pve_sdn_vnet_firewall_options_set
Set firewall options for a Proxmox SDN vnet with immediate effect. Dry-run by default to review potential impact before confirming changes.
Instructions
MUTATION (LIVE/IMMEDIATE): set vnet firewall options. Dry-run by default — the PLAN shows current values and a DIRECTION-AWARE blast-radius warning. RISK_HIGH when enable or policy_forward changes, else MEDIUM. Synchronous — confirm=True returns {"status": "ok", "result": None}; no task UPID to poll.
The HIGH-risk warning is derived from the actual values being set: tightening (enable= True, policy_forward=DROP) warns this can immediately CUT forwarded traffic; loosening (enable=False, delete=["enable"], policy_forward=ACCEPT) warns this immediately REMOVES firewall protection instead — the two are never conflated. An unrecognized/conflicting combination gets a combined warning covering both directions rather than guessing.
UNLIKE the staged zone/vnet/subnet SDN objects, this takes effect on live guest traffic THE INSTANT you confirm — there is no pve_sdn_apply gate and no pve_sdn_rollback coverage for this family. Requires at least one of options/delete. No UNDO — revert by setting the prior values back.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| vnet | Yes | SDN vnet name. | |
| delete | No | List of option keys to unset. | |
| digest | No | Optimistic-lock digest forwarded to PVE to abort if the options changed since a prior read. | |
| confirm | No | Set True to execute the mutation; False (default) only returns a dry-run PLAN. | |
| options | No | Key-value bag of options to set: enable (bool), log_level_forward, policy_forward (ACCEPT/DROP). | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |