1. Packages
  2. Routeros Provider
  3. API Docs
  4. Ipv6FirewallMangle
routeros 1.81.2 published on Tuesday, Apr 15, 2025 by terraform-routeros

routeros.Ipv6FirewallMangle

Explore with Pulumi AI

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const rule = new routeros.Ipv6FirewallMangle("rule", {
    action: "change-mss",
    chain: "forward",
    newMss: "1130",
    outInterface: "pppoe-out",
    protocol: "tcp",
    tcpFlags: "syn",
    tcpMss: "1301-65535",
});
Copy
import pulumi
import pulumi_routeros as routeros

rule = routeros.Ipv6FirewallMangle("rule",
    action="change-mss",
    chain="forward",
    new_mss="1130",
    out_interface="pppoe-out",
    protocol="tcp",
    tcp_flags="syn",
    tcp_mss="1301-65535")
Copy
package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpv6FirewallMangle(ctx, "rule", &routeros.Ipv6FirewallMangleArgs{
			Action:       pulumi.String("change-mss"),
			Chain:        pulumi.String("forward"),
			NewMss:       pulumi.String("1130"),
			OutInterface: pulumi.String("pppoe-out"),
			Protocol:     pulumi.String("tcp"),
			TcpFlags:     pulumi.String("syn"),
			TcpMss:       pulumi.String("1301-65535"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var rule = new Routeros.Ipv6FirewallMangle("rule", new()
    {
        Action = "change-mss",
        Chain = "forward",
        NewMss = "1130",
        OutInterface = "pppoe-out",
        Protocol = "tcp",
        TcpFlags = "syn",
        TcpMss = "1301-65535",
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.Ipv6FirewallMangle;
import com.pulumi.routeros.Ipv6FirewallMangleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rule = new Ipv6FirewallMangle("rule", Ipv6FirewallMangleArgs.builder()
            .action("change-mss")
            .chain("forward")
            .newMss("1130")
            .outInterface("pppoe-out")
            .protocol("tcp")
            .tcpFlags("syn")
            .tcpMss("1301-65535")
            .build());

    }
}
Copy
resources:
  rule:
    type: routeros:Ipv6FirewallMangle
    properties:
      action: change-mss
      chain: forward
      newMss: '1130'
      outInterface: pppoe-out
      protocol: tcp
      tcpFlags: syn
      tcpMss: 1301-65535
Copy

Create Ipv6FirewallMangle Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Ipv6FirewallMangle(name: string, args: Ipv6FirewallMangleArgs, opts?: CustomResourceOptions);
@overload
def Ipv6FirewallMangle(resource_name: str,
                       args: Ipv6FirewallMangleArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def Ipv6FirewallMangle(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       action: Optional[str] = None,
                       chain: Optional[str] = None,
                       ___id_: Optional[float] = None,
                       ___path_: Optional[str] = None,
                       ___skip_: Optional[str] = None,
                       ___unset_: Optional[str] = None,
                       address_list: Optional[str] = None,
                       address_list_timeout: Optional[str] = None,
                       comment: Optional[str] = None,
                       connection_bytes: Optional[str] = None,
                       connection_limit: Optional[str] = None,
                       connection_mark: Optional[str] = None,
                       connection_nat_state: Optional[str] = None,
                       connection_rate: Optional[str] = None,
                       connection_state: Optional[str] = None,
                       connection_type: Optional[str] = None,
                       content: Optional[str] = None,
                       disabled: Optional[bool] = None,
                       dscp: Optional[float] = None,
                       dst_address: Optional[str] = None,
                       dst_address_list: Optional[str] = None,
                       dst_address_type: Optional[str] = None,
                       dst_limit: Optional[str] = None,
                       dst_port: Optional[str] = None,
                       icmp_options: Optional[str] = None,
                       in_bridge_port: Optional[str] = None,
                       in_bridge_port_list: Optional[str] = None,
                       in_interface: Optional[str] = None,
                       in_interface_list: Optional[str] = None,
                       ingress_priority: Optional[float] = None,
                       ipsec_policy: Optional[str] = None,
                       ipv6_firewall_mangle_id: Optional[str] = None,
                       limit: Optional[str] = None,
                       log: Optional[bool] = None,
                       log_prefix: Optional[str] = None,
                       new_connection_mark: Optional[str] = None,
                       new_dscp: Optional[float] = None,
                       new_mss: Optional[str] = None,
                       new_packet_mark: Optional[str] = None,
                       new_priority: Optional[str] = None,
                       new_routing_mark: Optional[str] = None,
                       new_ttl: Optional[str] = None,
                       nth: Optional[str] = None,
                       out_bridge_port: Optional[str] = None,
                       out_bridge_port_list: Optional[str] = None,
                       out_interface: Optional[str] = None,
                       out_interface_list: Optional[str] = None,
                       packet_mark: Optional[str] = None,
                       packet_size: Optional[str] = None,
                       passthrough: Optional[bool] = None,
                       per_connection_classifier: Optional[str] = None,
                       place_before: Optional[str] = None,
                       port: Optional[str] = None,
                       priority: Optional[float] = None,
                       protocol: Optional[str] = None,
                       random: Optional[float] = None,
                       routing_mark: Optional[str] = None,
                       src_address: Optional[str] = None,
                       src_address_list: Optional[str] = None,
                       src_address_type: Optional[str] = None,
                       src_mac_address: Optional[str] = None,
                       src_port: Optional[str] = None,
                       tcp_flags: Optional[str] = None,
                       tcp_mss: Optional[str] = None,
                       time: Optional[str] = None,
                       tls_host: Optional[str] = None,
                       ttl: Optional[str] = None)
func NewIpv6FirewallMangle(ctx *Context, name string, args Ipv6FirewallMangleArgs, opts ...ResourceOption) (*Ipv6FirewallMangle, error)
public Ipv6FirewallMangle(string name, Ipv6FirewallMangleArgs args, CustomResourceOptions? opts = null)
public Ipv6FirewallMangle(String name, Ipv6FirewallMangleArgs args)
public Ipv6FirewallMangle(String name, Ipv6FirewallMangleArgs args, CustomResourceOptions options)
type: routeros:Ipv6FirewallMangle
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. Ipv6FirewallMangleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. Ipv6FirewallMangleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. Ipv6FirewallMangleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. Ipv6FirewallMangleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. Ipv6FirewallMangleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Ipv6FirewallMangle Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Ipv6FirewallMangle resource accepts the following input properties:

Action This property is required. string
Action to take if a packet is matched by the rule.
Chain This property is required. string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string
Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string
Interprets the connection tracking analysis data for a particular packet.
ConnectionType string
Matches packets from related connections based on information from their connection tracking helpers.
Content string
Match packets that contain specified text.
Disabled bool
Dscp double
Matches DSCP IP header field.
DstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string
Matches destination address of a packet against user-defined address list.
DstAddressType string
Matches destination address type.
DstLimit string
Matches packets until a given rate is exceeded.
DstPort string
List of destination port numbers or port number ranges.
IcmpOptions string
Matches ICMP type: code fields.
InBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string
Interface the packet has entered the router.
InInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool
Add a message to the system log.
LogPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string
Sets a new connection-mark value.
NewDscp double
Sets a new DSCP value for a packet.
NewMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string
Sets a new packet-mark value.
NewPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string
Sets a new routing-mark value.
NewTtl string
Sets a new TTL for a packet.
Nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string
Interface the packet is leaving the router.
OutInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string
Matches packets of specified size or size range in bytes.
Passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string
Matches particular IP protocol specified by protocol name or number.
Random double
Matches packets randomly with a given probability.
RoutingMark string
Matches packets marked by mangle facility with particular routing mark.
SrcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string
Matches source address of a packet against user-defined address list.
SrcAddressType string
Matches source address type.
SrcMacAddress string
Matches source MAC address of the packet.
SrcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string
Matches specified TCP flags.
TcpMss string
Matches TCP MSS value of an IP packet.
Time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string
Matches packets TTL value.
___id_ double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
Action This property is required. string
Action to take if a packet is matched by the rule.
Chain This property is required. string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
AddressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Comment string
ConnectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string
Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string
Interprets the connection tracking analysis data for a particular packet.
ConnectionType string
Matches packets from related connections based on information from their connection tracking helpers.
Content string
Match packets that contain specified text.
Disabled bool
Dscp float64
Matches DSCP IP header field.
DstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string
Matches destination address of a packet against user-defined address list.
DstAddressType string
Matches destination address type.
DstLimit string
Matches packets until a given rate is exceeded.
DstPort string
List of destination port numbers or port number ranges.
IcmpOptions string
Matches ICMP type: code fields.
InBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string
Interface the packet has entered the router.
InInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
IpsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool
Add a message to the system log.
LogPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string
Sets a new connection-mark value.
NewDscp float64
Sets a new DSCP value for a packet.
NewMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string
Sets a new packet-mark value.
NewPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string
Sets a new routing-mark value.
NewTtl string
Sets a new TTL for a packet.
Nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string
Interface the packet is leaving the router.
OutInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string
Matches packets of specified size or size range in bytes.
Passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string
Matches particular IP protocol specified by protocol name or number.
Random float64
Matches packets randomly with a given probability.
RoutingMark string
Matches packets marked by mangle facility with particular routing mark.
SrcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string
Matches source address of a packet against user-defined address list.
SrcAddressType string
Matches source address type.
SrcMacAddress string
Matches source MAC address of the packet.
SrcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string
Matches specified TCP flags.
TcpMss string
Matches TCP MSS value of an IP packet.
Time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string
Matches packets TTL value.
___id_ float64
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action This property is required. String
Action to take if a packet is matched by the rule.
chain This property is required. String
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String
Can match connections that are srcnatted, dstnatted or both.
connectionRate String
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String
Interprets the connection tracking analysis data for a particular packet.
connectionType String
Matches packets from related connections based on information from their connection tracking helpers.
content String
Match packets that contain specified text.
disabled Boolean
dscp Double
Matches DSCP IP header field.
dstAddress String
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String
Matches destination address of a packet against user-defined address list.
dstAddressType String
Matches destination address type.
dstLimit String
Matches packets until a given rate is exceeded.
dstPort String
List of destination port numbers or port number ranges.
icmpOptions String
Matches ICMP type: code fields.
inBridgePort String
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String
Interface the packet has entered the router.
inInterfaceList String
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean
Add a message to the system log.
logPrefix String
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String
Sets a new connection-mark value.
newDscp Double
Sets a new DSCP value for a packet.
newMss String
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String
Sets a new packet-mark value.
newPriority String
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String
Sets a new routing-mark value.
newTtl String
Sets a new TTL for a packet.
nth String
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String
Interface the packet is leaving the router.
outInterfaceList String
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String
Matches packets of specified size or size range in bytes.
passthrough Boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String
Matches particular IP protocol specified by protocol name or number.
random Double
Matches packets randomly with a given probability.
routingMark String
Matches packets marked by mangle facility with particular routing mark.
srcAddress String
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String
Matches source address of a packet against user-defined address list.
srcAddressType String
Matches source address type.
srcMacAddress String
Matches source MAC address of the packet.
srcPort String
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String
Matches specified TCP flags.
tcpMss String
Matches TCP MSS value of an IP packet.
time String
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String
Matches packets TTL value.
action This property is required. string
Action to take if a packet is matched by the rule.
chain This property is required. string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment string
connectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string
Can match connections that are srcnatted, dstnatted or both.
connectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string
