/packages/unifi/index.html) 4. [API Docs](/content/registry/packages/unifi/api-docs/index.html) 5. [firewall](/content/registry/packages/unifi/api-docs/firewall/index.html) 6. [Rule](/content/registry/packages/unifi/api-docs/firewall/rule/index.html) Unifi v0.2.0, Feb 17 26 Unifi v0.2.0, Feb 17 26 Viewing docs for Unifi v0.2.0 published on Tuesday, Feb 17, 2026 by Pulumiverse [Schema (JSON)](/content/registry/packages/unifi/schema.json) [pulumiverse/pulumi-unifi](https://github.com/pulumiverse/pulumi-unifi) # unifi.firewall.Rule [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#unifi-firewall-rule/index.html) Explore with Neo [Explain this resource](https://app.pulumi.com/neo?prompt=Explain+the+resource+unifi.firewall.Rule.+Provide+a+detailed+overview+of+its+purpose%2C+architecture%2C+and+typical+responsibilities.&prefer_signup=true) [Show real-world scenarios](https://app.pulumi.com/neo?prompt=List+the+top+five+real-world+scenarios+where+unifi.firewall.Rule+delivers+the+most+value.+Describe+why+it+is+useful+for+each.&prefer_signup=true) [Provision a new instance](https://app.pulumi.com/neo?prompt=Generate+a+Pulumi+program+that+provisions+unifi.firewall.Rule.+Include+any+required+configuration+and+showcase+best+practices.&prefer_signup=true) Viewing docs for Unifi v0.2.0 published on Tuesday, Feb 17, 2026 by Pulumiverse [Schema (JSON)](/content/registry/packages/unifi/schema.json) [pulumiverse/pulumi-unifi](https://github.com/pulumiverse/pulumi-unifi) ## On this page ## On this page - [Example Usage](/content/registry/packages/unifi/api-docs/firewall/rule/#example-usage/index.html) - [Create Rule Resource](/content/registry/packages/unifi/api-docs/firewall/rule/#create/index.html) - [Constructor syntax](/content/registry/packages/unifi/api-docs/firewall/rule/#constructor-syntax/index.html) - [Constructor example](/content/registry/packages/unifi/api-docs/firewall/rule/#constructor-example/index.html) - [Rule Resource Properties](/content/registry/packages/unifi/api-docs/firewall/rule/#properties/index.html) - [Inputs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html) - [Outputs](/content/registry/packages/unifi/api-docs/firewall/rule/#outputs/index.html) - [Look up Existing Rule Resource](/content/registry/packages/unifi/api-docs/firewall/rule/#look-up/index.html) - [Import](/content/registry/packages/unifi/api-docs/firewall/rule/#import/index.html) - [Package Details](/content/registry/packages/unifi/api-docs/firewall/rule/#package-details/index.html) - Copy Page - [Request a Change](https://github.com/pulumi/registry/issues/new?body=File:%20[themes%2fdefault%2fcontent/%2fregistry%2fpackages%2funifi%2fapi-docs%2ffirewall%2frule](https%3a%2f%2fwww.pulumi.com%2fregistry%2fpackages%2funifi%2fapi-docs%2ffirewall%2frule%2f)) [Scroll to top](/content/registry/packages/unifi/api-docs/firewall/rule/# "Scroll to top"/index.html) The `unifi.firewall.Rule` resource manages firewall rules. This resource allows you to create and manage firewall rules that control traffic flow between different network segments (WAN, LAN, Guest) for both IPv4 and IPv6 traffic. Rules can be configured to allow, drop, or reject traffic based on various criteria including protocols, ports, and IP addresses. Rules are processed in order based on their `rule_index`, with lower numbers being processed first. Custom rules should use indices between 2000-2999 or 4000-4999 to avoid conflicts with system rules. ## Example Usage [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#example-usage/index.html) - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript import * as pulumi from "@pulumi/pulumi"; import * as unifi from "@pulumiverse/unifi"; const config = new pulumi.Config(); const ipAddress = config.require("ipAddress"); const dropAll = new unifi.firewall.Rule("drop_all", { name: "drop all", action: "drop", ruleset: "LAN_IN", ruleIndex: 2011, protocol: "all", dstAddress: ipAddress, }); ``` Copy ```python import pulumi import pulumiverse_unifi as unifi config = pulumi.Config() ip_address = config.require("ipAddress") drop_all = unifi.firewall.Rule("drop_all", name="drop all", action="drop", ruleset="LAN_IN", rule_index=2011, protocol="all", dst_address=ip_address) ``` Copy ```go package main import ( "github.com/pulumi/pulumi/sdk/v3/go/pulumi" "github.com/pulumi/pulumi/sdk/v3/go/pulumi/config" "github.com/pulumiverse/pulumi-unifi/sdk/go/unifi/firewall" ) func main() { pulumi.Run(func(ctx *pulumi.Context) error { cfg := config.New(ctx, "") ipAddress := cfg.Require("ipAddress") _, err := firewall.NewRule(ctx, "drop_all", &firewall.RuleArgs{ Name: pulumi.String("drop all"), Action: pulumi.String("drop"), Ruleset: pulumi.String("LAN_IN"), RuleIndex: pulumi.Int(2011), Protocol: pulumi.String("all"), DstAddress: pulumi.String(ipAddress), }) if err != nil { return err } return nil }) } ``` Copy ```csharp using System.Collections.Generic; using System.Linq; using Pulumi; using Unifi = Pulumiverse.Unifi; return await Deployment.RunAsync(() => { var config = new Config(); var ipAddress = config.Require("ipAddress"); var dropAll = new Unifi.Firewall.Rule("drop_all", new() { Name = "drop all", Action = "drop", Ruleset = "LAN_IN", RuleIndex = 2011, Protocol = "all", DstAddress = ipAddress, }); }); ``` Copy ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumiverse.unifi.firewall.Rule; import com.pulumiverse.unifi.firewall.RuleArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { final var config = ctx.config(); final var ipAddress = config.require("ipAddress"); var dropAll = new Rule("dropAll", RuleArgs.builder() .name("drop all") .action("drop") .ruleset("LAN_IN") .ruleIndex(2011) .protocol("all") .dstAddress(ipAddress) .build()); } } ``` Copy ```yaml configuration: ipAddress: type: string resources: dropAll: type: unifi:firewall:Rule name: drop_all properties: name: drop all action: drop ruleset: LAN_IN ruleIndex: 2011 protocol: all dstAddress: ${ipAddress} ``` Copy ``` Example coming soon! ``` ## Create Rule Resource [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#create/index.html) Resources are created with functions called constructors. To learn more about declaring and configuring resources, see [Resources](/content/docs/concepts/resources/index.html). ### Constructor syntax [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#constructor-syntax/index.html) - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript new Rule(name: string, args: RuleArgs, opts?: CustomResourceOptions); ``` ```python @overload def Rule(resource_name: str, args: RuleArgs, opts: Optional[ResourceOptions] = None) @overload def Rule(resource_name: str, opts: Optional[ResourceOptions] = None, action: Optional[str] = None, ruleset: Optional[str] = None, rule_index: Optional[int] = None, protocol_v6: Optional[str] = None, dst_address: Optional[str] = None, dst_network_type: Optional[str] = None, dst_port: Optional[str] = None, enabled: Optional[bool] = None, icmp_typename: Optional[str] = None, icmp_v6_typename: Optional[str] = None, ip_sec: Optional[str] = None, logging: Optional[bool] = None, name: Optional[str] = None, protocol: Optional[str] = None, dst_firewall_group_ids: Optional[Sequence[str]] = None, dst_address_ipv6: Optional[str] = None, dst_network_id: Optional[str] = None, site: Optional[str] = None, src_address: Optional[str] = None, src_address_ipv6: Optional[str] = None, src_firewall_group_ids: Optional[Sequence[str]] = None, src_mac: Optional[str] = None, src_network_id: Optional[str] = None, src_network_type: Optional[str] = None, src_port: Optional[str] = None, state_established: Optional[bool] = None, state_invalid: Optional[bool] = None, state_new: Optional[bool] = None, state_related: Optional[bool] = None) ``` ```go func NewRule(ctx *Context, name string, args RuleArgs, opts ...ResourceOption) (*Rule, error) ``` ```csharp public Rule(string name, RuleArgs args, CustomResourceOptions? opts = null) ``` ```java public Rule(String name, RuleArgs args) public Rule(String name, RuleArgs args, CustomResourceOptions options) ``` ```yaml type: unifi:firewall:Rule properties: # The arguments to resource properties. options: # Bag of options to control resource's behavior. ``` ```hcl resource "unifi_firewall_rule" "name" { # resource properties } ``` #### Parameters [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#parameters/index.html) nameThis property is required.stringThe unique name of the resource.argsThis property is required.[RuleArgs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html)The arguments to resource properties.opts[CustomResourceOptions](/content/docs/reference/pkg/nodejs/pulumi/pulumi/#CustomResourceOptions/index.html)Bag of options to control resource's behavior. resource\_nameThis property is required.strThe unique name of the resource.argsThis property is required.[RuleArgs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html)The arguments to resource properties.opts[ResourceOptions](/content/docs/reference/pkg/python/pulumi/#pulumi.ResourceOptions)Bag of options to control resource's behavior. ctx[Context](https://pkg.go.dev/github.com/pulumi/pulumi/sdk/v3/go/pulumi?tab=doc#Context)Context object for the current deployment.nameThis property is required.stringThe unique name of the resource.argsThis property is required.[RuleArgs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html)The arguments to resource properties.opts[ResourceOption](https://pkg.go.dev/github.com/pulumi/pulumi/sdk/v3/go/pulumi?tab=doc#ResourceOption)Bag of options to control resource's behavior. nameThis property is required.stringThe unique name of the resource.argsThis property is required.[RuleArgs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html)The arguments to resource properties.opts[CustomResourceOptions](/content/docs/reference/pkg/dotnet/Pulumi/Pulumi.CustomResourceOptions.html)Bag of options to control resource's behavior. nameThis property is required.StringThe unique name of the resource.argsThis property is required.[RuleArgs](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html)The arguments to resource properties.optionsCustomResourceOptionsBag of options to control resource's behavior. ### Constructor example [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#constructor-example/index.html) The following reference example uses placeholder values for all [input properties](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html). - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```csharp var ruleResource = new Unifi.Firewall.Rule("ruleResource", new() { Action = "string", Ruleset = "string", RuleIndex = 0, ProtocolV6 = "string", DstAddress = "string", DstNetworkType = "string", DstPort = "string", Enabled = false, IcmpTypename = "string", IcmpV6Typename = "string", IpSec = "string", Logging = false, Name = "string", Protocol = "string", DstFirewallGroupIds = new[] { "string", }, DstAddressIpv6 = "string", DstNetworkId = "string", Site = "string", SrcAddress = "string", SrcAddressIpv6 = "string", SrcFirewallGroupIds = new[] { "string", }, SrcMac = "string", SrcNetworkId = "string", SrcNetworkType = "string", SrcPort = "string", StateEstablished = false, StateInvalid = false, StateNew = false, StateRelated = false, }); ``` Copy ```go example, err := firewall.NewRule(ctx, "ruleResource", &firewall.RuleArgs{ Action: pulumi.String("string"), Ruleset: pulumi.String("string"), RuleIndex: pulumi.Int(0), ProtocolV6: pulumi.String("string"), DstAddress: pulumi.String("string"), DstNetworkType: pulumi.String("string"), DstPort: pulumi.String("string"), Enabled: pulumi.Bool(false), IcmpTypename: pulumi.String("string"), IcmpV6Typename: pulumi.String("string"), IpSec: pulumi.String("string"), Logging: pulumi.Bool(false), Name: pulumi.String("string"), Protocol: pulumi.String("string"), DstFirewallGroupIds: pulumi.StringArray{ pulumi.String("string"), }, DstAddressIpv6: pulumi.String("string"), DstNetworkId: pulumi.String("string"), Site: pulumi.String("string"), SrcAddress: pulumi.String("string"), SrcAddressIpv6: pulumi.String("string"), SrcFirewallGroupIds: pulumi.StringArray{ pulumi.String("string"), }, SrcMac: pulumi.String("string"), SrcNetworkId: pulumi.String("string"), SrcNetworkType: pulumi.String("string"), SrcPort: pulumi.String("string"), StateEstablished: pulumi.Bool(false), StateInvalid: pulumi.Bool(false), StateNew: pulumi.Bool(false), StateRelated: pulumi.Bool(false), }) ``` Copy ```hcl resource "unifi_firewall_rule" "ruleResource" { action = "string" ruleset = "string" rule_index = 0 protocol_v6 = "string" dst_address = "string" dst_network_type = "string" dst_port = "string" enabled = false icmp_typename = "string" icmp_v6_typename = "string" ip_sec = "string" logging = false name = "string" protocol = "string" dst_firewall_group_ids = ["string"] dst_address_ipv6 = "string" dst_network_id = "string" site = "string" src_address = "string" src_address_ipv6 = "string" src_firewall_group_ids = ["string"] src_mac = "string" src_network_id = "string" src_network_type = "string" src_port = "string" state_established = false state_invalid = false state_new = false state_related = false } ``` Copy ```java var ruleResource = new Rule("ruleResource", RuleArgs.builder() .action("string") .ruleset("string") .ruleIndex(0) .protocolV6("string") .dstAddress("string") .dstNetworkType("string") .dstPort("string") .enabled(false) .icmpTypename("string") .icmpV6Typename("string") .ipSec("string") .logging(false) .name("string") .protocol("string") .dstFirewallGroupIds("string") .dstAddressIpv6("string") .dstNetworkId("string") .site("string") .srcAddress("string") .srcAddressIpv6("string") .srcFirewallGroupIds("string") .srcMac("string") .srcNetworkId("string") .srcNetworkType("string") .srcPort("string") .stateEstablished(false) .stateInvalid(false) .stateNew(false) .stateRelated(false) .build()); ``` Copy ```python rule_resource = unifi.firewall.Rule("ruleResource", action="string", ruleset="string", rule_index=0, protocol_v6="string", dst_address="string", dst_network_type="string", dst_port="string", enabled=False, icmp_typename="string", icmp_v6_typename="string", ip_sec="string", logging=False, name="string", protocol="string", dst_firewall_group_ids=["string"], dst_address_ipv6="string", dst_network_id="string", site="string", src_address="string", src_address_ipv6="string", src_firewall_group_ids=["string"], src_mac="string", src_network_id="string", src_network_type="string", src_port="string", state_established=False, state_invalid=False, state_new=False, state_related=False) ``` Copy ```typescript const ruleResource = new unifi.firewall.Rule("ruleResource", { action: "string", ruleset: "string", ruleIndex: 0, protocolV6: "string", dstAddress: "string", dstNetworkType: "string", dstPort: "string", enabled: false, icmpTypename: "string", icmpV6Typename: "string", ipSec: "string", logging: false, name: "string", protocol: "string", dstFirewallGroupIds: ["string"], dstAddressIpv6: "string", dstNetworkId: "string", site: "string", srcAddress: "string", srcAddressIpv6: "string", srcFirewallGroupIds: ["string"], srcMac: "string", srcNetworkId: "string", srcNetworkType: "string", srcPort: "string", stateEstablished: false, stateInvalid: false, stateNew: false, stateRelated: false, }); ``` Copy ```yaml type: unifi:firewall:Rule properties: action: string dstAddress: string dstAddressIpv6: string dstFirewallGroupIds: - string dstNetworkId: string dstNetworkType: string dstPort: string enabled: false icmpTypename: string icmpV6Typename: string ipSec: string logging: false name: string protocol: string protocolV6: string ruleIndex: 0 ruleset: string site: string srcAddress: string srcAddressIpv6: string srcFirewallGroupIds: - string srcMac: string srcNetworkId: string srcNetworkType: string srcPort: string stateEstablished: false stateInvalid: false stateNew: false stateRelated: false ``` Copy ## Rule Resource Properties [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#properties/index.html) To learn more about resource properties and how to use them, see [Inputs and Outputs](/content/docs/intro/concepts/inputs-outputs/index.html) in the Architecture and Concepts docs. ### Inputs [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#inputs/index.html) In Python, inputs that are objects can be passed either as [argument classes or as dictionary literals](/content/docs/languages-sdks/python/#inputs-and-outputs/index.html). The Rule resource accepts the following [input](/content/docs/intro/concepts/inputs-outputs/index.html) properties: [Action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_csharp/index.html)This property is required.stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [RuleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleindex_csharp/index.html)This property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [Ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_csharp/index.html)This property is required.string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: - NETWORK can be: WAN, LAN, GUEST (or their IPv6 variants WANv6, LANv6, GUESTv6) - DIRECTION can be: - IN - Traffic entering the network - OUT - Traffic leaving the network - LOCAL - Traffic destined for the USG/UDM itself Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [DstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddress_csharp/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[DstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddressipv6_csharp/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[DstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#dstfirewallgroupids_csharp/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[DstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworkid_csharp/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[DstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworktype_csharp/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [DstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#dstport_csharp/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [Enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_csharp/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[IcmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmptypename_csharp/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: - `echo-request` \- ICMP ping requests - `echo-reply` \- ICMP ping replies - `destination-unreachable` \- Host/network unreachable messages - `time-exceeded` \- TTL exceeded messages (traceroute) [IcmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmpv6typename_csharp/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: - `echo-request` \- IPv6 ping requests - `echo-reply` \- IPv6 ping replies - `neighbor-solicitation` \- IPv6 neighbor discovery - `neighbor-advertisement` \- IPv6 neighbor announcements - `destination-unreachable` \- Host/network unreachable messages - `packet-too-big` \- Path MTU discovery messages [IpSec](/content/registry/packages/unifi/api-docs/firewall/rule/#ipsec_csharp/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[Logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_csharp/index.html)boolEnable logging for the firewall rule.[Name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_csharp/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[Protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_csharp/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only (e.g., web, email) - `udp` \- UDP traffic only (e.g., DNS, VoIP) - `tcp_udp` \- Both TCP and UDP - `icmp` \- ICMP traffic (ping, traceroute) - Protocol numbers (1-255) for other protocols Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [ProtocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocolv6_csharp/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [Site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_csharp/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[SrcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddress_csharp/index.html)stringThe source IPv4 address for the firewall rule.[SrcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddressipv6_csharp/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[SrcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#srcfirewallgroupids_csharp/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [SrcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#srcmac_csharp/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[SrcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworkid_csharp/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[SrcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworktype_csharp/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [SrcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#srcport_csharp/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [StateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#stateestablished_csharp/index.html)bool Match established connections. When enabled: - Rule only applies to packets that are part of an existing connection - Useful for allowing return traffic without creating separate rules - Common in WAN\_IN rules to allow responses to outbound connections Example: Allow established connections from WAN while blocking new incoming connections [StateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#stateinvalid_csharp/index.html)boolMatch where the state is invalid.[StateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#statenew_csharp/index.html)boolMatch where the state is new.[StateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#staterelated_csharp/index.html)boolMatch where the state is related. [Action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_go/index.html)This property is required.stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [RuleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleindex_go/index.html)This property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [Ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_go/index.html)This property is required.string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [DstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddress_go/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[DstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddressipv6_go/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[DstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#dstfirewallgroupids_go/index.html)\[\]stringA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[DstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworkid_go/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[DstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworktype_go/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [DstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#dstport_go/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [Enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_go/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[IcmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmptypename_go/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [IcmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmpv6typename_go/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [IpSec](/content/registry/packages/unifi/api-docs/firewall/rule/#ipsec_go/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[Logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_go/index.html)boolEnable logging for the firewall rule.[Name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_go/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[Protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_go/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [ProtocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocolv6_go/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [Site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_go/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[SrcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddress_go/index.html)stringThe source IPv4 address for the firewall rule.[SrcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddressipv6_go/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[SrcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#srcfirewallgroupids_go/index.html)\[\]string A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [SrcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#srcmac_go/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[SrcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworkid_go/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[SrcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworktype_go/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [SrcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#srcport_go/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [StateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#stateestablished_go/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [StateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#stateinvalid_go/index.html)boolMatch where the state is invalid.[StateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#statenew_go/index.html)boolMatch where the state is new.[StateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#staterelated_go/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_hcl/index.html)This property is required.stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [rule\_index](/content/registry/packages/unifi/api-docs/firewall/rule/#rule_index_hcl/index.html)This property is required.numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_hcl/index.html)This property is required.string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [dst\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_address_hcl/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dst\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_address_ipv6_hcl/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dst\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_firewall_group_ids_hcl/index.html)list(string)A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dst\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_network_id_hcl/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dst\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_network_type_hcl/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dst\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_port_hcl/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_hcl/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmp\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmp_typename_hcl/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmp\_v6\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmp_v6_typename_hcl/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ip\_sec](/content/registry/packages/unifi/api-docs/firewall/rule/#ip_sec_hcl/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_hcl/index.html)boolEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_hcl/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_hcl/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocol\_v6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_v6_hcl/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_hcl/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[src\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#src_address_hcl/index.html)stringThe source IPv4 address for the firewall rule.