Skip to content

Fixed inaccuracies regarding FirewallRulesConfig #844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 8, 2023
Merged

Fixed inaccuracies regarding FirewallRulesConfig #844

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0d8d5ba
Fixed inaccuracies regarding FirewallRulesConfig
bbiggerr Aug 31, 2023
4f6c899
Updated FirewallRuleConfig ip address examples
bbiggerr Aug 31, 2023
b866492
Added ports ICMP and IPENCAP restriction
bbiggerr Aug 31, 2023
23261b6
Added more instructions for updating Firewall rules
bbiggerr Sep 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 38 additions & 24 deletions openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13062,10 +13062,11 @@ paths:
"ports": "22, 80, 443",
"addresses": {
"ipv4": [
"192.0.2.0/24"
"192.0.2.0/24",
"198.51.100.2/32"
],
"ipv6": [
"2001:DB8::/32"
"2001:DB8::/128"
]
},
"action": "ACCEPT",
Expand All @@ -13080,10 +13081,11 @@ paths:
"ports": "49152-65535",
"addresses": {
"ipv4": [
"192.0.2.0/24"
"192.0.2.0/24",
"198.51.100.2/32"
],
"ipv6": [
"2001:DB8::/32"
"2001:DB8::/128"
]
},
"action": "ACCEPT",
Expand All @@ -13109,8 +13111,8 @@ paths:
--label example-firewall \
--rules.outbound_policy ACCEPT \
--rules.inbound_policy DROP \
--rules.inbound '[{"protocol": "TCP", "ports": "22, 80, 8080, 443", "addresses": {"ipv4": ["192.0.2.1", "192.0.2.0/24"], "ipv6": ["2001:DB8::/32"]}, "action": "ACCEPT"}]' \
--rules.outbound '[{"protocol": "TCP", "ports": "49152-65535", "addresses": {"ipv4": ["192.0.2.0/24"],"ipv6": ["2001:DB8::/32"]}, "action": "DROP", "label": "outbound-rule123", "description": "An example outbound rule description."}]'
--rules.inbound '[{"protocol": "TCP", "ports": "22, 80, 8080, 443", "addresses": {"ipv4": ["192.0.2.0/24", "198.51.100.2/32"], "ipv6": ["2001:DB8::/128"]}, "action": "ACCEPT"}]' \
--rules.outbound '[{"protocol": "TCP", "ports": "49152-65535", "addresses": {"ipv4": ["192.0.2.0/24", "198.51.100.2/32"],"ipv6": ["2001:DB8::/128"]}, "action": "DROP", "label": "outbound-rule123", "description": "An example outbound rule description."}]'
/networking/firewalls/{firewallId}:
parameters:
- name: firewallId
Expand Down Expand Up @@ -13534,7 +13536,7 @@ paths:
description: |
Updates the inbound and outbound Rules for a Firewall.

