Firewall rules

A firewall rule is a network ACL entry that is enforced in front of an instance before traffic reaches the guest. Rules are stateless and evaluated in descending priority order (highest priority value runs first). Once any rule exists for an instance, all traffic that does not match an ACCEPT rule is implicitly dropped -- the default-allow posture is replaced with default-deny the moment the first rule is created.

The firewall is toggled per instance via firewall_enabled on PATCH /v1/instances/{id}. When firewall_enabled is false, rules are stored but not enforced.

See Workspaces and scope and Pagination for shared conventions.

Create a firewall rule

POST/v1/instances/{id}/firewall-rulesCreate a firewall rule

Creates a new rule on the specified instance. Responds 201 Created with the created rule wrapped in a workflow.

Path parameters

Name	Type	Description
id	integer	Instance ID

Request body

Field	Type	Required	Description
type	string	yes	IP version: IPv4 or IPv6
protocol	string	yes	Network protocol: TCP, UDP, or ICMP
action	string	yes	What to do when the rule matches: ACCEPT or DROP
port_start	integer		First port in the range (1-65535). TCP and UDP only. Required when port_end is set.
port_end	integer		Last port in the range (1-65535). Must be >= port_start. Omit to match a single port.
remote	string		Source CIDR to match, for example 203.0.113.0/24. Defaults to 0.0.0.0/0 (IPv4) or ::/0 (IPv6) when omitted.
local	string		Destination CIDR to match within the instance address space. Omit to match all local addresses.
bps_limit	integer		Rate limit in bits per second (1 to 10,000,000,000). Mutually exclusive with pps_limit.
pps_limit	integer		Rate limit in packets per second (1 to 10,000,000,000). Takes precedence over bps_limit when both are sent.
priority	integer		Evaluation order, 1 to 100, higher runs first. Defaults to 1.
description	string		Free-text label, up to 255 characters.

curl -X POST https://api.galaxygate.net/v1/instances/101/firewall-rules \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "IPv4",
    "protocol": "TCP",
    "action": "ACCEPT",
    "port_start": 443,
    "remote": "0.0.0.0/0",
    "priority": 10,
    "description": "Allow inbound HTTPS"
  }'

Returns a WorkflowWithResource containing the new firewall rule. The rule takes effect as soon as the workflow completes.

List firewall rules for an instance

GET/v1/instances/{iid}/firewall-rulesList firewall rules (paginated)

Returns the rules attached to one instance, newest first, with pagination.

Path parameters

Name	Type	Description
iid	integer	Instance ID

Query parameters

Name	Type	Description
type	string	Filter by IP version (IPv4 or IPv6)
protocol	string	Filter by protocol (TCP, UDP, ICMP)
action	string	Filter by action (ACCEPT or DROP)

Plus the shared pagination parameters. Returns a paged list of firewall rules.

Fetch a firewall rule

GET/v1/firewall-rules/{id}Fetch a firewall rule

Path parameters

Name	Type	Description
id	integer	Firewall rule ID

Returns the full firewall rule object.

Delete a firewall rule

DELETE/v1/firewall-rules/{id}Delete a firewall rule

Removes one rule. The change takes effect immediately.

Path parameters

Name	Type	Description
id	integer	Firewall rule ID

Returns a WorkflowData object.

List workspace firewall summary

GET/v1/workspaces/{wid}/firewall-rulesList instances and their firewall rule counts

Returns every instance in the workspace with its rule count. Useful for auditing which instances have rules configured.

Path parameters

Name	Type	Description
wid	integer	Workspace ID

Returns a list of objects, each with instance (ID), name, and rules (count of rules on that instance).