[src\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#src_address_ipv6_hcl/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[src\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#src_firewall_group_ids_hcl/index.html)list(string) A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [src\_mac](/content/registry/packages/unifi/api-docs/firewall/rule/#src_mac_hcl/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[src\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#src_network_id_hcl/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[src\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#src_network_type_hcl/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [src\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#src_port_hcl/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [state\_established](/content/registry/packages/unifi/api-docs/firewall/rule/#state_established_hcl/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [state\_invalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_invalid_hcl/index.html)boolMatch where the state is invalid.[state\_new](/content/registry/packages/unifi/api-docs/firewall/rule/#state_new_hcl/index.html)boolMatch where the state is new.[state\_related](/content/registry/packages/unifi/api-docs/firewall/rule/#state_related_hcl/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_java/index.html)This property is required.StringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleindex_java/index.html)This property is required.IntegerThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_java/index.html)This property is required.String Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddress_java/index.html)StringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddressipv6_java/index.html)StringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#dstfirewallgroupids_java/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworkid_java/index.html)StringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworktype_java/index.html)StringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#dstport_java/index.html)StringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_java/index.html)BooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmptypename_java/index.html)StringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmpv6typename_java/index.html)StringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#ipsec_java/index.html)StringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_java/index.html)BooleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_java/index.html)StringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_java/index.html)String The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocolv6_java/index.html)StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_java/index.html)Changes to this property will trigger replacement.StringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddress_java/index.html)StringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddressipv6_java/index.html)StringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#srcfirewallgroupids_java/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#srcmac_java/index.html)StringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworkid_java/index.html)StringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworktype_java/index.html)StringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#srcport_java/index.html)StringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#stateestablished_java/index.html)Boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#stateinvalid_java/index.html)BooleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#statenew_java/index.html)BooleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#staterelated_java/index.html)BooleanMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_nodejs/index.html)This property is required.stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleindex_nodejs/index.html)This property is required.numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_nodejs/index.html)This property is required.string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddress_nodejs/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddressipv6_nodejs/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#dstfirewallgroupids_nodejs/index.html)string\[\]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworkid_nodejs/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworktype_nodejs/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#dstport_nodejs/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_nodejs/index.html)booleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmptypename_nodejs/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmpv6typename_nodejs/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#ipsec_nodejs/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_nodejs/index.html)booleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_nodejs/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_nodejs/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocolv6_nodejs/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_nodejs/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddress_nodejs/index.html)stringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddressipv6_nodejs/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#srcfirewallgroupids_nodejs/index.html)string\[\] A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#srcmac_nodejs/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworkid_nodejs/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworktype_nodejs/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#srcport_nodejs/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#stateestablished_nodejs/index.html)boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#stateinvalid_nodejs/index.html)booleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#statenew_nodejs/index.html)booleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#staterelated_nodejs/index.html)booleanMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_python/index.html)This property is required.strThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [rule\_index](/content/registry/packages/unifi/api-docs/firewall/rule/#rule_index_python/index.html)This property is required.intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_python/index.html)This property is required.str Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [dst\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_address_python/index.html)strThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dst\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_address_ipv6_python/index.html)strThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dst\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_firewall_group_ids_python/index.html)Sequence\[str\]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dst\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_network_id_python/index.html)strThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dst\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_network_type_python/index.html)strThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dst\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#dst_port_python/index.html)strThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_python/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmp\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmp_typename_python/index.html)strThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmp\_v6\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmp_v6_typename_python/index.html)strThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ip\_sec](/content/registry/packages/unifi/api-docs/firewall/rule/#ip_sec_python/index.html)strSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_python/index.html)boolEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_python/index.html)strA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_python/index.html)str The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocol\_v6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_v6_python/index.html)strThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_python/index.html)Changes to this property will trigger replacement.strThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[src\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#src_address_python/index.html)strThe source IPv4 address for the firewall rule.