Inserting a Network ACL Rule

firewall_id

Yes

String

Definition:

Network ACL ID. You can call the API Querying Network ACLs to obtain the ID of the target network ACL, and then use this API to add network ACL rules.

Range:

N/A

project_id

Yes

String

Definition:

ID of the project that the network ACL belongs to. For details about how to obtain a project ID, see Obtaining a Project ID.

Range:

N/A

firewall

Yes

FirewallInsertRuleOption object

Definition:

Request body for inserting a network ACL rule.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

dry_run

No

Boolean

Definition:

Whether to only check the request.

Constraints:

N/A

Range:

• true: A check request will be sent and no network ACL rule will be inserted. Check items include mandatory parameters, request format, and constraints. If the check fails, an error will be returned. If the check succeeds, response code 202 will be returned.

• false: A request will be sent and a network ACL rule will be inserted.

Default Value:

false

ingress_rules

No

Array of FirewallInsertRuleItemOption objects

Definition:

Network ACL inbound rules.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

egress_rules

No

Array of FirewallInsertRuleItemOption objects

Definition:

Network ACL outbound rules.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

insert_after_rule

No

String

Definition:

ID of an inbound or outbound network ACL rule after which a new rule will be inserted. If not specified, the network ACL rule will be inserted at the beginning of the inbound or outbound rule list.

Constraints:

If insert_after_rule is specified, either ingress_rules or egress_rules can be specified. That is, the new rule must be inserted into either the inbound or outbound rule list. The specified rule must exist in the inbound or outbound network ACL rule list.

Range:

N/A

Default Value:

N/A

name

No

String

Definition:

Network ACL rule name.

Constraints:

The value can contain 0 to 255 characters, including letters, digits, underscores (_), hyphens (-), and periods.

Range:

N/A

Default Value:

N/A

description

No

String

Definition:

Supplementary information about the network ACL rule.

Constraints:

The value can contain 0 to 255 characters and cannot contain angle brackets (< or >).

Range:

N/A

Default Value:

N/A

action

Yes

String

Definition:

Whether a network ACL rule allows or denies traffic.

Constraints:

N/A

Range:

• allow: A network ACL rule allows traffic.

• deny: A network ACL rule denies traffic.

Default Value:

N/A

protocol

Yes

String

Definition:

Communication protocol of a network ACL rule.

Constraints:

• The protocol cannot be empty.

• If the protocol is icmpv6, IP version should be IPv6.

• If the protocol is icmp, IP version should be IPv4.

• tcp

• udp

• icmp

• icmpv6

• IP protocol number (0-255)

• any: any protocol

Range:

Default Value:

N/A

ip_version

Yes

Integer

Definition:

IP address version of a network ACL rule.

Constraints:

N/A

Range:

• 4: IPv4 network ACL rule.

• 6: IPv6 network ACL rule.

Default Value:

N/A

source_ip_address

No

String

Definition:

Source IP address or source IP address range of a network ACL rule.

Constraints:

source_ip_address and source_address_group_id cannot be specified at the same time.

Range:

N/A

Default Value:

N/A

destination_ip_address

No

String

Definition:

Destination IP address or destination IP address range of a network ACL rule.

Constraints:

destination_ip_address and destination_address_group_id cannot be specified at the same time.

Range:

N/A

Default Value:

N/A

source_port

No

String

Definition:

Source port of a network ACL rule.

Constraints:

• Individual port: for example, 22

• Consecutive ports: for example, 22-30

• Non-consecutive ports: ports and port ranges, such as 22,23-30. You can specify up to 20 port ranges. Port ranges cannot overlap.

• All ports: Leave it empty or enter 1-65535.

Range:

N/A

Default Value:

N/A

destination_port

No

String

Definition:

Destination port of a network ACL rule.

Constraints:

• Individual port: for example, 22

• Consecutive ports: for example, 22-30

• Non-consecutive ports: ports and port ranges, such as 22,23-30. You can specify up to 20 port ranges. Port ranges cannot overlap.

• All ports: Leave it empty or enter 1-65535.

Range:

N/A

Default Value:

N/A

source_address_group_id

No

String

Definition:

ID of the source IP address group of a network ACL rule.

Constraints:

• source_ip_address and source_address_group_id cannot be specified at the same time.

• source_address_group_id and destination_address_group_id cannot be specified at the same time.

Range:

N/A

Default Value:

N/A

destination_address_group_id

No

String

Definition:

ID of the destination IP address group of a network ACL rule.

Constraints:

• destination_ip_address and destination_address_group_id cannot be specified at the same time.

• destination_address_group_id and source_address_group_id cannot be specified at the same time.

Range:

N/A

Default Value:

N/A

enabled

No

Boolean

Definition:

Whether a network ACL rule is enabled.

Constraints:

N/A

Range:

• true: A network ACL rule is enabled.

• false: A network ACL rule is disabled.

Default Value:

true

firewall

FirewallDetail object

Definition:

Response body for inserting a network ACL rule.

Range:

N/A

request_id

String

Definition:

Request ID.

Range:

N/A

id

String

Definition:

Network ACL ID. Each network ACL comes with an ID, which uniquely identifies the network ACL.

Range:

The value is in UUID format with hyphens (-).

name

String

Definition:

Name of the network ACL.

