opnsense_search_firewall_rules
Search firewall rules by keyword, IP, or port, returning matches in evaluation order to identify why traffic is blocked or allowed.
Instructions
Search firewall filter rules and return them in evaluation order with their action, interface, source, destination and description.
Rules are evaluated top to bottom and the last match wins unless a rule sets quick. The 'sequence' column reflects ordering, so when diagnosing "why is this traffic blocked", read the matching rules in sequence order rather than assuming the first match applies.
Scope note: this reads the MVC filter model, which is what Firewall -> Rules uses on current OPNsense releases. On older releases some legacy rules may live outside this model and will not appear.
Args: params (SearchRulesInput): Validated input containing: - search (str): Free-text filter (default: "") - enabled_only (bool): Skip disabled rules (default: False) - limit (int): Max records, 1-200 (default: 25) - offset (int): Records to skip (default: 0) - response_format (ResponseFormat): 'markdown' or 'json'
Returns: str: Markdown table, or JSON with this schema: { "total": int, "count": int, "offset": int, "has_more": bool, "next_offset": int|null, "rules": [ { "uuid": str, # pass to opnsense_get_firewall_rule "sequence": str, "enabled": str, "action": str, # "pass", "block", "reject" "interface": str, "direction": str, "ipprotocol": str, "protocol": str, "source_net": str, "source_port": str, "destination_net": str, "destination_port": str, "description": str } ] }
Examples: - Use when: "Which rules mention the IOT VLAN?" -> search="IOT" - Use when: "What blocks port 445?" -> search="445" - Don't use when: You want NAT rules (those live under firewall/source_nat and firewall/d_nat, reachable via opnsense_api_request)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |