pve_sdn_vnet_firewall_rule_add
Add a new SDN vnet firewall rule that takes effect instantly on live guest traffic. Dry-run to preview; confirm to apply. Actions: ACCEPT, DROP, REJECT. Misplaced rules can sever traffic immediately with no undo.
Instructions
MUTATION (LIVE/IMMEDIATE): add a new vnet firewall rule. Dry-run by default — the PLAN shows vnet, type, action, and key address/port fields. RISK_MEDIUM floor (absence of HIGH is NOT a safety signal). Synchronous — confirm=True returns {"status": "ok", "result": None}; no task UPID to poll.
UNLIKE the shipped guest/cluster/node pve_firewall_rule_add (always inserts at position 0), this takes effect on live guest traffic THE INSTANT you confirm — no pve_sdn_apply gate, no pve_sdn_rollback coverage. A misplaced DROP/REJECT can sever traffic for every guest on this vnet immediately. No UNDO — revert by removing it with pve_sdn_vnet_firewall_rule_remove.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| log | No | Log level for this rule, e.g. 'info', 'nolog'. | |
| pos | No | Position to insert at — Smoke-confirm: this endpoint's schema declares 'pos' on CREATE with description text copy-pasted from its PUT sibling; actual create-time effect (insert-at-pos vs. append vs. ignored) is unconfirmed. | |
| dest | No | Destination address/CIDR/alias to match, or None for any. | |
| vnet | Yes | SDN vnet name. | |
| dport | No | Destination port or port range to match, e.g. '22' or '8000:8010'. | |
| iface | No | Network interface name to match. | |
| macro | No | Predefined standard macro name. | |
| proto | No | IP protocol to match, e.g. 'tcp', 'udp', 'icmp'. | |
| sport | No | Source port or port range to match. | |
| action | Yes | Rule action: 'ACCEPT', 'DROP', or 'REJECT'. | |
| digest | No | Optimistic-lock digest — schema-declared on this endpoint's CREATE (a platform inconsistency vs. the shipped guest/cluster/node rule_add, which accepts none); forwarded when given. | |
| enable | No | Whether the rule is active immediately; omit to use PVE's own default (enabled). | |
| source | No | Source address/CIDR/alias to match, or None for any. | |
| comment | No | Free-text comment stored with the rule. | |
| confirm | No | Set True to execute the mutation; False (default) only returns a dry-run PLAN. | |
| fw_type | No | Rule type: 'in', 'out', 'forward', or 'group' (richer than the guest/cluster/node firewall's in/out-only direction). | in |
| icmp_type | No | ICMP type, only valid when proto is icmp/icmpv6/ipv6-icmp. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |