From a45e2988263f5109a56b6dcb2c46ecbc6738cb3a Mon Sep 17 00:00:00 2001 From: GomathiselviS Date: Thu, 27 Aug 2020 14:58:25 -0400 Subject: Release 1.0.4 (#81) Release 1.0.4 Reviewed-by: https://github.com/apps/ansible-zuul --- docs/vyos.vyos.vyos_firewall_rules_module.rst | 1996 ++++++++++++------------- 1 file changed, 998 insertions(+), 998 deletions(-) (limited to 'docs/vyos.vyos.vyos_firewall_rules_module.rst') diff --git a/docs/vyos.vyos.vyos_firewall_rules_module.rst b/docs/vyos.vyos.vyos_firewall_rules_module.rst index 647f835..15073b1 100644 --- a/docs/vyos.vyos.vyos_firewall_rules_module.rst +++ b/docs/vyos.vyos.vyos_firewall_rules_module.rst @@ -31,1281 +31,1287 @@ Parameters Parameter Choices/Defaults - Comments + Comments - - + +
config
list - / elements=dictionary
- - - - -
A dictionary of Firewall rule-set options.
- - - - - + / elements=dictionary + + + + + +
A dictionary of Firewall rule-set options.
+ + + + +
afi
string - / required
- - - - - -
Specifies the type of rule-set.
- + / required + + + + + + +
Specifies the type of rule-set.
+ - - - + + +
rule_sets
list - / elements=dictionary
- - - - -
The Firewall rule-set list.
- - - - - - + / elements=dictionary + + + + + +
The Firewall rule-set list.
+ + + + + +
default_action
string -
- - - - - -
Default action for rule-set.
-
drop (Drop if no prior rules are hit (default))
-
reject (Drop and notify source if no prior rules are hit)
-
accept (Accept if no prior rules are hit)
- - - - - - + + + + + + +
Default action for rule-set.
+
drop (Drop if no prior rules are hit (default))
+
reject (Drop and notify source if no prior rules are hit)
+
accept (Accept if no prior rules are hit)
+ + + + + +
description
string -
- - - - -
Rule set description.
- + + + + + +
Rule set description.
+ - - - - + + + +
enable_default_log
boolean -
- - - - - -
Option to log packets hitting default-action.
- + + + + + + +
Option to log packets hitting default-action.
+ - - - - + + + +
name
string -
- - - - -
Firewall rule set name.
- + + + + + +
Firewall rule set name.
+ - - - - + + + +
rules
list - / elements=dictionary
- - - - -
A ditionary that specifies the rule-set configurations.
- - - - - - - + / elements=dictionary + + + + + +
A ditionary that specifies the rule-set configurations.
+ + + + + + +
action
string -
- - - - - -
Specifying the action.
- - - - - - - + + + + + + +
Specifying the action.
+ + + + + + +
description
string -
- - - - -
Description of this rule.
- - - - - - - + + + + + +
Description of this rule.
+ + + + + + +
destination
dictionary -
- - - - -
Specifying the destination parameters.
- - - - - - - - + + + + + +
Specifying the destination parameters.
+ + + + + + + +
address
string -
- - - - -
Destination ip address subnet or range.
-
IPv4/6 address, subnet or range to match.
-
Match everything except the specified address, subnet or range.
-
Destination ip address subnet or range.
- - - - - - - - + + + + + +
Destination ip address subnet or range.
+
IPv4/6 address, subnet or range to match.
+
Match everything except the specified address, subnet or range.
+
Destination ip address subnet or range.
+ + + + + + + +
group
dictionary -
- - - - -
Destination group.
- - - - - - - - - + + + + + +
Destination group.
+ + + + + + + + +
address_group
string -
- - - - -
Group of addresses.
- - - - - - - - - + + + + + +
Group of addresses.
+ + + + + + + + +
network_group
string -
- - - - -
Group of networks.
- - - - - - - - - + + + + + +
Group of networks.
+ + + + + + + + +
port_group
string -
- - - - -
Group of ports.
- - - - - - - - - + + + + + +
Group of ports.
+ + + + + + + + +
port
string -
- - - - -
Multiple destination ports can be specified as a comma-separated list.
-
The whole list can also be "negated" using '!'.
-
For example:'!22,telnet,http,123,1001-1005'.
- - - - - - - - + + + + + +
Multiple destination ports can be specified as a comma-separated list.
+
The whole list can also be "negated" using '!'.
+
For example:'!22,telnet,http,123,1001-1005'.
+ + + + + + + +
disabled
boolean -
- - - - - -
Option to disable firewall rule.
- - - - - - - + + + + + + +
Option to disable firewall rule.
+ + + + + + +
fragment
string -
- - - - - -
IP fragment match.
- - - - - - - + + + + + + +
IP fragment match.
+ + + + + + +
icmp
dictionary -
- - - - -
ICMP type and code information.
- - - - - - - - + + + + + +
ICMP type and code information.
+ + + + + + + +
code
integer -
- - - - -
ICMP code.
- - - - - - - - + + + + + +
ICMP code.
+ + + + + + + +
type
integer -
- - - - -
ICMP type.
- - - - - - - - + + + + + +
ICMP type.
+ + + + + + + +
type_name
string -
- - - - - -
ICMP type-name.
- - - - - - - - + + + + + + +
ICMP type-name.
+ + + + + + + +
ipsec
string -
- - - - - -
Inboud ip sec packets.
- - - - - - - + + + + + + +
Inboud ip sec packets.
+ + + + + + +
limit
dictionary -
- - - - -
Rate limit using a token bucket filter.
- - - - - - - - + + + + + +
Rate limit using a token bucket filter.
+ + + + + + + +
burst
integer -
- - - - -
Maximum number of packets to allow in excess of rate.
- - - - - - - - + + + + + +
Maximum number of packets to allow in excess of rate.
+ + + + + + + +
rate
dictionary -
- - - - -
format for rate (integer/time unit).
-
any one of second, minute, hour or day may be used to specify time unit.
-
eg. 1/second implies rule to be matched at an average of once per second.
- - - - - - - - - + + + + + +
format for rate (integer/time unit).
+
any one of second, minute, hour or day may be used to specify time unit.
+
eg. 1/second implies rule to be matched at an average of once per second.
+ + + + + + + + +
number
integer -
- - - - -
This is the integer value.
- - - - - - - - - + + + + + +
This is the integer value.
+ + + + + + + + +
unit
string -
- - - - -
This is the time unit.
- - - - - - - - - + + + + + +
This is the time unit.
+ + + + + + + + +
number
integer - / required
- - - - -
Rule number.
- - - - - - - + / required + + + + + +
Rule number.
+ + + + + + +
p2p
list - / elements=dictionary
- - - - -
P2P application packets.
- - - - - - - - + / elements=dictionary + + + + + +
P2P application packets.
+ + + + + + + +
application
string -
- - - - - -
Name of the application.
- - - - - - - - + + + + + + +
Name of the application.
+ + + + + + + +
protocol
string -
- - - - -
Protocol to match (protocol name in /etc/protocols or protocol number or all).
-
<text> IP protocol name from /etc/protocols (e.g. "tcp" or "udp").
-
<0-255> IP protocol number.
-
tcp_udp Both TCP and UDP.
-
all All IP protocols.
-
(!)All IP protocols except for the specified name or number.
- - - - - - - + + + + + +
Protocol to match (protocol name in /etc/protocols or protocol number or all).
+
<text> IP protocol name from /etc/protocols (e.g. "tcp" or "udp").
+
<0-255> IP protocol number.
+
tcp_udp Both TCP and UDP.
+
all All IP protocols.
+
(!)All IP protocols except for the specified name or number.
+ + + + + + +
recent
dictionary -
- - - - -
Parameters for matching recently seen sources.
- - - - - - - - + + + + + +
Parameters for matching recently seen sources.
+ + + + + + + +
count
integer -
- - - - -
Source addresses seen more than N times.
- - - - - - - - + + + + + +
Source addresses seen more than N times.
+ + + + + + + +
time
integer -
- - - - -
Source addresses seen in the last N seconds.
- - - - - - - - + + + + + +
Source addresses seen in the last N seconds.
+ + + + + + + +
source
dictionary -
- - - - -
Source parameters.
- - - - - - - - + + + + + +
Source parameters.
+ + + + + + + +
address
string -
- - - - -
Source ip address subnet or range.
-
IPv4/6 address, subnet or range to match.
-
Match everything except the specified address, subnet or range.
-
Source ip address subnet or range.
- - - - - - - - + + + + + +
Source ip address subnet or range.
+
IPv4/6 address, subnet or range to match.
+
Match everything except the specified address, subnet or range.
+
Source ip address subnet or range.
+ + + + + + + +
group
dictionary -
- - - - -
Source group.
- - - - - - - - - + + + + + +
Source group.
+ + + + + + + + +
address_group
string -
- - - - -
Group of addresses.
- - - - - - - - - + + + + + +
Group of addresses.
+ + + + + + + + +
network_group
string -
- - - - -
Group of networks.
- - - - - - - - - + + + + + +
Group of networks.
+ + + + + + + + +
port_group
string -
- - - - -
Group of ports.
- - - - - - - - - + + + + + +
Group of ports.
+ + + + + + + + +
mac_address
string -
- - - - -
<MAC address> MAC address to match.
-
<!MAC address> Match everything except the specified MAC address.
- - - - - - - - + + + + + +
<MAC address> MAC address to match.
+
<!MAC address> Match everything except the specified MAC address.
+ + + + + + + +
port
string -
- - - - -
Multiple source ports can be specified as a comma-separated list.
-
The whole list can also be "negated" using '!'.