Interprets the connection tracking analysis data for a particular packet.
connectionType string
Matches packets from related connections based on information from their connection tracking helpers.
content string
Match packets that contain specified text.
disabled boolean
dscp number
Matches DSCP IP header field.
dstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string
Matches destination address of a packet against user-defined address list.
dstAddressType string
Matches destination address type.
dstLimit string
Matches packets until a given rate is exceeded.
dstPort string
List of destination port numbers or port number ranges.
icmpOptions string
Matches ICMP type: code fields.
inBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string
Interface the packet has entered the router.
inInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId string
limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean
Add a message to the system log.
logPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string
Sets a new connection-mark value.
newDscp number
Sets a new DSCP value for a packet.
newMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string
Sets a new packet-mark value.
newPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string
Sets a new routing-mark value.
newTtl string
Sets a new TTL for a packet.
nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string
Interface the packet is leaving the router.
outInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string
Matches packets of specified size or size range in bytes.
passthrough boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string
Matches particular IP protocol specified by protocol name or number.
random number
Matches packets randomly with a given probability.
routingMark string
Matches packets marked by mangle facility with particular routing mark.
srcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string
Matches source address of a packet against user-defined address list.
srcAddressType string
Matches source address type.
srcMacAddress string
Matches source MAC address of the packet.
srcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string
Matches specified TCP flags.
tcpMss string
Matches TCP MSS value of an IP packet.
time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string
Matches packets TTL value.
action This property is required. str
Action to take if a packet is matched by the rule.
chain This property is required. str
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ float
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
address_list str
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment str
connection_bytes str
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str
Can match connections that are srcnatted, dstnatted or both.
connection_rate str
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str
Interprets the connection tracking analysis data for a particular packet.
connection_type str
Matches packets from related connections based on information from their connection tracking helpers.
content str
Match packets that contain specified text.
disabled bool
dscp float
Matches DSCP IP header field.
dst_address str
Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str
Matches destination address of a packet against user-defined address list.
dst_address_type str
Matches destination address type.
dst_limit str
Matches packets until a given rate is exceeded.
dst_port str
List of destination port numbers or port number ranges.
icmp_options str
Matches ICMP type: code fields.
in_bridge_port str
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str
Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str
Interface the packet has entered the router.
in_interface_list str
Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsec_policy str
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_mangle_id str
limit str
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool
Add a message to the system log.
log_prefix str
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str
Sets a new connection-mark value.
new_dscp float
Sets a new DSCP value for a packet.
new_mss str
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str
Sets a new packet-mark value.
new_priority str
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str
Sets a new routing-mark value.
new_ttl str
Sets a new TTL for a packet.
nth str
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str
Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str
Interface the packet is leaving the router.
out_interface_list str
Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str
Matches packets of specified size or size range in bytes.
passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str
Matches particular IP protocol specified by protocol name or number.
random float
Matches packets randomly with a given probability.
routing_mark str
Matches packets marked by mangle facility with particular routing mark.
src_address str
Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str
Matches source address of a packet against user-defined address list.
src_address_type str
Matches source address type.
src_mac_address str
Matches source MAC address of the packet.
src_port str
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str
Matches specified TCP flags.
tcp_mss str
Matches TCP MSS value of an IP packet.
time str
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str
Matches packets TTL value.
action This property is required. String
Action to take if a packet is matched by the rule.
chain This property is required. String
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
___id_ Number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
addressList String
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
comment String
connectionBytes String
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String
Can match connections that are srcnatted, dstnatted or both.
connectionRate String
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String
Interprets the connection tracking analysis data for a particular packet.
connectionType String
Matches packets from related connections based on information from their connection tracking helpers.
content String
Match packets that contain specified text.
disabled Boolean
dscp Number
Matches DSCP IP header field.
dstAddress String
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String
Matches destination address of a packet against user-defined address list.
dstAddressType String
Matches destination address type.
dstLimit String
Matches packets until a given rate is exceeded.
dstPort String
List of destination port numbers or port number ranges.
icmpOptions String
Matches ICMP type: code fields.
inBridgePort String
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String
Interface the packet has entered the router.
inInterfaceList String
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
ipsecPolicy String
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean
Add a message to the system log.
logPrefix String
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String
Sets a new connection-mark value.
newDscp Number
Sets a new DSCP value for a packet.
newMss String
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String
Sets a new packet-mark value.
newPriority String
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String
Sets a new routing-mark value.
newTtl String
Sets a new TTL for a packet.
nth String
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String
Interface the packet is leaving the router.
outInterfaceList String
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String
Matches packets of specified size or size range in bytes.
passthrough Boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String
Matches particular IP protocol specified by protocol name or number.
random Number
Matches packets randomly with a given probability.
routingMark String
Matches packets marked by mangle facility with particular routing mark.
srcAddress String
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String
Matches source address of a packet against user-defined address list.
srcAddressType String
Matches source address type.
srcMacAddress String
Matches source MAC address of the packet.
srcPort String
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String
Matches specified TCP flags.
tcpMss String
Matches TCP MSS value of an IP packet.
time String
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String
Matches packets TTL value.

