A firewall group is a perimeter firewall management to Networking. Firewall group uses iptables to apply firewall policy to all VM ports and router ports within a project.
Network v2
Create a new firewall group
openstack firewall group create
[-f {json,shell,table,value,yaml}]
[-c COLUMN]
[--noindent]
[--prefix PREFIX]
[--max-width <integer>]
[--fit-width]
[--print-empty]
[--name NAME]
[--description <description>]
[--ingress-firewall-policy <ingress-firewall-policy> | --no-ingress-firewall-policy]
[--egress-firewall-policy <egress-firewall-policy> | --no-egress-firewall-policy]
[--public | --private]
[--enable | --disable]
[--project <project>]
[--project-domain <project-domain>]
[--port <port> | --no-port]
-f <FORMATTER>, --format <FORMATTER>¶the output format, defaults to table
-c COLUMN, --column COLUMN¶specify the column(s) to include, can be repeated
--noindent¶whether to disable indenting the JSON
--prefix <PREFIX>¶add a prefix to all variable names
--max-width <integer>¶Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.
--fit-width¶Fit the table to the display width. Implied if –max-width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable
--print-empty¶Print empty table if there is no data to show.
--name <NAME>¶Name for the firewall group
--description <description>¶Description of the firewall group
--ingress-firewall-policy <ingress-firewall-policy>¶Ingress firewall policy (name or ID)
--no-ingress-firewall-policy¶Detach ingress firewall policy from the firewall group
--egress-firewall-policy <egress-firewall-policy>¶Egress firewall policy (name or ID)
--no-egress-firewall-policy¶Detach egress firewall policy from the firewall group
--public¶Make the firewall group public, which allows it to be used in all projects (as opposed to the default, which is to restrict its use to the current project)
--private¶Restrict use of the firewall group to the current project
--enable¶Enable firewall group
--disable¶Disable firewall group
--project <project>¶Owner’s project (name or ID)
--project-domain <project-domain>¶Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
--port <port>¶Port(s) (name or ID) to apply firewall group. This option can be repeated
--no-port¶Detach all port from the firewall group
Delete firewall group(s)
openstack firewall group delete <firewall-group> [<firewall-group> ...]
firewall-group¶Firewall group(s) to delete (name or ID)
List firewall groups
openstack firewall group list
[-f {csv,json,table,value,yaml}]
[-c COLUMN]
[--noindent]
[--max-width <integer>]
[--fit-width]
[--print-empty]
[--quote {all,minimal,none,nonnumeric}]
[--long]
-f <FORMATTER>, --format <FORMATTER>¶the output format, defaults to table
-c COLUMN, --column COLUMN¶specify the column(s) to include, can be repeated
--noindent¶whether to disable indenting the JSON
--max-width <integer>¶Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.
--fit-width¶Fit the table to the display width. Implied if –max-width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable
--print-empty¶Print empty table if there is no data to show.
--quote <QUOTE_MODE>¶when to include quotes, defaults to nonnumeric
--long¶List additional fields in output
Set firewall group properties
openstack firewall group set
[--name NAME]
[--description <description>]
[--ingress-firewall-policy <ingress-firewall-policy> | --no-ingress-firewall-policy]
[--egress-firewall-policy <egress-firewall-policy> | --no-egress-firewall-policy]
[--public | --private]
[--enable | --disable]
[--port <port>]
[--no-port]
<firewall-group>
--name <NAME>¶Name for the firewall group
--description <description>¶Description of the firewall group
--ingress-firewall-policy <ingress-firewall-policy>¶Ingress firewall policy (name or ID)
--no-ingress-firewall-policy¶Detach ingress firewall policy from the firewall group
--egress-firewall-policy <egress-firewall-policy>¶Egress firewall policy (name or ID)
--no-egress-firewall-policy¶Detach egress firewall policy from the firewall group
--public¶Make the firewall group public, which allows it to be used in all projects (as opposed to the default, which is to restrict its use to the current project)
--private¶Restrict use of the firewall group to the current project
--enable¶Enable firewall group
--disable¶Disable firewall group
--port <port>¶Port(s) (name or ID) to apply firewall group. This option can be repeated
--no-port¶Detach all port from the firewall group
firewall-group¶Firewall group to update (name or ID)
Display firewall group details
openstack firewall group show
[-f {json,shell,table,value,yaml}]
[-c COLUMN]
[--noindent]
[--prefix PREFIX]
[--max-width <integer>]
[--fit-width]
[--print-empty]
<firewall-group>
-f <FORMATTER>, --format <FORMATTER>¶the output format, defaults to table
-c COLUMN, --column COLUMN¶specify the column(s) to include, can be repeated
--noindent¶whether to disable indenting the JSON
--prefix <PREFIX>¶add a prefix to all variable names
--max-width <integer>¶Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.
--fit-width¶Fit the table to the display width. Implied if –max-width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable
--print-empty¶Print empty table if there is no data to show.
firewall-group¶Firewall group to show (name or ID)
Unset firewall group properties
openstack firewall group unset
[--port <port> | --all-port]
[--ingress-firewall-policy]
[--egress-firewall-policy]
[--public]
[--enable]
<firewall-group>
--port <port>¶Port(s) (name or ID) to apply firewall group. This option can be repeated
--all-port¶Remove all ports for this firewall group
--ingress-firewall-policy¶Ingress firewall policy (name or ID) to delete
--egress-firewall-policy¶Egress firewall policy (name or ID) to delete
--public¶Restrict use of the firewall group to the current project
--enable¶Disable firewall group
firewall-group¶Firewall group to unset (name or ID)
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.