[src\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#src_address_ipv6_python/index.html)strThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[src\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#src_firewall_group_ids_python/index.html)Sequence\[str\] A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [src\_mac](/content/registry/packages/unifi/api-docs/firewall/rule/#src_mac_python/index.html)strThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[src\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#src_network_id_python/index.html)strThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[src\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#src_network_type_python/index.html)strThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [src\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#src_port_python/index.html)strThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [state\_established](/content/registry/packages/unifi/api-docs/firewall/rule/#state_established_python/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [state\_invalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_invalid_python/index.html)boolMatch where the state is invalid.[state\_new](/content/registry/packages/unifi/api-docs/firewall/rule/#state_new_python/index.html)boolMatch where the state is new.[state\_related](/content/registry/packages/unifi/api-docs/firewall/rule/#state_related_python/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#action_yaml/index.html)This property is required.StringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleindex_yaml/index.html)This property is required.NumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#ruleset_yaml/index.html)This property is required.String Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddress_yaml/index.html)StringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#dstaddressipv6_yaml/index.html)StringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#dstfirewallgroupids_yaml/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworkid_yaml/index.html)StringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#dstnetworktype_yaml/index.html)StringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#dstport_yaml/index.html)StringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#enabled_yaml/index.html)BooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmptypename_yaml/index.html)StringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#icmpv6typename_yaml/index.html)StringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#ipsec_yaml/index.html)StringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#logging_yaml/index.html)BooleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#name_yaml/index.html)StringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#protocol_yaml/index.html)String The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#protocolv6_yaml/index.html)StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [site](/content/registry/packages/unifi/api-docs/firewall/rule/#site_yaml/index.html)Changes to this property will trigger replacement.StringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddress_yaml/index.html)StringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#srcaddressipv6_yaml/index.html)StringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#srcfirewallgroupids_yaml/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#srcmac_yaml/index.html)StringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworkid_yaml/index.html)StringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#srcnetworktype_yaml/index.html)StringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#srcport_yaml/index.html)StringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#stateestablished_yaml/index.html)Boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#stateinvalid_yaml/index.html)BooleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#statenew_yaml/index.html)BooleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#staterelated_yaml/index.html)BooleanMatch where the state is related. ### Outputs [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#outputs/index.html) All [input](/content/registry/packages/unifi/api-docs/firewall/rule/#inputs/index.html) properties are implicitly available as output properties. Additionally, the Rule resource produces the following output properties: [Id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_csharp/index.html)stringThe provider-assigned unique ID for this managed resource. [Id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_go/index.html)stringThe provider-assigned unique ID for this managed resource. [id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_hcl/index.html)stringThe provider-assigned unique ID for this managed resource. [id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_java/index.html)StringThe provider-assigned unique ID for this managed resource. [id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_nodejs/index.html)stringThe provider-assigned unique ID for this managed resource. [id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_python/index.html)strThe provider-assigned unique ID for this managed resource. [id](/content/registry/packages/unifi/api-docs/firewall/rule/#id_yaml/index.html)StringThe provider-assigned unique ID for this managed resource. ## Look up Existing Rule Resource [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#look-up/index.html) Get an existing Rule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup. - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript public static get(name: string, id: Input, state?: RuleState, opts?: CustomResourceOptions): Rule ``` ```python @staticmethod def get(resource_name: str, id: str, opts: Optional[ResourceOptions] = None, action: Optional[str] = None, dst_address: Optional[str] = None, dst_address_ipv6: Optional[str] = None, dst_firewall_group_ids: Optional[Sequence[str]] = None, dst_network_id: Optional[str] = None, dst_network_type: Optional[str] = None, dst_port: Optional[str] = None, enabled: Optional[bool] = None, icmp_typename: Optional[str] = None, icmp_v6_typename: Optional[str] = None, ip_sec: Optional[str] = None, logging: Optional[bool] = None, name: Optional[str] = None, protocol: Optional[str] = None, protocol_v6: Optional[str] = None, rule_index: Optional[int] = None, ruleset: Optional[str] = None, site: Optional[str] = None, src_address: Optional[str] = None, src_address_ipv6: Optional[str] = None, src_firewall_group_ids: Optional[Sequence[str]] = None, src_mac: Optional[str] = None, src_network_id: Optional[str] = None, src_network_type: Optional[str] = None, src_port: Optional[str] = None, state_established: Optional[bool] = None, state_invalid: Optional[bool] = None, state_new: Optional[bool] = None, state_related: Optional[bool] = None) -> Rule ``` ```go func GetRule(ctx *Context, name string, id IDInput, state *RuleState, opts ...ResourceOption) (*Rule, error) ``` ```csharp public static Rule Get(string name, Input id, RuleState? state, CustomResourceOptions? opts = null) ``` ```java public static Rule get(String name, Output id, RuleState state, CustomResourceOptions options) ``` ```yaml resources: _: type: unifi:firewall:Rule get: id: ${id} ``` ```hcl import { to = unifi_firewall_rule.example id = "${id}" } ``` nameThis property is required.The unique name of the resulting resource.idThis property is required.The _unique_ provider ID of the resource to lookup.stateAny extra arguments used during the lookup.optsA bag of options that control this resource's behavior. resource\_nameThis property is required.The unique name of the resulting resource.idThis property is required.The _unique_ provider ID of the resource to lookup. The following state arguments are supported: [Action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_csharp/index.html)stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [DstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddress_csharp/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[DstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddressipv6_csharp/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[DstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstfirewallgroupids_csharp/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[DstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworkid_csharp/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[DstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworktype_csharp/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [DstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstport_csharp/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [Enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_csharp/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[IcmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmptypename_csharp/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [IcmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmpv6typename_csharp/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [IpSec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ipsec_csharp/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[Logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_csharp/index.html)boolEnable logging for the firewall rule.[Name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_csharp/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[Protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_csharp/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [ProtocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocolv6_csharp/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [RuleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleindex_csharp/index.html)intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [Ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_csharp/index.html)string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [Site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_csharp/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[SrcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddress_csharp/index.html)stringThe source IPv4 address for the firewall rule.[SrcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddressipv6_csharp/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[SrcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcfirewallgroupids_csharp/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [SrcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcmac_csharp/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[SrcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworkid_csharp/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[SrcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworktype_csharp/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [SrcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcport_csharp/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [StateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateestablished_csharp/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [StateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateinvalid_csharp/index.html)boolMatch where the state is invalid.[StateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#state_statenew_csharp/index.html)boolMatch where the state is new.[StateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#state_staterelated_csharp/index.html)boolMatch where the state is related. [Action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_go/index.html)stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [DstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddress_go/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[DstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddressipv6_go/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[DstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstfirewallgroupids_go/index.html)\[\]stringA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[DstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworkid_go/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[DstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworktype_go/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [DstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstport_go/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [Enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_go/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[IcmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmptypename_go/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [IcmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmpv6typename_go/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [IpSec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ipsec_go/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[Logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_go/index.html)boolEnable logging for the firewall rule.[Name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_go/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[Protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_go/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [ProtocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocolv6_go/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [RuleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleindex_go/index.html)intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [Ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_go/index.html)string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [Site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_go/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[SrcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddress_go/index.html)stringThe source IPv4 address for the firewall rule.[SrcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddressipv6_go/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[SrcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcfirewallgroupids_go/index.html)\[\]string A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [SrcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcmac_go/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[SrcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworkid_go/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[SrcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworktype_go/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [SrcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcport_go/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [StateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateestablished_go/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [StateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateinvalid_go/index.html)boolMatch where the state is invalid.[StateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#state_statenew_go/index.html)boolMatch where the state is new.[StateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#state_staterelated_go/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_hcl/index.html)stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [dst\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_address_hcl/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dst\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_address_ipv6_hcl/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dst\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_firewall_group_ids_hcl/index.html)list(string)A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dst\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_network_id_hcl/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dst\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_network_type_hcl/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dst\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_port_hcl/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_hcl/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmp\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmp_typename_hcl/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmp\_v6\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmp_v6_typename_hcl/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ip\_sec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ip_sec_hcl/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_hcl/index.html)boolEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_hcl/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_hcl/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocol\_v6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_v6_hcl/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [rule\_index](/content/registry/packages/unifi/api-docs/firewall/rule/#state_rule_index_hcl/index.html)numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_hcl/index.html)string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_hcl/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[src\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_address_hcl/index.html)stringThe source IPv4 address for the firewall rule.