pve_sdn_vnet_firewall_rule_update
Update a SDN vnet firewall rule at a specific position, modifying only the fields you provide, with optional dry-run to preview changes before applying.
Instructions
MUTATION (LIVE/IMMEDIATE): update a vnet firewall rule at position pos. Dry-run by
default — the PLAN shows the rule's current state and the fields changing. RISK_MEDIUM
floor. Synchronous — confirm=True returns {"status": "ok", "result": None}; no task UPID
to poll.
Takes effect on live guest traffic THE INSTANT you confirm — no pve_sdn_apply gate, no pve_sdn_rollback coverage. Positions SHIFT after inserts/deletes — re-list before updating. Only the fields you pass are changed (unless moveto is given — see its own description). UNLIKE the guest/cluster/node firewall family, this endpoint's reads never expose a digest (schema-verified) — the PLAN's captured rule is best-effort identity evidence only, not an optimistic lock; supply digest ONLY if you have one from out-of-band, and confirming with none (the default) is the normal, supported path. No UNDO — revert by updating it back, or remove it with pve_sdn_vnet_firewall_rule_remove.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| log | No | New log level; omit to leave unchanged. | |
| pos | Yes | Rule position (0-based index) to update. | |
| dest | No | New destination address/CIDR/alias; omit to leave unchanged. | |
| vnet | Yes | SDN vnet name. | |
| dport | No | New destination port/range; omit to leave unchanged. | |
| iface | No | New interface name; omit to leave unchanged. | |
| macro | No | New macro name; omit to leave unchanged. | |
| proto | No | New IP protocol; omit to leave unchanged. | |
| sport | No | New source port/range; omit to leave unchanged. | |
| action | No | New rule action; omit to leave unchanged. | |
| digest | No | OPTIONAL optimistic-lock passthrough, forwarded verbatim when given. NEVER required, NEVER derived: this endpoint's reads (rules list / rule get) expose no digest field on this schema at all (schema-verified), so the PLAN cannot supply one — pass a digest only if you obtained one out-of-band. | |
| enable | No | New enabled state; omit to leave unchanged. | |
| moveto | No | Move the rule to this new position instead — PVE IGNORES every other argument in this same call when moveto is given (schema-documented). Do the move and the field edit in two separate calls if you need both. | |
| source | No | New source address/CIDR/alias; omit to leave unchanged. | |
| comment | No | New free-text comment; omit to leave unchanged. | |
| confirm | No | Set True to execute the mutation; False (default) only returns a dry-run PLAN. | |
| fw_type | No | New rule type: in/out/forward/group; omit to leave unchanged. | |
| icmp_type | No | New ICMP type; omit to leave unchanged. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |