# Network v2 FWaaS Commands

## firewall group

### firewall group create

Create a new firewall group

    openstack firewall group create
        [--description <description>]
        [--ingress-firewall-policy
        <ingress-firewall-policy>
        |
        --no-ingress-firewall-policy
        ]
        [--egress-firewall-policy
        <egress-firewall-policy>
        |
        --no-egress-firewall-policy
        ]
        [--share
        |
        --no-share
        ]
        [--enable | --disable]
        [--name NAME]
        [--project <project>]
        [--project-domain <project-domain>]
        [--port <port> | --no-port]
        [<name>]

--description <description>

  Description of the firewall group

--ingress-firewall-policy <ingress-firewall-policy>

  Ingress firewall policy (name or ID)

--no-ingress-firewall-policy

  Detach ingress firewall policy from the firewall group

--egress-firewall-policy <egress-firewall-policy>

  Egress firewall policy (name or ID)

--no-egress-firewall-policy

  Detach egress firewall policy from the firewall group

--share

  Share the firewall group to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall group to the current project

--enable

  Enable firewall group

--disable

  Disable firewall group

--name <NAME>

  (Deprecated, please pass name as a positional argument) Name for the firewall group

--project <project>

  Owner’s project (name or ID)

--project-domain <project-domain>

  Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--port <port>

  Port(s) (name or ID) to apply firewall group. This option can be repeated

--no-port

  Detach all port from the firewall group

name

  Name for the firewall group

### firewall group delete

Delete firewall group(s)

    openstack firewall group delete <firewall-group> [<firewall-group> ...]

firewall-group

  Firewall group(s) to delete (name or ID)

### firewall group list

List firewall groups

    openstack firewall group list
        [--sort-column SORT_COLUMN]
        [--sort-ascending | --sort-descending]
        [--long]

--sort-column SORT_COLUMN

  specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending

  sort the column(s) in ascending order

--sort-descending

  sort the column(s) in descending order

--long

  List additional fields in output

### firewall group set

Set firewall group properties

    openstack firewall group set
        [--description <description>]
        [--ingress-firewall-policy
        <ingress-firewall-policy>
        |
        --no-ingress-firewall-policy
        ]
        [--egress-firewall-policy
        <egress-firewall-policy>
        |
        --no-egress-firewall-policy
        ]
        [--share
        |
        --no-share
        ]
        [--enable | --disable]
        [--name NAME]
        [--port <port>]
        [--no-port]
        <firewall-group>

--description <description>

  Description of the firewall group

--ingress-firewall-policy <ingress-firewall-policy>

  Ingress firewall policy (name or ID)

--no-ingress-firewall-policy

  Detach ingress firewall policy from the firewall group

--egress-firewall-policy <egress-firewall-policy>

  Egress firewall policy (name or ID)

--no-egress-firewall-policy

  Detach egress firewall policy from the firewall group

--share

  Share the firewall group to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall group to the current project

--enable

  Enable firewall group

--disable

  Disable firewall group

--name <NAME>

  Name for the firewall group

--port <port>

  Port(s) (name or ID) to apply firewall group. This option can be repeated

--no-port

  Detach all port from the firewall group

firewall-group

  Firewall group to update (name or ID)

### firewall group show

Display firewall group details

    openstack firewall group show <firewall-group>

firewall-group

  Firewall group to show (name or ID)

### firewall group unset

Unset firewall group properties

    openstack firewall group unset
        [--port <port> | --all-port]
        [--ingress-firewall-policy]
        [--egress-firewall-policy]
        [--share]
        [--enable]
        <firewall-group>

--port <port>

  Port(s) (name or ID) to apply firewall group. This option can be repeated

--all-port

  Remove all ports for this firewall group

--ingress-firewall-policy

  Ingress firewall policy (name or ID) to delete

--egress-firewall-policy

  Egress firewall policy (name or ID) to delete

--share

  (Deprecated) Use “firewall group set –no-share” instead. Restrict use of the firewall group to the current project

--enable

  (Deprecated) Use “firewall group set –disable” instead. Disable firewall group

firewall-group

  Firewall group to unset (name or ID)

## firewall group policy

### firewall group policy add rule

Insert a rule into a given firewall policy

    openstack firewall group policy add rule
        [--insert-before <firewall-rule>]
        [--insert-after <firewall-rule>]
        <firewall-policy>
        <firewall-rule>

--insert-before <firewall-rule>

  Insert the new rule before this existing rule (name or ID)

--insert-after <firewall-rule>

  Insert the new rule after this existing rule (name or ID)

firewall-policy

  Firewall policy to insert rule (name or ID)

firewall-rule

  Firewall rule to be inserted (name or ID)

### firewall group policy create

Create a new firewall policy

    openstack firewall group policy create
        [--description DESCRIPTION]
        [--audited | --no-audited]
        [--share | --no-share]
        [--project <project>]
        [--project-domain <project-domain>]
        [--firewall-rule
        <firewall-rule>
        |
        --no-firewall-rule
        ]
        <name>