[src\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_address_ipv6_hcl/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[src\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_firewall_group_ids_hcl/index.html)list(string) A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [src\_mac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_mac_hcl/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[src\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_network_id_hcl/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[src\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_network_type_hcl/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [src\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_port_hcl/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [state\_established](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_established_hcl/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [state\_invalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_invalid_hcl/index.html)boolMatch where the state is invalid.[state\_new](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_new_hcl/index.html)boolMatch where the state is new.[state\_related](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_related_hcl/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_java/index.html)StringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddress_java/index.html)StringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddressipv6_java/index.html)StringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstfirewallgroupids_java/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworkid_java/index.html)StringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworktype_java/index.html)StringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstport_java/index.html)StringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_java/index.html)BooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmptypename_java/index.html)StringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmpv6typename_java/index.html)StringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ipsec_java/index.html)StringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_java/index.html)BooleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_java/index.html)StringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_java/index.html)String The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocolv6_java/index.html)StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleindex_java/index.html)IntegerThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_java/index.html)String Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_java/index.html)Changes to this property will trigger replacement.StringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddress_java/index.html)StringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddressipv6_java/index.html)StringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcfirewallgroupids_java/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcmac_java/index.html)StringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworkid_java/index.html)StringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworktype_java/index.html)StringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcport_java/index.html)StringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateestablished_java/index.html)Boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateinvalid_java/index.html)BooleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#state_statenew_java/index.html)BooleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#state_staterelated_java/index.html)BooleanMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_nodejs/index.html)stringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddress_nodejs/index.html)stringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddressipv6_nodejs/index.html)stringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstfirewallgroupids_nodejs/index.html)string\[\]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworkid_nodejs/index.html)stringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworktype_nodejs/index.html)stringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstport_nodejs/index.html)stringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_nodejs/index.html)booleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmptypename_nodejs/index.html)stringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmpv6typename_nodejs/index.html)stringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ipsec_nodejs/index.html)stringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_nodejs/index.html)booleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_nodejs/index.html)stringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_nodejs/index.html)string The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocolv6_nodejs/index.html)stringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleindex_nodejs/index.html)numberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_nodejs/index.html)string Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_nodejs/index.html)Changes to this property will trigger replacement.stringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddress_nodejs/index.html)stringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddressipv6_nodejs/index.html)stringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcfirewallgroupids_nodejs/index.html)string\[\] A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcmac_nodejs/index.html)stringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworkid_nodejs/index.html)stringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworktype_nodejs/index.html)stringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcport_nodejs/index.html)stringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateestablished_nodejs/index.html)boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateinvalid_nodejs/index.html)booleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#state_statenew_nodejs/index.html)booleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#state_staterelated_nodejs/index.html)booleanMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_python/index.html)strThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [dst\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_address_python/index.html)strThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dst\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_address_ipv6_python/index.html)strThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dst\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_firewall_group_ids_python/index.html)Sequence\[str\]A list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dst\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_network_id_python/index.html)strThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dst\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_network_type_python/index.html)strThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dst\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dst_port_python/index.html)strThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_python/index.html)boolWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmp\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmp_typename_python/index.html)strThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmp\_v6\_typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmp_v6_typename_python/index.html)strThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ip\_sec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ip_sec_python/index.html)strSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_python/index.html)boolEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_python/index.html)strA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_python/index.html)str The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocol\_v6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_v6_python/index.html)strThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [rule\_index](/content/registry/packages/unifi/api-docs/firewall/rule/#state_rule_index_python/index.html)intThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_python/index.html)str Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_python/index.html)Changes to this property will trigger replacement.strThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[src\_address](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_address_python/index.html)strThe source IPv4 address for the firewall rule.