Firewall — rules#
The Rules tab is one table of every rule in the chosen address family, across the three chains and every named rule set, with the router's packet and byte counts on each row. Clicking a row opens the rule in a side panel; Add rule opens the same panel empty. Both add to the pending changes, which reach the router when they are applied.
A rule found with the search palette (⌘K) opens in the same panel, in either family: the
page switches to the rule's family. A link does the same. /firewall?chain=input&rule=10
opens Input rule 10, and /firewall?family=ipv6&chain=input&rule=10 the IPv6 rule of that
number; a link that names no family is to an IPv4 rule.
The table#
| Column | What it shows |
|---|---|
| Rule set | The chain (Input, Forward, Output) or the named rule set. |
| # | The rule number. Rules are checked in number order, lowest first; the first rule that matches decides. |
| Action | Accept in green, Drop and Reject in red, anything else neutral. Go to names the rule set a rule sends traffic to. Disabled, Scheduled, Rate limited and Repeat limit mark rules that carry those. |
| Source / Destination | An address or network, a group, a list of countries, a domain name or a MAC address — or Any. |
| Service | The protocol and destination port, or Any. |
| In / Out | The incoming and outgoing interface or interface group, or Any. The loopback reads as Loopback. |
| Packets / Bytes | From the router’s firewall statistics. A dash — not zero — when those could not be read. |
| Description | The rule's description. |
The filter box above the table narrows the rows by any text in them.
The rule editor#
The panel is the same for a new rule and an existing one, so a rule made here can always be changed here. An existing rule's panel shows its live counters at the top; a new rule's panel asks first where the rule goes:
- Rule set — one of the three chains, or a named rule set of the same family.
- Rule number — suggested as ten past the highest number in the rule set, counting rules that are pending as well as those on the router, so two rules added before applying never share a number. A number already in the rule set is refused under the field.
The fields follow in five sections. Save changes (or Add rule) stays disabled until the rule is complete and every value is one the router takes; a value it would refuse is named under its field.
Action#
| Field | What it does |
|---|---|
| Action | Accept, Drop, Reject (drop and tell the sender), Go to rule set, Return (back to the chain that sent traffic here) or Continue (to the next rule). |
| Rule set to go to | Appears for Go to rule set, and lists the named rule sets of the same family. A new rule set is made on the Rule sets tab. |
Match#
| Field | What it does |
|---|---|
| Protocol | Any, TCP, UDP, TCP and UDP, or ICMP (ICMPv6 on IPv6). |
| Incoming interface | Any, one of the router's interfaces — VLANs included — or an interface group. Not offered in the Output chain, where nothing arrives. |
| Outgoing interface | The same, for where traffic leaves. Not offered in the Input chain. |
| Source, Destination | What each side matches — see below. |
| Source port, Destination port | Shown once the protocol is TCP, UDP or TCP and UDP: a port, a range such as 8000-8100, or several separated by commas. The destination can name a port group instead. |
| Connection state | Established, Related, New, Invalid. Leave all clear to match any state; the state policy already handles established and related traffic for every chain. |
Each side of the rule matches one kind of thing at a time:
| Choice | Field | Examples |
|---|---|---|
| Any | — | |
| Address or network | An address, a network or a range, optionally preceded by ! for everything except it | 192.0.2.10, 192.0.2.0/24, !192.0.2.0/24 |
| Group | An address, network, domain or MAC address group of the rule's family | See groups |
| Country | One or more countries, by name | See below |
| Domain name | A host name, looked up by the router | example.com |
| MAC address | Source only | 00:53:00:12:34:56 |
Choosing another kind takes away what the side matched before.
Matching on countries#
Choosing Country for a side offers every country the router knows, by name. Add as many as the rule needs; Every country except these turns the list around, so a rule can admit one country or refuse all but a few. Under the list the panel says when the country data was last updated; Settings refreshes it.
A country is only as exact as the database behind it: addresses move between countries, and the router's copy is refreshed weekly.
Schedule#
A scheduled rule matches only at the times it names; outside them it does not match, and the next rule decides.
| Field | What it does |
|---|---|
| Days | Mon to Sun. Leave all clear to match every day. |
| From / Until | A time of day, 24-hour: 08:00 or 17:30:00. Times are the router's local time. |
| Start date / End date | 2026-09-01. The rule matches from the start of the start date, and stops at the start of the end date. With a start date, From is the time on that date rather than every day; with an end date, so is Until. |
Limits#
| Field | What it does |
|---|---|
| Rate limit | Matches packets up to a rate — per second, minute, hour or day. With Accept, the packets over the rate go on to the next rule. |
| Burst | How many packets may arrive at once above the rate. Needs a rate. |
| Repeat connections and Period | Matches a source seen more than this many times in the last second, minute or hour — with Drop, the usual defence against password guessing on an open port. Both are needed. |
Options#
| Field | What it does |
|---|---|
| Log matches | Every packet the rule matches is logged; the Logs page shows them. |
| Disabled | The rule stays in the configuration and matches nothing. |
| Description | Up to 255 characters. |
Saving, deleting and disabling#
Only what changed is added to the pending changes: saving a rule unchanged adds nothing, and a field cleared in the panel is removed from the rule. Clearing the last value of a schedule, a limit or one side removes that whole part of the rule, which is how the router wants it.
Delete rule asks twice, then removes the whole rule. Disabled keeps the rule and its place in the order; a deleted rule has to be made again.
In the list of pending changes a rule reads as one line with its particulars — for example Add forward rule 30 — Drop, TCP, from China, every other country, to port 22, in on eth1.
An example#
A router accepts SSH on its uplink with an Input rule. Two rules numbered before that one refuse SSH from every country but one, and limit how fast anyone may retry. On the Rules tab, Add rule, with a rule number below the accept rule's:
| Field | Value |
|---|---|
| Rule set | Input |
| Action | Drop |
| Protocol | TCP |
| Incoming interface | eth1 — the uplink |
| Source | Country: Germany, with Every country except these on |
| Destination port | 22 |
| Log matches | On |
| Description | SSH from abroad |
Then a second rule, numbered between the two, for the connections that are left:
| Field | Value |
|---|---|
| Rule set | Input |
| Action | Drop |
| Protocol | TCP |
| Incoming interface | eth1 |
| Destination port | 22 |
| Connection state | New |
| Repeat connections | 5, per minute |
| Description | SSH retries |
Apply both with auto-revert, and watch the Packets column as the rules start to match.
What this page does not do#
- It does not reorder rules. The number is the order; to move a rule, add it under a new number and delete the old one.
- It does not show the compiled rules without Advanced mode. The nftables tab, which shows the router's own rendering of a rule set, is part of Advanced mode.
See also#
- Firewall — the chains, rule sets, state policy and global options.
- Firewall — groups — how to stop repeating literals in these fields.
- Worked rulesets — these fields used in three complete rulesets.
- Port forwards — a new forward adds its matching Forward rule.
- Commit-confirm — the window that makes an input-chain change survivable.
- A default-drop ruleset — a guide that uses these fields end to end.
- System — audit — who changed what.