Authoring firewall rules
You author the rules in a firewall rule group in one of two ways. Each create or update request uses exactly one of these authoring modes, and you can switch between them in later requests.
-
Rule strings – Raw firewall-mode rules in Suricata compatible syntax. Use this mode if you're comfortable writing Suricata firewall-mode rules directly. In the console, you author rule strings with the Text rule builder.
-
Modeled rules – A list of structured rule entries. Network Firewall compiles each modeled rule into one Suricata compatible rule string. Use this mode if you prefer a structured form that's easier to generate and manage programmatically. In the console, you author modeled rules with the Visual rule builder. For the fields of a modeled rule, see Fields of a modeled firewall rule.
The two forms are interchangeable. Network Firewall compiles each modeled rule into exactly one rule string, and when you describe a firewall rule group you can request either the modeled form or the compiled rule-string form. The conversion preserves each rule's behavior, but it isn't byte-for-byte lossless: the protocol normalizes to the hook's protocol family, accept-prior-hooks on a packet-layer hook isn't represented, and a domain-list rule group can be described as modeled rules but can't be written back in that form. If a rule string can't be represented as a modeled rule, the describe request returns an error that identifies the rule by its line number rather than silently changing it.