**Note:** This command replaces all of a Firewall's `inbound` and/or `outbound` rulesets with the values specified in your request.
**Note:** This command replaces all of a Firewall's `inbound` and `outbound` rulesets with the values specified in your request.
operationId: updateFirewallRules
x-linode-cli-action: rules-update
security:
Expand Down Expand Up @@ -13581,10 +13583,11 @@ paths:
"ports": "22, 80, 443",
"addresses": {
"ipv4": [
"192.0.2.0/24"
"192.0.2.0/24",
"198.51.100.2/32"
],
"ipv6": [
"2001:DB8::/32"
"2001:DB8::/128"
]
},
"action": "ACCEPT",
Expand All @@ -13599,10 +13602,11 @@ paths:
"ports": "49152-65535",
"addresses": {
"ipv4": [
"192.0.2.0/24"
"192.0.2.0/24",
"198.51.100.2/32"
],
"ipv6": [
"2001:DB8::/32"
"2001:DB8::/128"
]
},
"action": "ACCEPT",
Expand All @@ -13615,8 +13619,8 @@ paths:
- lang: CLI
source: >
linode-cli firewalls rules-update 123 \
--inbound '[{"action":"ACCEPT", "protocol": "TCP", "ports": "22, 80, 8080, 443", "addresses": {"ipv4": ["192.0.2.1/32", "192.0.2.0/24"], "ipv6": ["2001:DB8::/32"]}}]' \
--outbound '[{"action":"DROP","protocol": "TCP", "ports": "49152-65535", "addresses": {"ipv4": ["192.0.2.1/32", "192.0.2.0/24"], "ipv6": ["2001:DB8::/32"]}}]'
--inbound '[{"action":"ACCEPT", "protocol": "TCP", "ports": "22, 80, 8080, 443", "addresses": {"ipv4": ["192.0.2.0/24", "198.51.100.2/32"], "ipv6": ["2001:DB8::/128"]}}]' \
--outbound '[{"action":"DROP","protocol": "TCP", "ports": "49152-65535", "addresses": {"ipv4": ["192.0.2.0/24", "198.51.100.2/32"], "ipv6": ["2001:DB8::/128`"]}}]'
/networking/vlans:
x-linode-cli-command: vlans
get:
Expand Down Expand Up @@ -20942,6 +20946,8 @@ components:
The inbound and outbound access rules to apply to the Firewall.

A Firewall may have up to 25 rules across its inbound and outbound rulesets.

Multiple rules are applied in order. If two rules conflict, the first rule takes precedence. For example, if the first rule accepts inbound traffic from an address, and the second rule drops inbound traffic the same address, the first rule applies and inbound traffic from that address is accepted.
properties:
inbound:
type: array
Expand Down Expand Up @@ -20998,41 +21004,49 @@ components:
- ICMP
- IPENCAP
description: >
The type of network traffic to allow.
The type of network traffic affected by this rule.
example: TCP
ports:
type: string
nullable: true
description: |
A string representing the port or ports on which traffic will be allowed:
A string representing the port or ports affected by this rule:

- The string may be a single port, a range of ports, or a comma-separated list of single ports and port ranges. A space is permitted following each comma.
- A range of ports is inclusive of the start and end values for the range. The end value of the range must be greater than the start value.
- Ports must be within 1 and 65535, and may not contain any leading zeroes. For example, port "080" is not allowed.
- Ports may not be specified if a rule's protocol is `ICMP` or `IPENCAP`.
- At least one port must be specified if a rule's protocol is `TCP` or `UDP`.
- The ports string can have up to 15 *pieces*, where a single port is treated as one piece, and a port range is treated as two pieces. For example, the string "22-24, 80, 443" has four pieces.
- If no ports are configured, all ports are affected.
- Only allowed for the TCP and UDP protocols. Ports are not allowed for the ICMP and IPENCAP protocols.
example: '22-24, 80, 443'
addresses:
type: object
description: >
Allowed IPv4 or IPv6 addresses. A Rule can have up to 255 addresses
or networks listed across its IPv4 and IPv6 arrays. A network and a single IP
are treated as equivalent when accounting for this limit.
description: |
The IPv4 and/or IPv6 addresses affected by this rule. A Rule can have up to 255 total addresses or networks listed across its IPv4 and IPv6 arrays. A network and a single IP are treated as equivalent when accounting for this limit.

Must contain `ipv4`, `ipv6`, or both.
properties:
ipv4:
description: A list of IPv4 addresses or networks. Must be in IP/mask format.
description: |
A list of IPv4 addresses or networks. Addresses must be in IP/mask format. Must not be an empty list.

If "0.0.0.0/0" is included in this list, all IPv4 addresses are affected by this rule.
type: array
items:
type: string
example:
- 192.0.2.0/24
- 198.51.100.2/32
ipv6:
description: A list of IPv6 addresses or networks. Must be in IP/mask format.
description: |
A list of IPv6 addresses or networks. Addresses must be in IP/mask format. Must not be an empty list.

If "::/0" is included in this list, all IPv6 addresses are affected by this rule.
type: array
items:
type: string
example:
- 2001:DB8::/32
- 2001:DB8::/128
action:
type: string
enum:
Expand Down