Outputs

All input properties are implicitly available as output properties. Additionally, the Ipv6FirewallMangle resource produces the following output properties:

Dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string
The provider-assigned unique ID for this managed resource.
Invalid bool
Dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
Id string
The provider-assigned unique ID for this managed resource.
Invalid bool
dynamic Boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String
The provider-assigned unique ID for this managed resource.
invalid Boolean
dynamic boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id string
The provider-assigned unique ID for this managed resource.
invalid boolean
dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id str
The provider-assigned unique ID for this managed resource.
invalid bool
dynamic Boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
id String
The provider-assigned unique ID for this managed resource.
invalid Boolean

Look up Existing Ipv6FirewallMangle Resource

Get an existing Ipv6FirewallMangle resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: Ipv6FirewallMangleState, opts?: CustomResourceOptions): Ipv6FirewallMangle
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        ___skip_: Optional[str] = None,
        ___unset_: Optional[str] = None,
        action: Optional[str] = None,
        address_list: Optional[str] = None,
        address_list_timeout: Optional[str] = None,
        chain: Optional[str] = None,
        comment: Optional[str] = None,
        connection_bytes: Optional[str] = None,
        connection_limit: Optional[str] = None,
        connection_mark: Optional[str] = None,
        connection_nat_state: Optional[str] = None,
        connection_rate: Optional[str] = None,
        connection_state: Optional[str] = None,
        connection_type: Optional[str] = None,
        content: Optional[str] = None,
        disabled: Optional[bool] = None,
        dscp: Optional[float] = None,
        dst_address: Optional[str] = None,
        dst_address_list: Optional[str] = None,
        dst_address_type: Optional[str] = None,
        dst_limit: Optional[str] = None,
        dst_port: Optional[str] = None,
        dynamic: Optional[bool] = None,
        icmp_options: Optional[str] = None,
        in_bridge_port: Optional[str] = None,
        in_bridge_port_list: Optional[str] = None,
        in_interface: Optional[str] = None,
        in_interface_list: Optional[str] = None,
        ingress_priority: Optional[float] = None,
        invalid: Optional[bool] = None,
        ipsec_policy: Optional[str] = None,
        ipv6_firewall_mangle_id: Optional[str] = None,
        limit: Optional[str] = None,
        log: Optional[bool] = None,
        log_prefix: Optional[str] = None,
        new_connection_mark: Optional[str] = None,
        new_dscp: Optional[float] = None,
        new_mss: Optional[str] = None,
        new_packet_mark: Optional[str] = None,
        new_priority: Optional[str] = None,
        new_routing_mark: Optional[str] = None,
        new_ttl: Optional[str] = None,
        nth: Optional[str] = None,
        out_bridge_port: Optional[str] = None,
        out_bridge_port_list: Optional[str] = None,
        out_interface: Optional[str] = None,
        out_interface_list: Optional[str] = None,
        packet_mark: Optional[str] = None,
        packet_size: Optional[str] = None,
        passthrough: Optional[bool] = None,
        per_connection_classifier: Optional[str] = None,
        place_before: Optional[str] = None,
        port: Optional[str] = None,
        priority: Optional[float] = None,
        protocol: Optional[str] = None,
        random: Optional[float] = None,
        routing_mark: Optional[str] = None,
        src_address: Optional[str] = None,
        src_address_list: Optional[str] = None,
        src_address_type: Optional[str] = None,
        src_mac_address: Optional[str] = None,
        src_port: Optional[str] = None,
        tcp_flags: Optional[str] = None,
        tcp_mss: Optional[str] = None,
        time: Optional[str] = None,
        tls_host: Optional[str] = None,
        ttl: Optional[str] = None) -> Ipv6FirewallMangle
func GetIpv6FirewallMangle(ctx *Context, name string, id IDInput, state *Ipv6FirewallMangleState, opts ...ResourceOption) (*Ipv6FirewallMangle, error)
public static Ipv6FirewallMangle Get(string name, Input<string> id, Ipv6FirewallMangleState? state, CustomResourceOptions? opts = null)
public static Ipv6FirewallMangle get(String name, Output<String> id, Ipv6FirewallMangleState state, CustomResourceOptions options)
resources:  _:    type: routeros:Ipv6FirewallMangle    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Action string
Action to take if a packet is matched by the rule.
AddressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string
Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string
Interprets the connection tracking analysis data for a particular packet.
ConnectionType string
Matches packets from related connections based on information from their connection tracking helpers.
Content string
Match packets that contain specified text.
Disabled bool
Dscp double
Matches DSCP IP header field.
DstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string
Matches destination address of a packet against user-defined address list.
DstAddressType string
Matches destination address type.
DstLimit string
Matches packets until a given rate is exceeded.
DstPort string
List of destination port numbers or port number ranges.
Dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
IcmpOptions string
Matches ICMP type: code fields.
InBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string
Interface the packet has entered the router.
InInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority double
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool
Add a message to the system log.
LogPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string
Sets a new connection-mark value.
NewDscp double
Sets a new DSCP value for a packet.
NewMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string
Sets a new packet-mark value.
NewPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string
Sets a new routing-mark value.
NewTtl string
Sets a new TTL for a packet.
Nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string
Interface the packet is leaving the router.
OutInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string
Matches packets of specified size or size range in bytes.
Passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority double
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string
Matches particular IP protocol specified by protocol name or number.
Random double
Matches packets randomly with a given probability.
RoutingMark string
Matches packets marked by mangle facility with particular routing mark.
SrcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string
Matches source address of a packet against user-defined address list.
SrcAddressType string
Matches source address type.
SrcMacAddress string
Matches source MAC address of the packet.
SrcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string
Matches specified TCP flags.
TcpMss string
Matches TCP MSS value of an IP packet.
Time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string