Range:

The value can contain 1 to 64 characters, including letters, digits, underscores (_), hyphens (-), and periods.

description

String

Definition:

Supplementary information about the network ACL.

Range:

The value can contain 0 to 255 characters and cannot contain angle brackets (< or >).

project_id

String

Definition:

ID of the project that the network ACL belongs to.

Range:

N/A

created_at

String

Definition:

Time when the network ACL was created. The value is automatically generated by the system.

Range:

The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.

updated_at

String

Definition:

Time when the network ACL was last updated. The value is automatically generated by the system.

Range:

The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.

admin_state_up

Boolean

Definition:

Network ACL administrative status.

Range

• true: The network ACL is enabled.

• false: The network ACL is disabled.

status

String

Definition:

Network ACL status.

Range

• ACTIVE: The network ACL is associated with a subnet.

• INACTIVE: The network ACL is not associated with a subnet.

enterprise_project_id

String

Definition:

ID of the enterprise project that the network ACL belongs to.

Range:

The value is 0 or a string that contains a maximum of 36 characters in UUID format with hyphens (-). 0 indicates the default enterprise project.

tags

Array of ResponseTag objects

Definition:

Tags of a network ACL, including tag keys and tag values, which can be used to classify and identify resources. For details, see the tag objects.

Range:

N/A

associations

Array of FirewallAssociation objects

Definition:

Subnets associated with the network ACL.

Range:

N/A

ingress_rules

Array of FirewallRuleDetail objects

Definition:

Network ACL inbound rules.

Range:

N/A

egress_rules

Array of FirewallRuleDetail objects

Definition:

Network ACL outbound rules.

Range:

N/A

key

String

Definition:

Tag key.

Range:

• A tag key can contain a maximum of 128 Unicode characters and cannot be left blank.

• Each tag key of a resource must be unique.

• The value can contain:

  • Letters

  • Digits

  • Special characters: underscores (_), periods (.), colons (:), plus signs (+), hyphens (-), and equal signs (=)

  • Chinese characters

value

String

Definition:

Tag value.

Range:

• Each value can contain a maximum of 255 Unicode characters and can be left blank.

• The value can contain:

  • Letters

  • Digits

  • Special characters: underscores (_), periods (.), colons (:), plus signs (+), hyphens (-), and equal signs (=)

  • Chinese characters

virsubnet_id

String

Definition:

ID of the subnet associated with the network ACL.

Range:

• If the network ACL type is normal, it can only be associated with common subnets.

• If the network ACL type is CloudDCN, it can only be associated with CloudDCN subnets.

id

String

Definition:

Network ACL rule ID. Each network ACL rule comes with an ID, which uniquely identifies the network ACL rule.

Range:

The value is in UUID format with hyphens (-).

name

String

Definition:

Network ACL rule name.

Range:

The value can contain 0 to 255 characters, including letters, digits, underscores (_), hyphens (-), and periods.

description

String

Definition:

Supplementary information about the network ACL rule.

Range:

The value can contain 0 to 255 characters and cannot contain angle brackets (< or >).

action

String

Definition:

Whether a network ACL rule allows or denies traffic.

Range:

• allow: A network ACL rule allows traffic.

• deny: A network ACL rule denies traffic.

project_id

String

Definition:

ID of the project that the network ACL rule belongs to.

Range:

N/A

protocol

String

Definition:

Communication protocol of a network ACL rule.

Range:

• tcp

• udp

• icmp

• icmpv6

• IP protocol number (0-255)

• any: any protocol

ip_version

Integer

Definition:

IP address version of a network ACL rule.

Range:

• 4: IPv4 network ACL rule.

• 6: IPv6 network ACL rule.

source_ip_address

String

Definition:

Source IP address or source IP address range of a network ACL rule.

Range:

source_ip_address and source_address_group_id cannot be specified at the same time.

destination_ip_address

String

Definition:

Destination IP address or destination IP address range of a network ACL rule.

Range:

destination_ip_address and destination_address_group_id cannot be specified at the same time.

source_port

String

Definition:

Source port of a network ACL rule.

Range:

• Individual port: for example, 22

• Consecutive ports: for example, 22-30

• Non-consecutive ports: ports and port ranges, such as 22,23-30. You can specify up to 20 port ranges. Port ranges cannot overlap.

• All ports: Leave it empty or enter 1-65535.

destination_port

String

Definition:

Destination port of a network ACL rule.

Range:

• Individual port: for example, 22

• Consecutive ports: for example, 22-30

• Non-consecutive ports: ports and port ranges, such as 22,23-30. You can specify up to 20 port ranges. Port ranges cannot overlap.

• All ports: Leave it empty or enter 1-65535.

source_address_group_id

String

Definition:

ID of the source IP address group of a network ACL rule.

Range:

source_ip_address and source_address_group_id cannot be specified at the same time.

destination_address_group_id

String

Definition:

ID of the destination IP address group of a network ACL rule.

Range:

destination_ip_address and destination_address_group_id cannot be specified at the same time.

enabled

Boolean

Definition:

Whether a network ACL rule is enabled.

Range:

• true: (default value) A network ACL rule is enabled.

• false: A network ACL rule is disabled.

200

Normal response to the PUT operation. For more status codes, see Status Codes.