> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cli-ionosctl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cli-ionosctl/subcommands/compute-engine/firewallrule/create.md). # create Create a Firewall Rule ## Usage ``` ionosctl compute firewallrule create [flags] ``` ## Aliases For `firewallrule` command: ``` [f fr firewall] ``` For `create` command: ``` [c] ``` ## Description Add a new Firewall Rule to the NIC identified by --datacenter-id / --server-id / --nic-id. Every Firewall Rule belongs to exactly one NIC. A rule WHITELISTS a slice of traffic: while the NIC's firewall is active, traffic is only allowed if a rule matches it (default-deny). --direction selects INGRESS (traffic entering the NIC) or EGRESS (traffic leaving the NIC); it defaults to INGRESS. \--protocol determines which other match flags apply: * TCP / UDP -> --port-range-start and --port-range-end restrict the destination port range. Leave both unset to allow all ports. * ICMP -> --icmp-type and --icmp-code restrict the ICMP message. Leave unset to allow all types/codes. * ANY -> matches every protocol; port and ICMP flags do not apply. --source-mac, --source-ip and --destination-ip narrow the match further for any protocol; any of them left unset acts as a wildcard (allow all). NOTE: --protocol is fixed at creation time. It cannot be changed later (the update command has no --protocol flag); to change protocol you must delete the rule and create a new one. Use `--wait` (`-w`) to wait for the resource to reach AVAILABLE state. Required values to run command: * Data Center Id * Server Id * Nic Id * Protocol ## Options ``` -u, --api-url string Override default host URL. Preferred over the config file override 'cloud' and env var 'IONOS_API_URL' (default "https://api.ionos.com") --cols strings Set of columns to be printed on output Available columns: [FirewallRuleId Name Protocol PortRangeStart PortRangeEnd Direction IPVersion State SourceMac SourceIP DestinationIP IcmpCode IcmpType] -c, --config string Configuration file used for authentication (default "$XDG_CONFIG_HOME/ionosctl/config.yaml") --datacenter-id string The unique Data Center Id (required) -D, --depth int Level of detail for response objects (default 1) --destination-ip ip When the NIC has multiple IPs, match only traffic directed to this IP address of the NIC (must match --ip-version). Leave unset to allow any target IP -d, --direction string Direction of traffic the rule matches: INGRESS (entering the NIC) or EGRESS (leaving the NIC). Defaults to INGRESS (default "INGRESS") -F, --filters strings Limit results to results containing the specified filter:KEY1=VALUE1,KEY2=VALUE2 -f, --force Force command to execute without user input -h, --help Print usage --icmp-code int Only when --protocol ICMP: match this ICMP code (0-254). Leave unset to allow all codes --icmp-type int Only when --protocol ICMP: match this ICMP type (0-254), e.g. 8 = echo request (ping), 0 = echo reply. Leave unset to allow all types --ip-version string The IP version this rule applies to. If --source-ip/--destination-ip are given it must match their version; if omitted it is deduced from those addresses. With no IPs given the rule only allows the selected version (defaults to IPv4). Can be one of: IPv4, IPv6 (default "IPv4") --limit int Maximum number of items to return per request (default 50) -n, --name string A human-friendly label for the rule. Has no effect on matching; used only to identify the rule in listings (default "Unnamed Rule") --nic-id string The unique NIC Id (required) --no-headers Don't print table headers when table output is used --offset int Number of items to skip before starting to collect the results --order-by string Property to order the results by -o, --output string Desired output format [text|json|api-json] (default "text") --port-range-end int Only when --protocol TCP or UDP: last port of the allowed destination-port range (1-65534, inclusive). Set both --port-range-start and --port-range-end; leave both unset to allow all ports (default 1) --port-range-start int Only when --protocol TCP or UDP: first port of the allowed destination-port range (1-65534, inclusive). Set both --port-range-start and --port-range-end (use the same value for a single port); leave both unset to allow all ports (default 1) --protocol string The IP protocol this rule matches. TCP/UDP also honour --port-range-start/--port-range-end; ICMP also honours --icmp-type/--icmp-code; ANY matches every protocol. Fixed at creation - it cannot be changed by a later update (required) --query string JMESPath query string to filter the output -q, --quiet Quiet output --server-id string The unique Server Id (required) --source-ip ip Match only traffic originating from this IP address (must match --ip-version). Leave unset to allow any source IP --source-mac string Match only traffic originating from this MAC address. Format: aa:bb:cc:dd:ee:ff. Leave unset to allow any source MAC -t, --timeout int Timeout in seconds for --wait and other wait operations (default 600) -v, --verbose count Increase verbosity level [-v, -vv, -vvv] -w, --wait Wait for the resource to reach AVAILABLE state after the command completes. No-op for list commands ``` ## Examples ``` # Allow inbound SSH (TCP port 22) from any source ionosctl compute firewallrule create --datacenter-id DATACENTER_ID --server-id SERVER_ID --nic-id NIC_ID --protocol TCP --direction INGRESS --port-range-start 22 --port-range-end 22 --name "Allow SSH" # Allow inbound ICMP echo-request (ping, type 8) from a single source IP only ionosctl compute firewallrule create --datacenter-id DATACENTER_ID --server-id SERVER_ID --nic-id NIC_ID --protocol ICMP --direction INGRESS --icmp-type 8 --source-ip 192.0.2.10 --name "Allow ping from admin host" ```