Firewall API

Creates a firewall policy and requests realization on its selected attachments.

Supply name, optional inbound_rules, optional outbound_rules, and one attachment definition. Omitted inbound rules default to an empty allowlist; omitted outbound rules default to permit-all outbound traffic. Explicit empty outbound rules deny new outbound traffic. null is invalid for either list.

To permit inbound TCP on port 8080 from one load balancer, send:

{
  "name": "web-backend",
  "inbound_rules": [
    {
      "protocol": "tcp",
      "ports": { "start": 8080, "end": 8080 },
      "peer": { "load_balancer_id": "lb_public" }
    }
  ],
  "attachments": { "selector": { "service": "web" } }
}

Rule protocols are tcp, udp, icmp, icmpv6, or any. TCP and UDP require inclusive port bounds 1–65535. Other protocols reject a port field. A peer contains exactly one permitted CIDR or supported resource selector.

Returns 202 with policy ID and realization operation. Invalid peers or ranges return 422 invalid_rule with the rule index and field path.

Returns desired and applied policy revisions for each interface.

Requires networks:read and reports each interface's desired and applied revisions. A newly matching droplet can appear before its node applies the rule set.

Replaces the supplied rule sets or attachment definition.

Requires If-Match. Rule arrays replace the whole direction's rules; omission preserves that direction. The attachment object also replaces its complete definition. Review a selector change before application.

Multiple attached policies combine allow rules. A restrictive policy cannot cancel another policy's broad allow rule. Existing tracked connections can remain after new-connection rules change; application session revocation is separate.

Deletes a firewall policy after its attachments are removed.

Deletion requires the policy ETag and no attachments. Otherwise the API returns 409 firewall_in_use. Detaching a policy can change exposure according to the remaining policies and region baseline.

Returns effective combined rules and their source policy IDs.

Inspect the resolved combined rules with source policy IDs. Check applied revisions before treating a sensitive withdrawal as complete. See firewalls and Network interface API.