Matches packets TTL value.
___id_ double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
Action string
Action to take if a packet is matched by the rule.
AddressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
AddressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
Chain string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
Comment string
ConnectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
ConnectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
ConnectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
ConnectionNatState string
Can match connections that are srcnatted, dstnatted or both.
ConnectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
ConnectionState string
Interprets the connection tracking analysis data for a particular packet.
ConnectionType string
Matches packets from related connections based on information from their connection tracking helpers.
Content string
Match packets that contain specified text.
Disabled bool
Dscp float64
Matches DSCP IP header field.
DstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
DstAddressList string
Matches destination address of a packet against user-defined address list.
DstAddressType string
Matches destination address type.
DstLimit string
Matches packets until a given rate is exceeded.
DstPort string
List of destination port numbers or port number ranges.
Dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
IcmpOptions string
Matches ICMP type: code fields.
InBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
InBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
InInterface string
Interface the packet has entered the router.
InInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
IngressPriority float64
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
Invalid bool
IpsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
Ipv6FirewallMangleId string
Limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
Log bool
Add a message to the system log.
LogPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
NewConnectionMark string
Sets a new connection-mark value.
NewDscp float64
Sets a new DSCP value for a packet.
NewMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
NewPacketMark string
Sets a new packet-mark value.
NewPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
NewRoutingMark string
Sets a new routing-mark value.
NewTtl string
Sets a new TTL for a packet.
Nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
OutBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
OutBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
OutInterface string
Interface the packet is leaving the router.
OutInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
PacketMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
PacketSize string
Matches packets of specified size or size range in bytes.
Passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
PerConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
PlaceBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
Port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
Priority float64
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
Protocol string
Matches particular IP protocol specified by protocol name or number.
Random float64
Matches packets randomly with a given probability.
RoutingMark string
Matches packets marked by mangle facility with particular routing mark.
SrcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
SrcAddressList string
Matches source address of a packet against user-defined address list.
SrcAddressType string
Matches source address type.
SrcMacAddress string
Matches source MAC address of the packet.
SrcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
TcpFlags string
Matches specified TCP flags.
TcpMss string
Matches TCP MSS value of an IP packet.
Time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
TlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
Ttl string
Matches packets TTL value.
___id_ float64
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
___id_ Double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String
Action to take if a packet is matched by the rule.
addressList String
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String
Can match connections that are srcnatted, dstnatted or both.
connectionRate String
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String
Interprets the connection tracking analysis data for a particular packet.
connectionType String
Matches packets from related connections based on information from their connection tracking helpers.
content String
Match packets that contain specified text.
disabled Boolean
dscp Double
Matches DSCP IP header field.
dstAddress String
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String
Matches destination address of a packet against user-defined address list.
dstAddressType String
Matches destination address type.
dstLimit String
Matches packets until a given rate is exceeded.
dstPort String
List of destination port numbers or port number ranges.
dynamic Boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions String
Matches ICMP type: code fields.
inBridgePort String
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String
Interface the packet has entered the router.
inInterfaceList String
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Double
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean
Add a message to the system log.
logPrefix String
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String
Sets a new connection-mark value.
newDscp Double
Sets a new DSCP value for a packet.
newMss String
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String
Sets a new packet-mark value.
newPriority String
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String
Sets a new routing-mark value.
newTtl String
Sets a new TTL for a packet.
nth String
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String
Interface the packet is leaving the router.
outInterfaceList String
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String
Matches packets of specified size or size range in bytes.
passthrough Boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Double
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String
Matches particular IP protocol specified by protocol name or number.
random Double
Matches packets randomly with a given probability.
routingMark String
Matches packets marked by mangle facility with particular routing mark.
srcAddress String
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String
Matches source address of a packet against user-defined address list.
srcAddressType String
Matches source address type.
srcMacAddress String
Matches source MAC address of the packet.
srcPort String
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String
Matches specified TCP flags.
tcpMss String
Matches TCP MSS value of an IP packet.
time String
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String
Matches packets TTL value.
___id_ number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ string
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ string
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action string
Action to take if a packet is matched by the rule.
addressList string
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout string
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain string
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment string
connectionBytes string
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit string
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark string
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState string
Can match connections that are srcnatted, dstnatted or both.
connectionRate string
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState string
Interprets the connection tracking analysis data for a particular packet.
connectionType string
Matches packets from related connections based on information from their connection tracking helpers.
content string
Match packets that contain specified text.
disabled boolean
dscp number
Matches DSCP IP header field.
dstAddress string
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList string
Matches destination address of a packet against user-defined address list.
dstAddressType string
Matches destination address type.
dstLimit string
Matches packets until a given rate is exceeded.
dstPort string
List of destination port numbers or port number ranges.
dynamic boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions string
Matches ICMP type: code fields.
inBridgePort string
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList string
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface string
Interface the packet has entered the router.
inInterfaceList string
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority number
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid boolean
ipsecPolicy string
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId string
limit string
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log boolean
Add a message to the system log.
logPrefix string
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark string
Sets a new connection-mark value.
newDscp number
Sets a new DSCP value for a packet.
newMss string
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark string
Sets a new packet-mark value.
newPriority string
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark string
Sets a new routing-mark value.
newTtl string
Sets a new TTL for a packet.
nth string
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort string
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList string
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface string
Interface the packet is leaving the router.
outInterfaceList string
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark string
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize string
Matches packets of specified size or size range in bytes.
passthrough boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier string
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore string
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port string
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority number
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol string
Matches particular IP protocol specified by protocol name or number.
random number
Matches packets randomly with a given probability.
routingMark string
Matches packets marked by mangle facility with particular routing mark.
srcAddress string
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList string
Matches source address of a packet against user-defined address list.
srcAddressType string
Matches source address type.
srcMacAddress string
Matches source MAC address of the packet.
srcPort string
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags string
Matches specified TCP flags.
tcpMss string
Matches TCP MSS value of an IP packet.
time string
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost string
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl string
Matches packets TTL value.
___id_ float
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ str
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ str
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action str
Action to take if a packet is matched by the rule.
address_list str
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
address_list_timeout str
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain str
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment str
connection_bytes str
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connection_limit str
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connection_mark str
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connection_nat_state str
Can match connections that are srcnatted, dstnatted or both.
connection_rate str
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connection_state str
Interprets the connection tracking analysis data for a particular packet.
connection_type str
Matches packets from related connections based on information from their connection tracking helpers.
content str
Match packets that contain specified text.
disabled bool
dscp float
Matches DSCP IP header field.
dst_address str
Matches packets which destination is equal to specified IP or falls into specified IP range.
dst_address_list str
Matches destination address of a packet against user-defined address list.
dst_address_type str
Matches destination address type.
dst_limit str
Matches packets until a given rate is exceeded.
dst_port str
List of destination port numbers or port number ranges.
dynamic bool
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmp_options str
Matches ICMP type: code fields.
in_bridge_port str
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
in_bridge_port_list str
Set of interfaces defined in interface list. Works the same as in-bridge-port.
in_interface str
Interface the packet has entered the router.
in_interface_list str
Set of interfaces defined in interface list. Works the same as in-interface.
ingress_priority float
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid bool
ipsec_policy str
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6_firewall_mangle_id str
limit str
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log bool
Add a message to the system log.
log_prefix str
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
new_connection_mark str
Sets a new connection-mark value.
new_dscp float
Sets a new DSCP value for a packet.
new_mss str
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
new_packet_mark str
Sets a new packet-mark value.
new_priority str
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
new_routing_mark str
Sets a new routing-mark value.
new_ttl str
Sets a new TTL for a packet.
nth str
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
out_bridge_port str
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
out_bridge_port_list str
Set of interfaces defined in interface list. Works the same as out-bridge-port.
out_interface str
Interface the packet is leaving the router.
out_interface_list str
Set of interfaces defined in interface list. Works the same as out-interface.
packet_mark str
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packet_size str
Matches packets of specified size or size range in bytes.
passthrough bool
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
per_connection_classifier str
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
place_before str
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port str
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority float
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol str
Matches particular IP protocol specified by protocol name or number.
random float
Matches packets randomly with a given probability.
routing_mark str
Matches packets marked by mangle facility with particular routing mark.
src_address str
Matches packets which source is equal to specified IP or falls into a specified IP range.
src_address_list str
Matches source address of a packet against user-defined address list.
src_address_type str
Matches source address type.
src_mac_address str
Matches source MAC address of the packet.
src_port str
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcp_flags str
Matches specified TCP flags.
tcp_mss str
Matches TCP MSS value of an IP packet.
time str
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tls_host str
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl str
Matches packets TTL value.
___id_ Number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___skip_ String
A set of transformations for field names. This is an internal service field, setting a value is not required.
___unset_ String
A set of fields that require setting/unsetting. This is an internal service field, setting a value is not required.
action String
Action to take if a packet is matched by the rule.
addressList String
Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list.
addressListTimeout String
Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions.
chain String
Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment String
connectionBytes String
Matches packets only if a given amount of bytes has been transfered through the particular connection.
connectionLimit String
Matches connections per address or address block after given value is reached. Should be used together with connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
connectionMark String
Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any unmarked connection.
connectionNatState String
Can match connections that are srcnatted, dstnatted or both.
connectionRate String
Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection (0..4294967295).
connectionState String
Interprets the connection tracking analysis data for a particular packet.
connectionType String
Matches packets from related connections based on information from their connection tracking helpers.
content String
Match packets that contain specified text.
disabled Boolean
dscp Number
Matches DSCP IP header field.
dstAddress String
Matches packets which destination is equal to specified IP or falls into specified IP range.
dstAddressList String
Matches destination address of a packet against user-defined address list.
dstAddressType String
Matches destination address type.
dstLimit String
Matches packets until a given rate is exceeded.
dstPort String
List of destination port numbers or port number ranges.
dynamic Boolean
Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified.
icmpOptions String
Matches ICMP type: code fields.
inBridgePort String
Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
inBridgePortList String
Set of interfaces defined in interface list. Works the same as in-bridge-port.
inInterface String
Interface the packet has entered the router.
inInterfaceList String
Set of interfaces defined in interface list. Works the same as in-interface.
ingressPriority Number
Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
invalid Boolean
ipsecPolicy String
Matches the policy used by IPsec. Value is written in the following format: direction, policy.
ipv6FirewallMangleId String
limit String
Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is reached. Parameters are written in the following format: rate[/time],burst:mode.
log Boolean
Add a message to the system log.
logPrefix String
Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
newConnectionMark String
Sets a new connection-mark value.
newDscp Number
Sets a new DSCP value for a packet.
newMss String
Sets a new MSS for a packet. > clamp-to-pmtu feature sets (DF) bit in the IP header to dynamically discover the PMTU of a path. > Host sends all datagrams on that path with the DF bit set until receives ICMP. > Destination Unreachable messages with a code meaning "fragmentation needed and DF set". > Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
newPacketMark String
Sets a new packet-mark value.
newPriority String
Sets a new priority for a packet. This can be the VLAN, WMM, DSCP or MPLS EXP priority. This property can also be used to set an internal priority.
newRoutingMark String
Sets a new routing-mark value.
newTtl String
Sets a new TTL for a packet.
nth String
Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched by the rule
outBridgePort String
Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall is enabled in bridge settings.
outBridgePortList String
Set of interfaces defined in interface list. Works the same as out-bridge-port.
outInterface String
Interface the packet is leaving the router.
outInterfaceList String
Set of interfaces defined in interface list. Works the same as out-interface.
packetMark String
Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any unmarked packet.
packetSize String
Matches packets of specified size or size range in bytes.
passthrough Boolean
Whether to let the packet to pass further (like action passthrough) into the firewall or not (property only valid some actions).
perConnectionClassifier String
PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options in one particular stream.
placeBefore String
Before which position the rule will be inserted. > Please check the effect of this option, as it does not work as you think! > Best way to use in conjunction with a data source. See example.
port String
Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority Number
Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP bit, or from the priority that has been set using the set-priority action.
protocol String
Matches particular IP protocol specified by protocol name or number.
random Number
Matches packets randomly with a given probability.
routingMark String
Matches packets marked by mangle facility with particular routing mark.
srcAddress String
Matches packets which source is equal to specified IP or falls into a specified IP range.
srcAddressList String
Matches source address of a packet against user-defined address list.
srcAddressType String
Matches source address type.
srcMacAddress String
Matches source MAC address of the packet.
srcPort String
List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
tcpFlags String
Matches specified TCP flags.
tcpMss String
Matches TCP MSS value of an IP packet.
time String
Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time and date.
tlsHost String
Allows matching HTTPS traffic based on TLS SNI hostname.
ttl String
Matches packets TTL value.

Import

#The ID can be found via API or the terminal

#The command for the terminal is -> :put [/ipv6/firewall/mangle get [print show-ids]]

$ pulumi import routeros:index/ipv6FirewallMangle:Ipv6FirewallMangle rule "*0"
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
routeros terraform-routeros/terraform-provider-routeros
License
Notes
This Pulumi package is based on the routeros Terraform Provider.