> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/tools-cli/subcommands/compute-engine/firewallrule/create.md).

# create

Create a Firewall Rule

## Usage

```
ionosctl compute firewallrule create [flags]
```

## Aliases

For `firewallrule` command:

```
[f fr firewall]
```

For `create` command:

```
[c]
```

## Description

Add a new Firewall Rule to the NIC identified by --datacenter-id / --server-id / --nic-id. Every Firewall Rule belongs to exactly one NIC.

A rule WHITELISTS a slice of traffic: while the NIC's firewall is active, traffic is only allowed if a rule matches it (default-deny). --direction selects INGRESS (traffic entering the NIC) or EGRESS (traffic leaving the NIC); it defaults to INGRESS.

\--protocol determines which other match flags apply:

* TCP / UDP -> --port-range-start and --port-range-end restrict the destination port range. Leave both unset to allow all ports.
* ICMP -> --icmp-type and --icmp-code restrict the ICMP message. Leave unset to allow all types/codes.
* ANY -> matches every protocol; port and ICMP flags do not apply. --source-mac, --source-ip and --destination-ip narrow the match further for any protocol; any of them left unset acts as a wildcard (allow all).

NOTE: --protocol is fixed at creation time. It cannot be changed later (the update command has no --protocol flag); to change protocol you must delete the rule and create a new one.

Use `--wait` (`-w`) to wait for the resource to reach AVAILABLE state.

Required values to run command:

* Data Center Id
* Server Id
* Nic Id
* Protocol

## Options

```
  -u, --api-url string         Override default host URL. Preferred over the config file override 'cloud' and env var 'IONOS_API_URL' (default "https://api.ionos.com")
      --cols strings           Set of columns to be printed on output 
                               Available columns: [FirewallRuleId Name Protocol PortRangeStart PortRangeEnd Direction IPVersion State SourceMac SourceIP DestinationIP IcmpCode IcmpType]
  -c, --config string          Configuration file used for authentication (default "$XDG_CONFIG_HOME/ionosctl/config.yaml")
      --datacenter-id string   The unique Data Center Id (required)
  -D, --depth int              Level of detail for response objects (default 1)
      --destination-ip ip      When the NIC has multiple IPs, match only traffic directed to this IP address of the NIC (must match --ip-version). Leave unset to allow any target IP
  -d, --direction string       Direction of traffic the rule matches: INGRESS (entering the NIC) or EGRESS (leaving the NIC). Defaults to INGRESS (default "INGRESS")
  -F, --filters strings        Limit results to results containing the specified filter:KEY1=VALUE1,KEY2=VALUE2
  -f, --force                  Force command to execute without user input
  -h, --help                   Print usage
      --icmp-code int          Only when --protocol ICMP: match this ICMP code (0-254). Leave unset to allow all codes
      --icmp-type int          Only when --protocol ICMP: match this ICMP type (0-254), e.g. 8 = echo request (ping), 0 = echo reply. Leave unset to allow all types
      --ip-version string      The IP version this rule applies to. If --source-ip/--destination-ip are given it must match their version; if omitted it is deduced from those addresses. With no IPs given the rule only allows the selected version (defaults to IPv4). Can be one of: IPv4, IPv6 (default "IPv4")
      --limit int              Maximum number of items to return per request (default 50)
  -n, --name string            A human-friendly label for the rule. Has no effect on matching; used only to identify the rule in listings (default "Unnamed Rule")
      --nic-id string          The unique NIC Id (required)
      --no-headers             Don't print table headers when table output is used
      --offset int             Number of items to skip before starting to collect the results
      --order-by string        Property to order the results by
  -o, --output string          Desired output format [text|json|api-json] (default "text")
      --port-range-end int     Only when --protocol TCP or UDP: last port of the allowed destination-port range (1-65534, inclusive). Set both --port-range-start and --port-range-end; leave both unset to allow all ports (default 1)
      --port-range-start int   Only when --protocol TCP or UDP: first port of the allowed destination-port range (1-65534, inclusive). Set both --port-range-start and --port-range-end (use the same value for a single port); leave both unset to allow all ports (default 1)
      --protocol string        The IP protocol this rule matches. TCP/UDP also honour --port-range-start/--port-range-end; ICMP also honours --icmp-type/--icmp-code; ANY matches every protocol. Fixed at creation - it cannot be changed by a later update (required)
      --query string           JMESPath query string to filter the output
  -q, --quiet                  Quiet output
      --server-id string       The unique Server Id (required)
      --source-ip ip           Match only traffic originating from this IP address (must match --ip-version). Leave unset to allow any source IP
      --source-mac string      Match only traffic originating from this MAC address. Format: aa:bb:cc:dd:ee:ff. Leave unset to allow any source MAC
  -t, --timeout int            Timeout in seconds for --wait and other wait operations (default 600)
  -v, --verbose count          Increase verbosity level [-v, -vv, -vvv]
  -w, --wait                   Wait for the resource to reach AVAILABLE state after the command completes. No-op for list commands
```

## Examples

```
# Allow inbound SSH (TCP port 22) from any source
ionosctl compute firewallrule create --datacenter-id DATACENTER_ID --server-id SERVER_ID --nic-id NIC_ID --protocol TCP --direction INGRESS --port-range-start 22 --port-range-end 22 --name "Allow SSH"

# Allow inbound ICMP echo-request (ping, type 8) from a single source IP only
ionosctl compute firewallrule create --datacenter-id DATACENTER_ID --server-id SERVER_ID --nic-id NIC_ID --protocol ICMP --direction INGRESS --icmp-type 8 --source-ip 192.0.2.10 --name "Allow ping from admin host"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/tools-cli/subcommands/compute-engine/firewallrule/create.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.