Use groups instead of literals#

You will end up with named sets — management, iot, web-ports — that firewall rules reference instead of repeating literals. Adding a machine to the management prefix then becomes one edit in one place, rather than an audit of every rule that happened to mention it.

Before you start#

• The operator role and a licence, or console access.
• A rule or two that repeat the same address. If nothing repeats yet, this is still worth doing for anything that will grow: the second time you paste an address into a rule is the moment to make a group.

The kinds, and what each holds#

Network → Firewall → Groups.

A group may also include another group of the same kind, which the page shows as an includes badge on the card.

Step 1 — Create the group#

+ Add group, choose the kind, name it, and paste the members separated by spaces or commas.

set firewall group network-group management network 192.0.2.0/28
set firewall group network-group management description 'where admins sit'
set firewall group port-group web-ports port 80
set firewall group port-group web-ports port 443

A group with no members is still created, as a bare set — useful when you want the name to exist before you know what goes in it.

Each group gets a card on the Groups tab with its members as badges. Adding one member is the text field on the card; removing one is the × beside its badge.

set firewall group network-group management network 198.51.100.0/28
delete firewall group network-group management network 192.0.2.0/28

Step 2 — Reference it from a rule#

In the rule editor, the …or source group and …or destination group selects list every group of the right family, labelled with its kind. Choosing one clears the literal on that side, because a rule cannot have both.

set firewall ipv4 input filter rule 60 action accept
set firewall ipv4 input filter rule 60 description 'management to the router'
set firewall ipv4 input filter rule 60 source group network-group management
set firewall ipv4 input filter rule 60 destination group port-group web-ports
set firewall ipv4 input filter rule 60 protocol tcp

The port group goes on the destination side, which is where the rule editor puts it.

Step 3 — Commit, and then use it#

The value of a group is the second time you use it. Write the next rule with the group rather than the literal, and the one after that.

Check it worked#

The rule still matches. The Firewall page shows the hit counter on each rule; a rule that stopped matching when you swapped a literal for a group has the group wrong — usually the wrong kind, or a value with a prefix length that does not cover what you thought.

show firewall group
show firewall statistics

Then edit the group and watch every rule follow. Add an address, commit, and check the counters on all the rules that reference it.

Things that will bite#

A group is not a zone. It is a named set of values, matched in a rule. It carries no policy of its own, and nothing is applied to a group.

Family matters. An IPv4 rule cannot reference an ipv6-network-group. The editor only offers the groups that fit the family you are editing, which is why the list looks short when you are on the v6 tab.

domain-group resolves names. What it matches depends on what those names resolve to when the ruleset is loaded, which is a moving target. Prefer addresses where you can.

Undoing it#

delete firewall group network-group management

after removing the rules that reference it. Or leave the group and point the rules back at literals first.

See also#

• A default-drop ruleset that admits what you meant
• Publish a service
• Firewall — groups
• Firewall — rules

Checked against ui/src/pages/Firewall.tsx · agent/main.go