--description <DESCRIPTION>

  Description of the firewall policy

--audited

  Enable auditing for the policy

--no-audited

  Disable auditing for the policy

--share

  Share the firewall policy to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall policy to the current project

--project <project>

  Owner’s project (name or ID)

--project-domain <project-domain>

  Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--firewall-rule <firewall-rule>

  Firewall rule(s) to apply (name or ID)

--no-firewall-rule

  Unset all firewall rules from firewall policy

name

  Name for the firewall policy

### firewall group policy delete

Delete firewall policy(s)

    openstack firewall group policy delete
        <firewall-policy>
        [<firewall-policy> ...]

firewall-policy

  Firewall policy(s) to delete (name or ID)

### firewall group policy list

List firewall policies

    openstack firewall group policy list
        [--sort-column SORT_COLUMN]
        [--sort-ascending
        |
        --sort-descending
        ]
        [--long]

--sort-column SORT_COLUMN

  specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending

  sort the column(s) in ascending order

--sort-descending

  sort the column(s) in descending order

--long

  List additional fields in output

### firewall group policy remove rule

Remove a rule from a given firewall policy

    openstack firewall group policy remove rule
        <firewall-policy>
        <firewall-rule>

firewall-policy

  Firewall policy to remove rule (name or ID)

firewall-rule

  Firewall rule to remove from policy (name or ID)

### firewall group policy set

Set firewall policy properties

    openstack firewall group policy set
        [--description DESCRIPTION]
        [--audited | --no-audited]
        [--share | --no-share]
        [--name <name>]
        [--firewall-rule <firewall-rule>]
        [--no-firewall-rule]
        <firewall-policy>

--description <DESCRIPTION>

  Description of the firewall policy

--audited

  Enable auditing for the policy

--no-audited

  Disable auditing for the policy

--share

  Share the firewall policy to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall policy to the current project

--name <name>

  Name for the firewall policy

--firewall-rule <firewall-rule>

  Firewall rule(s) to apply (name or ID)

--no-firewall-rule

  Remove all firewall rules from firewall policy

firewall-policy

  Firewall policy to update (name or ID)

### firewall group policy show

Display firewall policy details

    openstack firewall group policy show <firewall-policy>

firewall-policy

  Firewall policy to show (name or ID)

### firewall group policy unset

Unset firewall policy properties

    openstack firewall group policy unset
        [--firewall-rule
        <firewall-rule>
        |
        --all-firewall-rule
        ]
        [--audited]
        [--share]
        <firewall-policy>

--firewall-rule <firewall-rule>

  Remove firewall rule(s) from the firewall policy (name or ID)

--all-firewall-rule

  Remove all firewall rules from the firewall policy

--audited

  Disable auditing for the policy

--share

  (Deprecated) Use “firewall policy set –no-share” instead. Restrict use of the firewall policy to the current project

firewall-policy

  Firewall policy to unset (name or ID)

## firewall group rule

### firewall group rule create

Create a new firewall rule

    openstack firewall group rule create
        [--description <description>]
        [--protocol PROTOCOL]
        [--action {allow,deny,reject}]
        [--ip-version <ip-version>]
        [--source-ip-address
        <source-ip-address>
        |
        --no-source-ip-address
        ]
        [--destination-ip-address
        <destination-ip-address>
        |
        --no-destination-ip-address
        ]
        [--source-port
        <source-port>
        |
        --no-source-port
        ]
        [--destination-port
        <destination-port>
        |
        --no-destination-port
        ]
        [--share
        |
        --no-share
        ]
        [--enable-rule
        |
        --disable-rule
        ]
        [--source-firewall-group
        <source-firewall-group>
        |
        --no-source-firewall-group
        ]
        [--destination-firewall-group
        <destination-firewall-group>
        |
        --no-destination-firewall-group
        ]
        [--name <name>]
        [--project <project>]
        [--project-domain <project-domain>]
        [<name>]

--description <description>

  Description of the firewall rule

--protocol <PROTOCOL>

  IP protocol (ah, dccp, egp, esp, gre, icmp, igmp, ipv6-encap, ipv6-frag, ipv6-icmp, ipv6-nonxt, ipv6-opts, ipv6-route, ospf, pgm, rsvp, sctp, tcp, udp, udplite, vrrp and integer representations [0-255] or any; default: any (all protocols))

--action <ACTION>

  Action for the firewall rule

--ip-version <ip-version>

  Set IP version 4 or 6 (default is 4)

--source-ip-address <source-ip-address>

  Source IP address or subnet

--no-source-ip-address

  Detach source IP address

--destination-ip-address <destination-ip-address>

  Destination IP address or subnet

--no-destination-ip-address

  Detach destination IP address

--source-port <source-port>

  Source port number or range (integer in [1, 65535] or range like 123:456)

--no-source-port

  Detach source port number or range

--destination-port <destination-port>

  Destination port number or range(integer in [1, 65535] or range like 123:456)

--no-destination-port

  Detach destination port number or range

--share

  Share the firewall rule to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall rule to the current project