-
For example:'!22,telnet,http,123,1001-1005'.
- - - - - - - - + + + + + +
Multiple source ports can be specified as a comma-separated list.
+
The whole list can also be "negated" using '!'.
+
For example:'!22,telnet,http,123,1001-1005'.
+ + + + + + + +
state
dictionary -
- - - - -
Session state.
- - - - - - - - + + + + + +
Session state.
+ + + + + + + +
established
boolean -
- - - - - -
Established state.
- - - - - - - - + + + + + + +
Established state.
+ + + + + + + +
invalid
boolean -
- - - - - -
Invalid state.
- - - - - - - - + + + + + + +
Invalid state.
+ + + + + + + +
new
boolean -
- - - - - -
New state.
- - - - - - - - + + + + + + +
New state.
+ + + + + + + +
related
boolean -
- - - - - -
Related state.
- - - - - - - - + + + + + + +
Related state.
+ + + + + + + +
tcp
dictionary -
- - - - -
TCP flags to match.
- - - - - - - - + + + + + +
TCP flags to match.
+ + + + + + + +
flags
string -
- - - - -
TCP flags to be matched.
- - - - - - - - + + + + + +
TCP flags to be matched.
+ + + + + + + +
time
dictionary -
- - - - -
Time to match rule.
- - - - - - - - + + + + + +
Time to match rule.
+ + + + + + + +
monthdays
string -
- - - - -
Monthdays to match rule on.
- - - - - - - - + + + + + +
Monthdays to match rule on.
+ + + + + + + +
startdate
string -
- - - - -
Date to start matching rule.
- - - - - - - - + + + + + +
Date to start matching rule.
+ + + + + + + +
starttime
string -
- - - - -
Time of day to start matching rule.
- - - - - - - - + + + + + +
Time of day to start matching rule.
+ + + + + + + +
stopdate
string -
- - - - -
Date to stop matching rule.
- - - - - - - - + + + + + +
Date to stop matching rule.
+ + + + + + + +
stoptime
string -
- - - - -
Time of day to stop matching rule.
- - - - - - - - + + + + + +
Time of day to stop matching rule.
+ + + + + + + +
utc
boolean -
- - - - - -
Interpret times for startdate, stopdate, starttime and stoptime to be UTC.
- - - - - - - - + + + + + + +
Interpret times for startdate, stopdate, starttime and stoptime to be UTC.
+ + + + + + + +
weekdays
string -
- - - - -
Weekdays to match rule on.
- - - - - - - - + + + + + +
Weekdays to match rule on.
+ + + + + + + +
running_config
string -
- - - - -
This option is used only with state parsed.
-
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | grep firewall.
-
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
- + + + + + +
This option is used only with state parsed.
+
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | grep firewall.
+
The state parsed reads the configuration from running_config option and transforms it into Ansible structured data as per the resource module's argspec and the value is then returned in the parsed key within the result.
+ - - + +
state
string -
- - - - - -
The state the configuration should be left in
- - - + + + + + + +
The state the configuration should be left in
+ + +
@@ -1323,7 +1329,6 @@ Examples .. code-block:: yaml+jinja - # Using deleted to delete firewall rules based on rule-set name # # Before state @@ -2356,9 +2361,6 @@ Examples - - - Return Values ------------- Common return values are documented `here `_, the following are the fields unique to this module: @@ -2371,60 +2373,60 @@ Common return values are documented `here Returned Description - - + +
after
list -
- + + when changed -
The resulting configuration model invocation.
-
-
Sample:
-
The configuration returned will always be in the same format +
The resulting configuration model invocation.
+
+
Sample:
+
The configuration returned will always be in the same format of the parameters above.
- + - - + +
before
list -
- +
+ always -
The configuration prior to the model invocation.
-
-
Sample:
-
The configuration returned will always be in the same format +
The configuration prior to the model invocation.
+
+
Sample:
+
The configuration returned will always be in the same format of the parameters above.
- + - - + +
commands
list -
- +
+ always -
The set of commands pushed to the remote device.
-
-
Sample:
-
["set firewall name Downlink default-action 'accept'", "set firewall name Downlink description 'IPv4 INBOUND rule set'", "set firewall name Downlink rule 501 action 'accept'", "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'", "set firewall name Downlink rule 502 ipsec 'match-ipsec'"]
- +
The set of commands pushed to the remote device.
+
+
Sample:
+
["set firewall name Downlink default-action 'accept'", "set firewall name Downlink description 'IPv4 INBOUND rule set'", "set firewall name Downlink rule 501 action 'accept'", "set firewall name Downlink rule 502 description 'Rule 502 is configured by Ansible'", "set firewall name Downlink rule 502 ipsec 'match-ipsec'"]
+ - +

@@ -2436,5 +2438,3 @@ Authors ~~~~~~~ - Rohit Thakur (@rohitthakur2590) - - -- cgit v1.2.3