Interface FirewallRule.Builder

All Superinterfaces:
Buildable, CopyableBuilder<FirewallRule.Builder,FirewallRule>, SdkBuilder<FirewallRule.Builder,FirewallRule>, SdkPojo
Enclosing class:
FirewallRule
@Mutable @NotThreadSafe public static interface FirewallRule.Builder extends SdkPojo, CopyableBuilder<FirewallRule.Builder,FirewallRule>

  • Method Details

    • action

      FirewallRule.Builder action(String action)

      The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

      • ACCEPT - Allow the traffic.

      • DROP - Block the traffic and discontinue inspection.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • REJECT_DST - Block the traffic and send a TCP reset packet to the destination.

      • REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

      You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Parameters:
      action - The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

      • ACCEPT - Allow the traffic.

      • DROP - Block the traffic and discontinue inspection.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • REJECT_DST - Block the traffic and send a TCP reset packet to the destination.

      • REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

      You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • action

      FirewallRule.Builder action(FirewallRuleAction action)

      The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

      • ACCEPT - Allow the traffic.

      • DROP - Block the traffic and discontinue inspection.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • REJECT_DST - Block the traffic and send a TCP reset packet to the destination.

      • REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

      You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Parameters:
      action - The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

      • ACCEPT - Allow the traffic.

      • DROP - Block the traffic and discontinue inspection.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • REJECT_DST - Block the traffic and send a TCP reset packet to the destination.

      • REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

      You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • actionScope

      FirewallRule.Builder actionScope(String actionScope)

      The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

      • PACKET - The current packet only.

      • HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.

      • TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.

      • FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

      In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

      Parameters:
      actionScope - The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

      • PACKET - The current packet only.

      • HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.

      • TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.

      • FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

      In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • actionScope

      FirewallRule.Builder actionScope(ActionScope actionScope)

      The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

      • PACKET - The current packet only.

      • HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.

      • TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.

      • FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

      In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

      Parameters:
      actionScope - The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

      • PACKET - The current packet only.

      • HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.

      • TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.

      • FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

      In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • hook

      FirewallRule.Builder hook(String hook)

      The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation.

      Parameters:
      hook - The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • hook

      FirewallRule.Builder hook(HookKey hook)

      The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation.

      Parameters:
      hook - The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • protocol

      FirewallRule.Builder protocol(String protocol)

      The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. Network Firewall rejects a rule whose protocol doesn't match its hook.

      Parameters:
      protocol - The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. Network Firewall rejects a rule whose protocol doesn't match its hook.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • protocol

      FirewallRule.Builder protocol(FirewallRuleProtocol protocol)

      The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. Network Firewall rejects a rule whose protocol doesn't match its hook.

      Parameters:
      protocol - The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. Network Firewall rejects a rule whose protocol doesn't match its hook.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • sourceIPs

      FirewallRule.Builder sourceIPs(String sourceIPs)

      The source IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

      Parameters:
      sourceIPs - The source IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • destIPs

      FirewallRule.Builder destIPs(String destIPs)

      The destination IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

      Parameters:
      destIPs - The destination IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • sourcePorts

      FirewallRule.Builder sourcePorts(String sourcePorts)

      The source ports to inspect for.

      Parameters:
      sourcePorts - The source ports to inspect for.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • destPorts

      FirewallRule.Builder destPorts(String destPorts)

      The destination ports to inspect for.

      Parameters:
      destPorts - The destination ports to inspect for.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ruleOptions

      FirewallRule.Builder ruleOptions(Collection<RuleOption> ruleOptions)

      Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.

      Parameters:
      ruleOptions - Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ruleOptions

      FirewallRule.Builder ruleOptions(RuleOption... ruleOptions)

      Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.

      Parameters:
      ruleOptions - Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ruleOptions

      FirewallRule.Builder ruleOptions(Consumer<RuleOption.Builder>... ruleOptions)

      Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.

      This is a convenience method that creates an instance of the RuleOption.Builder avoiding the need to create one manually via RuleOption.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to ruleOptions(List<RuleOption>).

      Parameters:
      ruleOptions - a consumer that will call methods on RuleOption.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • acceptPriorHooks

      FirewallRule.Builder acceptPriorHooks(Boolean acceptPriorHooks)

      Whether Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule's hook. Because the firewall engine is drop by default, accepting prior hooks lets you author a single rule for the hook you care about, instead of also authoring a rule for each earlier hook. This setting accepts the earlier application-layer hooks only; it doesn't accept the TCP layer. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Parameters:
      acceptPriorHooks - Whether Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule's hook. Because the firewall engine is drop by default, accepting prior hooks lets you author a single rule for the hook you care about, instead of also authoring a rule for each earlier hook. This setting accepts the earlier application-layer hooks only; it doesn't accept the TCP layer. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • alertEnabled

      FirewallRule.Builder alertEnabled(Boolean alertEnabled)

      Specifies whether the rule also generates an alert log for the traffic that it matches. Turning on alerting adds a secondary alert action to the rule, so that Network Firewall logs the match in addition to taking the rule's primary action.

      Parameters:
      alertEnabled - Specifies whether the rule also generates an alert log for the traffic that it matches. Turning on alerting adds a secondary alert action to the rule, so that Network Firewall logs the match in addition to taking the rule's primary action.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • bypassIPSEnabled

      FirewallRule.Builder bypassIPSEnabled(Boolean bypassIPSEnabled)

      Specifies whether an accepted connection bypasses the IPS engine. By default, traffic that the firewall engine accepts advances to the IPS engine for threat inspection. When you turn on this setting for an accept rule, the accepted traffic goes straight to its destination without IPS inspection. You can set the bypass only on accept rules, and it uses the same scope as the rule's accept action; only the flow and packet scopes support a bypass. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

      Parameters:
      bypassIPSEnabled - Specifies whether an accepted connection bypasses the IPS engine. By default, traffic that the firewall engine accepts advances to the IPS engine for threat inspection. When you turn on this setting for an accept rule, the accepted traffic goes straight to its destination without IPS inspection. You can set the bypass only on accept rules, and it uses the same scope as the rule's accept action; only the flow and packet scopes support a bypass. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ruleMetadata

      FirewallRule.Builder ruleMetadata(RuleMetadata ruleMetadata)

      Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn't change how the rule matches or acts on traffic.

      Parameters:
      ruleMetadata - Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn't change how the rule matches or acts on traffic.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ruleMetadata

      default FirewallRule.Builder ruleMetadata(Consumer<RuleMetadata.Builder> ruleMetadata)

      Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn't change how the rule matches or acts on traffic.

      This is a convenience method that creates an instance of the RuleMetadata.Builder avoiding the need to create one manually via RuleMetadata.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to ruleMetadata(RuleMetadata).

      Parameters:
      ruleMetadata - a consumer that will call methods on RuleMetadata.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also: