create_firewall_rule
Create a new firewall rule to accept, drop, or reject traffic by protocol, port, and source/destination zone. Applies immediately and persists on the UniFi controller.
Instructions
Create a legacy firewall rule (UniFi Network <9 or traditional API).
Mutating operation: applied immediately and persisted on the controller. For zone-based policies (Network 9+), prefer create_firewall_policy. Review existing rules with get_firewall_rules first.
Args: name: Unique rule name action: Action — "accept", "drop", or "reject" protocol: Protocol — "tcp", "udp", "icmp", "all", or IANA number dst_port: Destination port or range (e.g., "80", "80-443") src_zone: Source zone ID (from get_firewall_policies) dst_zone: Destination zone ID src_port: Source port or range logging: Enable logging for matches enabled: Whether rule is active on creation. Defaults to True. site: Site to operate on. Defaults to "default". device: Optional console name to target a specific console; omit for default.
Returns: Created firewall rule configuration
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Unique rule name | |
| site | No | Site to operate on. Defaults to "default". | default |
| action | Yes | Action — "accept", "drop", or "reject" | |
| device | No | Optional console name to target a specific UniFi device; omit for default. | |
| enabled | No | Whether rule is active on creation. Defaults to True. | |
| logging | No | Enable logging for matches. | |
| dst_port | No | Destination port or range (e.g., '80', '80-443'). | |
| dst_zone | No | Destination zone ID. | |
| protocol | Yes | Protocol — "tcp", "udp", "icmp", "all", or IANA number | |
| src_port | No | Source port or range. | |
| src_zone | No | Source zone ID (from get_firewall_policies). |