Firewall rules

We enforce firewall rules in the network before traffic reaches the instance. Rules apply to INBOUND or OUTBOUND traffic and run in descending priority order. Each direction has an ACCEPT or DROP default policy for traffic matching no rule.

ACCEPT admits traffic and automatically allows connection replies. STATELESS admits traffic without connection tracking, so replies need a rule in the return direction. DROP discards traffic. Adding a rule does not change the default policies.

See Workspaces and scope and Pagination for shared conventions. All path parameters are required. All query parameters are optional. POST and PATCH requests require a JSON body. Changes propagate through workflows.

Create a firewall rule

POST/v1/instances/{iid}/firewall/rulesCreate a firewall rule

Creates a rule on the instance. Omitting priority assigns the current highest priority plus one, capped at 1000. The first rule defaults to 0.

Path parameters

Name	Type	Description
iid	string	Instance ID

Request body

Field	Type	Required	Description
action	string	yes	ACCEPT, STATELESS, or DROP
direction	string	yes	INBOUND or OUTBOUND
type	string	yes	IPv4 or IPv6
protocol	string	yes	TCP, UDP, ICMP, or ALL
local_port_start	integer or null	no	First port on the instance's side, 1 to 65535. TCP and UDP only.
local_port_end	integer or null	no	Last local port. Requires local_port_start and must be at least its value. Defaults to the start.
remote_port_start	integer or null	no	First port on the peer's side, 1 to 65535. TCP and UDP only.
remote_port_end	integer or null	no	Last remote port. Requires remote_port_start and must be at least its value. Defaults to the start.
remote_cidr	string or null	no	Peer address range. Defaults to 0.0.0.0/0 for IPv4 or ::/0 for IPv6.
local_cidr	string or null	no	Instance address range. Omit or send null to match all local addresses.
bps_limit	integer or null	no	Bits per second, 1 to 10,000,000,000. Only accepted for ACCEPT or STATELESS rules.
priority	integer or null	no	Evaluation order, 0 to 1000. Higher runs first.
description	string or null	no	Optional label, 1 to 255 characters when supplied.

Both ending ports must be between 1 and 65535. Address ranges must match type.

curl -X POST https://api.galaxygate.net/v1/instances/101/firewall/rules \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "ACCEPT",
    "direction": "INBOUND",
    "type": "IPv4",
    "protocol": "TCP",
    "local_port_start": 443,
    "remote_cidr": "0.0.0.0/0",
    "priority": 10,
    "description": "Allow inbound HTTPS"
  }'

Returns 201 Created with a WorkflowWithResource containing workflow and a resource reference with id, name, type, and optional parent. It does not contain the full rule. Poll the workflow until the network change completes.

List firewall rules for an instance

GET/v1/instances/{iid}/firewall/rulesList firewall rules (paginated)

Returns rules attached to the instance with pagination.

Path parameters

Name	Type	Description
iid	string	Instance ID

Query parameters

Name	Type	Description
type	string	Filter by IPv4 or IPv6
protocol	string	Filter by TCP, UDP, ICMP, or ALL
action	string	Filter by ACCEPT, STATELESS, or DROP

Plus the shared pagination parameters. Returns 200 OK with a KeysetResultFirewallRuleListView containing items and pagination fields. Each item includes id, instance, and the rule fields above.

Update a firewall rule

PATCH/v1/instances/{iid}/firewall/rules/{rid}Replace a firewall rule

Replaces the contents of a rule. Send the required fields even when changing only one value. Omitted port, address, and rate limit fields reset to their defaults. Omitting priority assigns the current highest priority plus one, capped at 1000. An omitted description leaves the existing label unchanged.

Path parameters

Name	Type	Description
iid	string	Instance ID
rid	string	Firewall rule ID belonging to this instance

Request body

Uses the create rule fields, including required action, direction, type, and protocol.

{
  "action": "ACCEPT",
  "direction": "INBOUND",
  "type": "IPv4",
  "protocol": "TCP",
  "local_port_start": 443,
  "priority": 20
}

Returns 200 OK with a WorkflowWithResource containing workflow and the rule's resource reference.

Delete a firewall rule

DELETE/v1/instances/{iid}/firewall/rules/{rid}Delete a firewall rule

Removes a rule and starts a workflow to propagate the network change.

Path parameters

Name	Type	Description
iid	string	Instance ID
rid	string	Firewall rule ID belonging to this instance

Returns 200 OK with a WorkflowData object.

Update an instance firewall

PATCH/v1/instances/{iid}/firewallUpdate defaults and replace rules

Updates default policies and optionally replaces every rule in one request. Omitted policies and omitted rules remain unchanged. An empty rules array clears all rules. Neither defaults nor rules accepts null.

Path parameters

Name	Type	Description
iid	string	Instance ID

Request body

Field	Type	Required	Description
defaults	object	no	Default policies for traffic matching no rule
defaults.inbound	string or null	no	ACCEPT or DROP. Omitted or null leaves the policy unchanged.
defaults.outbound	string or null	no	ACCEPT or DROP. Omitted or null leaves the policy unchanged.
rules	object[]	no	Complete replacement list using the create rule fields

{
  "defaults": {
    "inbound": "DROP",
    "outbound": "ACCEPT"
  },
  "rules": [
    {
      "action": "ACCEPT",
      "direction": "INBOUND",
      "type": "IPv4",
      "protocol": "TCP",
      "local_port_start": 443
    }
  ]
}

Returns 200 OK with a WorkflowData object.

List workspace firewall summary

GET/v1/workspaces/{wid}/firewallList instance firewall defaults and rule counts

Returns every instance in the workspace, including instances with no rules, with pagination.

Path parameters

Name	Type	Description
wid	string	Workspace ID

Query parameters

Accepts the shared pagination parameters.

Returns 200 OK with a KeysetResultInstanceFirewallView containing items and pagination fields. Each item has instance, defaults, and rules. instance is an instance object. defaults holds inbound and outbound policies. rules has total, inbound, and outbound counts. Each direction has accept, stateless, and drop counts.

Reinstall the recommended firewall

POST/v1/commands/reinstall-recommended-firewallReplace rules with the recommended firewall

Discards existing rules, allows outbound traffic, and drops unmatched inbound traffic. Adds inbound SSH and rate limited ICMP rules for both IPv4 and IPv6.

Request body

Field	Type	Required	Description
instance	string	yes	Instance ID

{
  "instance": "1463106077196308568"
}

Returns 200 OK with a WorkflowData object.