Rules
Ordered packet handling rules for routed and locally generated traffic.
Rules are evaluated by priority and then by their match criteria. Use input selectors for traffic arriving from remote hosts, filters for packet attributes, output selectors for forwarding destinations, and modify settings for NAT.
New Flow rule items can be added.
Flow rule
Flow rules defined how network traffic flows through the device.
A rule applies when the packet origin, input, filter, and output selectors all match. Leave selector lists empty when that part of the rule should match any packet.
- Rejection - The response to send on packets rejection.
- Input matches - Flow matches packets on these inputs.
- Filter packets - Packet filter list.
- Output interfaces - Send packets that match the input interfaces and filter rules to these output interfaces and zones.
- Modify packet on output - Make changes to packets on output.
Properties
Enable
Enable this flow rule.
- Data type: boolean
- Default:
true - Configuration
CLI: (cli)> config network flow rule <key> enable
Label
The label used to describe and locate this flow rule.
- Data type: string
- Configuration
- Optional
CLI: (cli)> config network flow rule <key> label
Priority
The priority for this flow rule.
Lower priority values are evaluated before higher values. Use priorities to place specific rules before broader catch-all rules.
- Data type: integer
- Default:
0 - Configuration
- Required
CLI: (cli)> config network flow rule <key> priority
Packet origin
The source or packets this rule applies to.
Remote host rules apply to packets received on an interface. Local service rules apply to packets generated by services running on this device.
| Option | Label | Description |
|---|---|---|
remote | Remote hosts | This flow applies to packets from remote hosts. |
local | Sent by local services | This flow applies to packets from the local host. |
- Data type: string select
- Default:
remote - Configuration
- Required
CLI: (cli)> config network flow rule <key> origin
Action
The action to take on packets matching this flow rule.
Forward allows matching packets to continue toward an output interface. Drop silently discards matching packets. Reject discards packets and sends an ICMP or ICMPv6 rejection response.
| Option | Label | Description |
|---|---|---|
forward | Forward | Packets matching this flow rule will be forwarded. |
drop | Drop | Packets matching this flow rule will be dropped. |
reject | Reject | Packets matching this flow rule will be rejected. |
- Data type: string select
- Configuration
- Required
CLI: (cli)> config network flow rule <key> action