[src\_address\_ipv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_address_ipv6_python/index.html)strThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[src\_firewall\_group\_ids](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_firewall_group_ids_python/index.html)Sequence\[str\] A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [src\_mac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_mac_python/index.html)strThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[src\_network\_id](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_network_id_python/index.html)strThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[src\_network\_type](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_network_type_python/index.html)strThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [src\_port](/content/registry/packages/unifi/api-docs/firewall/rule/#state_src_port_python/index.html)strThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [state\_established](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_established_python/index.html)bool Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [state\_invalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_invalid_python/index.html)boolMatch where the state is invalid.[state\_new](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_new_python/index.html)boolMatch where the state is new.[state\_related](/content/registry/packages/unifi/api-docs/firewall/rule/#state_state_related_python/index.html)boolMatch where the state is related. [action](/content/registry/packages/unifi/api-docs/firewall/rule/#state_action_yaml/index.html)StringThe action to take when traffic matches this rule. Valid values are: - `accept` \- Allow the traffic - `drop` \- Silently block the traffic - `reject` \- Block the traffic and send an ICMP rejection message [dstAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddress_yaml/index.html)StringThe destination IPv4 address or network in CIDR notation (e.g., '192.168.1.10' or '192.168.0.0/24'). The format must match dst\_network\_type - use a single IP for ADDRv4 or CIDR for NETv4.[dstAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstaddressipv6_yaml/index.html)StringThe destination IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[dstFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstfirewallgroupids_yaml/index.html)ListA list of firewall group IDs to use as destinations. Groups can contain IP addresses, networks, or port numbers. This allows you to create reusable sets of addresses/ports and reference them in multiple rules.[dstNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworkid_yaml/index.html)StringThe ID of the destination network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller.[dstNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstnetworktype_yaml/index.html)StringThe type of destination network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [dstPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_dstport_yaml/index.html)StringThe destination port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [enabled](/content/registry/packages/unifi/api-docs/firewall/rule/#state_enabled_yaml/index.html)BooleanWhether this firewall rule is active (true) or disabled (false). Defaults to true.[icmpTypename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmptypename_yaml/index.html)StringThe ICMP type name when protocol is set to 'icmp'. Common values include: [icmpV6Typename](/content/registry/packages/unifi/api-docs/firewall/rule/#state_icmpv6typename_yaml/index.html)StringThe ICMPv6 type name when protocol\_v6 is set to 'ipv6-icmp'. Common values (not all are listed) include: [ipSec](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ipsec_yaml/index.html)StringSpecify whether the rule matches on IPsec packets. Can be one of `match-ipsec` or `match-none`.[logging](/content/registry/packages/unifi/api-docs/firewall/rule/#state_logging_yaml/index.html)BooleanEnable logging for the firewall rule.[name](/content/registry/packages/unifi/api-docs/firewall/rule/#state_name_yaml/index.html)StringA friendly name for the firewall rule. This helps identify the rule's purpose in the UniFi controller UI.[protocol](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocol_yaml/index.html)String The IPv4 protocol this rule applies to. Common values (not all are listed) include: Examples: - Use 'tcp' for web server rules (ports 80, 443) - Use 'udp' for VoIP or gaming traffic - Use 'all' for general network access rules [protocolV6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_protocolv6_yaml/index.html)StringThe IPv6 protocol this rule applies to. Similar to 'protocol' but for IPv6 traffic. Common values (not all are listed) include: - `all` \- Match all protocols - `tcp` \- TCP traffic only - `udp` \- UDP traffic only - `tcp_udp` \- Both TCP and UDP traffic - `ipv6-icmp` \- ICMPv6 traffic [ruleIndex](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleindex_yaml/index.html)NumberThe processing order for this rule. Lower numbers are processed first. Custom rules should use: - 2000-2999 for rules processed before auto-generated rules - 4000-4999 for rules processed after auto-generated rules [ruleset](/content/registry/packages/unifi/api-docs/firewall/rule/#state_ruleset_yaml/index.html)String Defines which traffic flow this rule applies to. The format is \[NETWORK\]\_\[DIRECTION\], where: Examples: WAN\_IN (incoming WAN traffic), LAN\_OUT (outgoing LAN traffic), GUEST\_LOCAL (traffic to Controller from guest network) [site](/content/registry/packages/unifi/api-docs/firewall/rule/#state_site_yaml/index.html)Changes to this property will trigger replacement.StringThe name of the UniFi site where the firewall rule should be created. If not specified, the default site will be used.[srcAddress](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddress_yaml/index.html)StringThe source IPv4 address for the firewall rule.[srcAddressIpv6](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcaddressipv6_yaml/index.html)StringThe source IPv6 address or network in CIDR notation (e.g., '2001:db8::1' or '2001:db8::/64'). Used for IPv6 firewall rules.[srcFirewallGroupIds](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcfirewallgroupids_yaml/index.html)List A list of firewall group IDs to use as sources. Groups can contain: - IP Address Groups - For matching specific IP addresses - Network Groups - For matching entire subnets - Port Groups - For matching specific port numbers Example uses: - Group of trusted admin IPs for remote access - Group of IoT device networks for isolation - Group of common service ports for allowing specific applications [srcMac](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcmac_yaml/index.html)StringThe source MAC address this rule applies to. Use this to create rules that match specific devices regardless of their IP address. Format: 'XX:XX:XX:XX:XX:XX'. MAC addresses are case-insensitive.[srcNetworkId](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworkid_yaml/index.html)StringThe ID of the source network this rule applies to. This can be found in the URL when viewing the network in the UniFi controller, or by using the network's name in the form `[site]/[network_name]`.[srcNetworkType](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcnetworktype_yaml/index.html)StringThe type of source network address. Valid values are: - `ADDRv4` \- Single IPv4 address - `NETv4` \- IPv4 network in CIDR notation [srcPort](/content/registry/packages/unifi/api-docs/firewall/rule/#state_srcport_yaml/index.html)StringThe source port(s) for this rule. Can be: - A single port number (e.g., '80') - A port range (e.g., '8000:8080') - A list of ports/ranges separated by commas [stateEstablished](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateestablished_yaml/index.html)Boolean Match established connections. When enabled: Example: Allow established connections from WAN while blocking new incoming connections [stateInvalid](/content/registry/packages/unifi/api-docs/firewall/rule/#state_stateinvalid_yaml/index.html)BooleanMatch where the state is invalid.[stateNew](/content/registry/packages/unifi/api-docs/firewall/rule/#state_statenew_yaml/index.html)BooleanMatch where the state is new.[stateRelated](/content/registry/packages/unifi/api-docs/firewall/rule/#state_staterelated_yaml/index.html)BooleanMatch where the state is related. ## Import [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#import/index.html) import using the ID from the controller API/UI ```sh $ pulumi import unifi:firewall/rule:Rule my_rule 5f7080eb6b8969064f80494f ``` Copy To learn more about importing existing cloud resources, see [Importing resources](/content/docs/using-pulumi/adopting-pulumi/import/index.html). ## Package Details [Anchor](/content/registry/packages/unifi/api-docs/firewall/rule/\#package-details/index.html) Viewing docs for Unifi v0.2.0 published on Tuesday, Feb 17, 2026 by Pulumiverse [Schema (JSON)](/content/registry/packages/unifi/schema.json) [pulumiverse/pulumi-unifi](https://github.com/pulumiverse/pulumi-unifi) ## On this page ## On this page - Copy Page [Scroll to top](/content/registry/packages/unifi/api-docs/firewall/rule/# "Scroll to top"/index.html) #### Try Pulumi Cloud free. Your team will thank you. [Start free trial](https://app.pulumi.com/signup?utm_source=registry&utm_medium=right-rail-banner&utm_campaign=try-pulumi-cloud&iaid=docs-try-pulumi-cloud-ad)