From 433a274ce636573953f8a4be9c68743a2ed1d0a5 Mon Sep 17 00:00:00 2001
From: omnom62 <75066712+omnom62@users.noreply.github.com>
Date: Thu, 27 Aug 2026 04:00:17 +1000
Subject: T8220: Firewall Zone Policy support (#447)

Add zone base policy firewall module
---
 plugins/modules/vyos_firewall_global.py | 85 +++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

(limited to 'plugins/modules')

diff --git a/plugins/modules/vyos_firewall_global.py b/plugins/modules/vyos_firewall_global.py
index 9abeb5a1..4967a564 100644
--- a/plugins/modules/vyos_firewall_global.py
+++ b/plugins/modules/vyos_firewall_global.py
@@ -280,6 +280,91 @@ options:
             - notice
             - info
             - debug
+      zone:
+        description:
+        - Defines a firewall zone.
+        type: list
+        elements: dict
+        suboptions:
+          name:
+            description:
+            - Name of the firewall zone.
+            type: str
+            required: true
+          description:
+            description:
+            - Allows you to specify a brief description for the firewall zone.
+            type: str
+          default_log:
+            description:
+            - Specifies whether or not to log packets for the firewall zone.
+            type: bool
+          local_zone:
+            description:
+            - Specifies whether or not the zone is local.
+            type: bool
+          default_action:
+            description:
+            - Specifies the default action for the zone.
+            type: str
+            default: drop
+            choices:
+            - drop
+            - reject
+          interfaces:
+            description:
+            - Specifies the interfaces associated with the zone.
+            type: list
+            elements: str
+          intra_zone_filtering:
+            description:
+            - Specifies a policy for intra-zone filtering.
+            type: dict
+            suboptions:
+              action:
+                description:
+                - Action for intra-zone traffic.
+                type: str
+                choices:
+                - accept
+                - drop
+              firewall:
+                description:
+                - Firewall ruleset to apply to intra-zone traffic.
+                type: dict
+                suboptions:
+                  name:
+                    description:
+                    - Name of the firewall ruleset to apply to intra-zone traffic.
+                    type: str
+                  ipv6_name:
+                    description:
+                    - Name of the IPv6 firewall ruleset to apply to intra-zone traffic.
+                    type: str
+          sources:
+            description:
+            - Specifies the source zones for the firewall rules.
+            type: list
+            elements: dict
+            suboptions:
+              zone:
+                description:
+                - Name of the source zone.
+                type: str
+                required: true
+              firewall:
+                description:
+                - Firewall ruleset to apply to the source zone.
+                type: dict
+                suboptions:
+                  name:
+                    description:
+                    - Name of the firewall ruleset to apply to the source zone.
+                    type: str
+                  ipv6_name:
+                    description:
+                    - Name of the IPv6 firewall ruleset to apply to the source zone.
+                    type: str
   running_config:
     description:
     - >
-- 
cgit v1.2.3