pve_firewall_rule_add
Add a new firewall rule to Proxmox VE with a dry-run preview to verify scope, direction, action, and address/port fields before execution. Confirm to apply, avoiding accidental lockout.
Instructions
MUTATION: add a new firewall rule. Dry-run by default — the PLAN shows scope, direction, action, and key address/port fields. Re-call with confirm=True to execute. Synchronous — confirm=True returns {"status": "ok", "result": None}; no task UPID to poll.
WARNING: a misplaced DROP/REJECT can cause a connectivity lockout. PVE always inserts the new rule at position 0 (top), taking precedence over existing rules. No UNDO — revert by removing it with pve_firewall_rule_remove.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dest | No | Destination address/CIDR/alias to match, or None for any. | |
| kind | No | Guest kind for scope='guest': 'qemu' or 'lxc'. | |
| node | No | Node name, required for scope='node' or scope='guest'. | |
| vmid | No | Guest VMID/CTID, required for scope='guest'. | |
| dport | No | Destination port or port range to match, e.g. '22' or '8000:8010'. | |
| proto | No | IP protocol to match, e.g. 'tcp', 'udp', 'icmp'. | |
| scope | No | Firewall scope: 'cluster', 'node', or 'guest'. | cluster |
| sport | No | Source port or port range to match, e.g. '22' or '8000:8010'. | |
| action | Yes | Rule action: 'ACCEPT', 'DROP', or 'REJECT'. | |
| enable | No | Whether the rule is active immediately (True) or created disabled (False). | |
| source | No | Source address/CIDR/alias to match, or None for any. | |
| comment | No | Free-text comment stored with the rule. | |
| confirm | No | Set True to execute the mutation; False (default) only returns a dry-run PLAN. | |
| direction | No | Traffic direction the rule matches: 'in' or 'out'. | in |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |