Create Firewall Rule

Create a firewall rule for an IP or network.

If you provide a subnet (for example a /24), a separate rule is created for each individual IP in it.

Actions (with protocol restrictions):

• 0: DROP - Drop packets (TCP/UDP/ICMP)
• 1: ACCEPT - Accept packets (TCP/UDP/ICMP)
• 2: FILTER - Continue filtering (TCP/UDP/ICMP)
• 10: FiveM TCP L1 - Monitor only (TCP only)
• 11: FiveM TCP L2 - Require auth (TCP only)
• 12: FiveM TCP L10 - Auth + rate limit (TCP only)
• 15: FiveM UDP L1 - Monitor only (UDP only)
• 16: FiveM UDP L2 - Require auth (UDP only)
• 17: FiveM UDP L3 - Self-auth getinfo (UDP only)
• 20: RDP TCP - Full auth + rate limit (TCP only)
• 21: RDP UDP - Require auth (UDP only)
• 30: DNS UDP - Validate DNS header (UDP only)
• 31: DNS TCP - Validate header + length (TCP only)
• 40: Minecraft Java - Handshake validation (TCP only)
• 50: TLS - TLS record validation (TCP only)
• 60: Source rate limit in packets per second, per source IP to the destination port (any protocol)
• 61: Source rate limit in megabits per second, per source IP to the destination port (any protocol)

IPv6: an address (bare or /128) or a prefix of /48 to /128 inside a block you own, stored as ONE rule for the whole prefix (never expanded). Same actions and protocol restrictions as IPv4 and protocols 0, 6, 17 and 58 (ICMPv6, dst_port 0; protocol 1 is stored as 58). For IPv6, a source rate limit (60, 61) and an app authentication count each source /64 as one source. The rule is stored, but it only applies to your IPv6 traffic once a core redirects it to the scrubbers (always-on mitigation, scrubbing_active on the profile). A prefix rule is enforced as a prefix; an exact address rule wins over it.

For actions 60 and 61, set the limits in tcp_syn, tcp_ack, tcp_synack, tcp_rst, tcp_fin, tcp_all, udp and icmp.