--enable-rule

  Enable this rule (default is enabled)

--disable-rule

  Disable this rule

--source-firewall-group <source-firewall-group>

  Source firewall group (name or ID)

--no-source-firewall-group

  No associated source firewall group

--destination-firewall-group <destination-firewall-group>

  Destination firewall group (name or ID)

--no-destination-firewall-group

  No associated destination firewall group

--name <name>

  (Deprecated, please pass name as a positional argument) Name of the firewall rule

--project <project>

  Owner’s project (name or ID)

--project-domain <project-domain>

  Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

name

  Name of the firewall rule

### firewall group rule delete

Delete firewall rule(s)

    openstack firewall group rule delete
        <firewall-rule>
        [<firewall-rule> ...]

firewall-rule

  Firewall rule(s) to delete (name or ID)

### firewall group rule list

List firewall rules that belong to a given tenant

    openstack firewall group rule list
        [--sort-column SORT_COLUMN]
        [--sort-ascending
        |
        --sort-descending
        ]
        [--long]

--sort-column SORT_COLUMN

  specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending

  sort the column(s) in ascending order

--sort-descending

  sort the column(s) in descending order

--long

  List additional fields in output

### firewall group rule set

Set firewall rule properties

    openstack firewall group rule set
        [--description <description>]
        [--protocol PROTOCOL]
        [--action {allow,deny,reject}]
        [--ip-version <ip-version>]
        [--source-ip-address
        <source-ip-address>
        |
        --no-source-ip-address
        ]
        [--destination-ip-address
        <destination-ip-address>
        |
        --no-destination-ip-address
        ]
        [--source-port
        <source-port>
        |
        --no-source-port
        ]
        [--destination-port
        <destination-port>
        |
        --no-destination-port
        ]
        [--share
        |
        --no-share
        ]
        [--enable-rule
        |
        --disable-rule
        ]
        [--source-firewall-group
        <source-firewall-group>
        |
        --no-source-firewall-group
        ]
        [--destination-firewall-group
        <destination-firewall-group>
        |
        --no-destination-firewall-group
        ]
        [--name <name>]
        <firewall-rule>

--description <description>

  Description of the firewall rule

--protocol <PROTOCOL>

  IP protocol (ah, dccp, egp, esp, gre, icmp, igmp, ipv6-encap, ipv6-frag, ipv6-icmp, ipv6-nonxt, ipv6-opts, ipv6-route, ospf, pgm, rsvp, sctp, tcp, udp, udplite, vrrp and integer representations [0-255] or any; default: any (all protocols))

--action <ACTION>

  Action for the firewall rule

--ip-version <ip-version>

  Set IP version 4 or 6 (default is 4)

--source-ip-address <source-ip-address>

  Source IP address or subnet

--no-source-ip-address

  Detach source IP address

--destination-ip-address <destination-ip-address>

  Destination IP address or subnet

--no-destination-ip-address

  Detach destination IP address

--source-port <source-port>

  Source port number or range (integer in [1, 65535] or range like 123:456)

--no-source-port

  Detach source port number or range

--destination-port <destination-port>

  Destination port number or range(integer in [1, 65535] or range like 123:456)

--no-destination-port

  Detach destination port number or range

--share

  Share the firewall rule to be used in all projects (by default, it is restricted to be used by the current project).

--no-share

  Restrict use of the firewall rule to the current project

--enable-rule

  Enable this rule (default is enabled)

--disable-rule

  Disable this rule

--source-firewall-group <source-firewall-group>

  Source firewall group (name or ID)

--no-source-firewall-group

  No associated source firewall group

--destination-firewall-group <destination-firewall-group>

  Destination firewall group (name or ID)

--no-destination-firewall-group

  No associated destination firewall group

--name <name>

  Name of the firewall rule

firewall-rule

  Firewall rule to set (name or ID)

### firewall group rule show

Display firewall rule details

    openstack firewall group rule show <firewall-rule>

firewall-rule

  Firewall rule to display (name or ID)

### firewall group rule unset

Unset firewall rule properties

    openstack firewall group rule unset
        [--source-ip-address]
        [--destination-ip-address]
        [--source-port]
        [--destination-port]
        [--share]
        [--enable-rule]
        [--source-firewall-group]
        [--destination-firewall-group]
        <firewall-rule>

--source-ip-address

  Source IP address or subnet

--destination-ip-address

  Destination IP address or subnet

--source-port

  Source port number or range(integer in [1, 65535] or range like 123:456)

--destination-port

  Destination port number or range(integer in [1, 65535] or range like 123:456)

--share

  (Deprecated) Use “firewall rule set –no-share” instead. Restrict use of the firewall rule to the current project

--enable-rule

  (Deprecated) Use “firewall rule set –disable-rule” instead. Disable this rule

--source-firewall-group

  Source firewall group (name or ID)

--destination-firewall-group

  Destination firewall group (name or ID)

firewall-rule

  Firewall rule to unset (name or ID)

this page last updated: 2026-07-15 15:33:41

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.