pve_firewall_rule_update
Update an existing firewall rule at a specified position using optimistic locking for safe concurrent changes. Dry-run previews modifications; pass digest to confirm.
Instructions
MUTATION: update an existing firewall rule at position pos. Dry-run by default — the PLAN
shows the rule's current state, the fields being changed, AND the optimistic-lock digest. Pass the
digest from the plan back as digest= on confirm so PVE rejects the update if the rule list moved
since the preview (positions shift and the wrong rule can be updated otherwise). Synchronous —
confirm=True returns {"status": "ok", "result": None}; no task UPID to poll.
Only the fields you pass are changed; omitted ones keep their current value. No UNDO — revert by updating the rule back to its prior values, or remove it with pve_firewall_rule_remove.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pos | Yes | Rule position (0-based index) in the target scope's rule list. | |
| dest | No | New destination address/CIDR/alias to match; omit to leave unchanged. | |
| kind | No | Guest kind for scope='guest': 'qemu' or 'lxc'. | |
| node | No | Node name, required for scope='node' or scope='guest'. | |
| vmid | No | Guest VMID/CTID, required for scope='guest'. | |
| dport | No | New destination port or port range; omit to leave unchanged. | |
| proto | No | New IP protocol to match, e.g. 'tcp'/'udp'/'icmp'; omit to leave unchanged. | |
| scope | No | Firewall scope: 'cluster', 'node', or 'guest'. | cluster |
| sport | No | New source port or port range; omit to leave unchanged. | |
| action | No | New rule action: 'ACCEPT', 'DROP', or 'REJECT'; omit to leave unchanged. | |
| digest | No | Optimistic-lock digest from the PLAN preview; pass on confirm to abort if the rule list changed since. | |
| enable | No | New enabled state for the rule; omit to leave unchanged. | |
| source | No | New source address/CIDR/alias to match; omit to leave unchanged. | |
| comment | No | New free-text comment; omit to leave unchanged. | |
| confirm | No | Set True to execute the mutation; False (default) only returns a dry-run PLAN. | |
| direction | No | New traffic direction: 'in' or 'out'; omit to leave unchanged. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |