List Firewalla Rules
firewalla_list_rulesAudit and review configured Firewalla network security rules to identify overly permissive settings, stale configurations, and scope mismatches for security optimization.
Instructions
Audit configured block / allow rules. Read-only — this tool does NOT pause, resume, create, or modify rules.
Use this to answer:
"Do I have any allow rules that bypass Firewalla's default blocks?"
"Which rules haven't fired in 90 days (candidates to remove)?"
"Are my block rules scoped to the right device/group?"
"Any rules with action=allow and broad scope?"
Args:
query (string, optional): Firewalla query-grammar filter (pass-through). Examples:
action:allow,status:paused,target.type:domain.response_format ('markdown' | 'json'): Output format (default: markdown).
Returns: { count: number, rules: Array<{ id: string, gid: string, action: string, // "block" | "allow" | "time_limit" | … direction?: string, // "outbound" | "inbound" | "bidirection" status?: string, // "active" | "paused" | "disabled" target: { type, value, dnsOnly?, port? }, scope?: { type?, value? }, notes?: string, hit?: { count?, lastHitTs? }, ts?: number, updateTs?: number }> }
Audit framing:
action=allow with scope=global → overly permissive, investigate.
status=paused with no notes → someone disabled a rule and didn't document why.
hit.count=0 & old updateTs → stale rule, candidate for removal.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Firewalla query string (pass-through). See Firewalla docs for the grammar — supports filters like `device.mac:AA:BB:CC:DD:EE:FF`, `blocked:true`, `region:CN`, `ts:>1700000000`, etc. Omit to match everything. | |
| response_format | No | Output format. 'markdown' (default) renders human-readable audit tables. 'json' returns structured data suitable for chaining into another tool call. | markdown |