Terraform provider reference / resources / router_firewall_rule

fiberax_router_firewall_rule (Resource)

One access rule of a ROUTER's firewall.

Unlike fiberax_server_firewall, where the whole rule set is one resource, a router rule is a resource of its own: it is addressed by its number on the router (priority), and that number does not shift when a neighbouring rule is deleted. Rules are checked in ascending number order and the first matching rule wins.

Ordering across several rules is expressed with priority. Terraform creates resources in parallel, so rules created without a number get the next free numbers in an arbitrary order. Give each rule a priority when the order matters.

Rules created inside the router by hand are visible too (editable = false, extra non-empty): they can be imported and deleted, but not changed.

The first drop or reject rule also switches the router to stateful filtering (replies to established connections pass); that is a property of the router, not of the rule.

Example Usage

# Access rules of a ROUTER. Each rule is a resource of its own, addressed by its
# number on the router; rules are checked in ascending number order and the
# first matching rule wins.
#
# Give rules a priority when the order matters: Terraform creates resources in
# parallel, and rules without a number get free numbers in an arbitrary order.
resource "fiberax_router_firewall_rule" "ssh_from_office" {
  server_id        = fiberax_server.router.id
  priority         = 2010
  action           = "accept"
  protocol         = "tcp"
  interface        = "eth0" # the public side of the router
  source           = "203.0.113.0/24"
  destination_port = "22"
  description      = "ssh from the office"
}

resource "fiberax_router_firewall_rule" "web" {
  server_id        = fiberax_server.router.id
  priority         = 2020
  action           = "accept"
  protocol         = "tcp"
  interface        = "eth0"
  destination_port = "80,443"
  description      = "web"
}

# The first drop or reject rule also switches the router to stateful filtering,
# so replies to connections allowed above keep passing.
resource "fiberax_router_firewall_rule" "drop_the_rest" {
  server_id   = fiberax_server.router.id
  priority    = 2100
  action      = "drop"
  interface   = "eth0"
  description = "everything else from the internet"
}

Schema

Required

• action (String) accept, drop or reject.
• server_id (Number) The router the rule belongs to. A rule cannot move to another router: changing this field recreates the resource.

Optional

• description (String) A note on the rule, up to 120 characters, without control characters.
• destination (String) IPv4 address or IPv4/prefix the traffic goes to. Not set means any.
• destination_port (String) Destination port, in the same form as source_port. Requires protocol.
• enabled (Boolean) A disabled rule stays on the router and does nothing. Enabled by default.
• interface (String) Router interface the traffic arrives on, in the router's own names: eth0 is the public side, eth1 and up are the private networks (see GET /v1/servers/{id}/router/networks). Not set means any interface. Tunnel interfaces are not accepted.
• priority (Number) Rule number, 2000 to 999000; lower numbers are checked first. Omit it and the platform takes the next free number in steps of ten.

The number cannot be changed on an existing rule, so setting a different one recreates the resource. A number freed by a delete is reused by the next create.

• protocol (String) tcp, udp, tcp_udp or icmp. Not set means any protocol. A port requires tcp, udp or tcp_udp.
• source (String) IPv4 address or IPv4/prefix the traffic comes from. Not set means any.
• source_port (String) Source port AS TEXT: a number, a comma-separated list or a range WITH A DASH (22, 80,443, 10000-20000), up to 200 characters. Requires protocol.

Read-Only

• editable (Boolean) False when the rule carries conditions this API cannot express (extra is non-empty): such a rule was created inside the router by hand and can only be read and deleted.
• extra (List of String) Conditions of the rule outside this API's model, in the router's own words. Empty for rules created through Terraform.
• id (Number) Rule number on the router - the same value as priority.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The import ID is the router's server ID and the rule number, separated by a comma.
terraform import fiberax_router_firewall_rule.ssh_from_office 11102,2010

Generated from the provider schema for version 0.3.0. How to install the provider: Terraform provider.