{"id":1785,"date":"2026-07-01T17:46:35","date_gmt":"2026-07-01T17:46:35","guid":{"rendered":"https:\/\/kb.powercode.com\/?post_type=ht_kb&p=1785"},"modified":"2026-07-01T18:02:05","modified_gmt":"2026-07-01T18:02:05","slug":"use-the-firewall-page","status":"publish","type":"ht_kb","link":"https:\/\/kb.powercode.com\/?ht_kb=use-the-firewall-page","title":{"rendered":"Use the Firewall page"},"content":{"rendered":"\n

The Firewall<\/strong> page edits the Link host firewall through a safe apply workflow. Changes must be confirmed after they are applied; otherwise they automatically roll back.<\/p>\n\n\n\n

Open the Firewall page<\/h2>\n\n\n\n
    \n
  1. Sign in to Powercode Link.<\/li>\n\n\n\n
  2. Select Firewall<\/strong> in the page selector.<\/li>\n<\/ol>\n\n\n\n

    You need configuration\/write access to use this page.<\/p>\n\n\n\n

    Understand the safety workflow<\/h2>\n\n\n\n

    Firewall changes can disconnect your browser session. Link protects against lockout by using a confirmation timer:<\/p>\n\n\n\n

      \n
    1. You edit a candidate firewall ruleset.<\/li>\n\n\n\n
    2. You save and validate the candidate.<\/li>\n\n\n\n
    3. You apply the candidate with a rollback timeout.<\/li>\n\n\n\n
    4. Link starts a countdown.<\/li>\n\n\n\n
    5. If the connection still works, you select Confirm Changes<\/strong>.<\/li>\n\n\n\n
    6. If you do not confirm in time, Link automatically rolls back.<\/li>\n<\/ol>\n\n\n\n

      If you know the change is wrong, select Rollback Now<\/strong> instead of waiting for the timer.<\/p>\n\n\n\n

      Read the status banner<\/h2>\n\n\n\n

      The top banner shows the firewall daemon state:<\/p>\n\n\n\n

        \n
      • Host firewall<\/strong>: the daemon is idle and ready.<\/li>\n\n\n\n
      • Firewall Changes Pending Confirmation<\/strong>: a ruleset was applied and must be confirmed before the timer expires.<\/li>\n\n\n\n
      • Connected<\/strong> or Connection Lost<\/strong>: whether the UI can currently reach the firewall daemon.<\/li>\n<\/ul>\n\n\n\n

        Edit rules<\/h2>\n\n\n\n

        The Rule editor<\/strong> uses structured firewall JSON.<\/p>\n\n\n\n

        Common fields in the default model include:<\/p>\n\n\n\n

          \n
        • default_policy<\/code>: default handling for unmatched traffic.<\/li>\n\n\n\n
        • rules<\/code>: ordered rule entries.<\/li>\n\n\n\n
        • description<\/code>: human-readable rule purpose.<\/li>\n\n\n\n
        • action<\/code>: usually allow<\/code> or another supported firewall action.<\/li>\n\n\n\n
        • protocol<\/code>: for example tcp<\/code> or udp<\/code>.<\/li>\n\n\n\n
        • ports<\/code>: port list.<\/li>\n\n\n\n
        • source<\/code>: allowed source network or any<\/code>.<\/li>\n\n\n\n
        • family<\/code>: ipv4<\/code>, ipv6<\/code>, or both<\/code>.<\/li>\n<\/ul>\n\n\n\n

          The default rules allow loopback, established sessions, SSH, HTTP, HTTPS, DHCPv4, and DHCPv6.<\/p>\n\n\n\n

          Configure SNAT for probe traffic<\/h2>\n\n\n\n

          Use the top-level nat_rules<\/code> array to configure managed source NAT. This is useful when Docker-based SNMP or ICMP probes must leave the Link host with a specific source IP.<\/p>\n\n\n\n

          Example SNAT rules equivalent to Docker SNMP\/ICMP probe SNAT on ens160<\/code>:<\/p>\n\n\n\n

          {\n  \"version\": 1,\n  \"default_policy\": \"drop\",\n  \"rules\": [\n    { \"description\": \"Loopback traffic\", \"action\": \"allow\", \"interface\": \"lo\" },\n    { \"description\": \"Established and related sessions\", \"action\": \"allow\", \"established\": true },\n    { \"description\": \"SSH access\", \"action\": \"allow\", \"protocol\": \"tcp\", \"ports\": [22], \"source\": \"any\", \"family\": \"both\" },\n    { \"description\": \"HTTP access\", \"action\": \"allow\", \"protocol\": \"tcp\", \"ports\": [80], \"source\": \"any\", \"family\": \"both\" },\n    { \"description\": \"HTTPS access\", \"action\": \"allow\", \"protocol\": \"tcp\", \"ports\": [443], \"source\": \"any\", \"family\": \"both\" },\n    { \"description\": \"DHCPv4 server\", \"action\": \"allow\", \"protocol\": \"udp\", \"ports\": [67], \"source\": \"any\", \"family\": \"ipv4\" },\n    { \"description\": \"DHCPv6 server\", \"action\": \"allow\", \"protocol\": \"udp\", \"ports\": [547], \"source\": \"any\", \"family\": \"ipv6\" }\n  ],\n  \"nat_rules\": [\n    {\n      \"description\": \"SNAT Docker SNMP probes\",\n      \"type\": \"snat\",\n      \"out_interface\": \"ens160\",\n      \"source\": \"172.19.0.0\/16\",\n      \"destinations\": [\"10.0.0.0\/8\"],\n      \"protocol\": \"udp\",\n      \"ports\": [161],\n      \"snat_to\": \"10.0.20.5\"\n    },\n    {\n      \"description\": \"SNAT Docker ICMP probes\",\n      \"type\": \"snat\",\n      \"out_interface\": \"ens160\",\n      \"source\": \"172.19.0.0\/16\",\n      \"destinations\": [\"10.0.0.0\/8\"],\n      \"protocol\": \"icmp\",\n      \"snat_to\": \"10.0.20.5\"\n    }\n  ]\n}<\/code><\/pre>\n\n\n\n
          SNAT fields:<\/p>\n\n\n\n
            \n
          • type<\/code>: currently snat<\/code>.<\/li>\n\n\n\n
          • out_interface<\/code>: required outgoing interface name, such as ens160<\/code>. in_interface<\/code> is not supported for managed SNAT.<\/li>\n\n\n\n
          • source<\/code>: optional container CIDR or address, usually the Docker network subnet. Omit it or leave it empty to generate a destination\/interface\/protocol\/port-constrained SNAT rule with no source-address match.<\/li>\n\n\n\n
          • destinations<\/code>: required live-device CIDRs or addresses. Broad destinationless SNAT is rejected.<\/li>\n\n\n\n
          • protocol<\/code>: required explicit probe protocol: tcp<\/code>, udp<\/code>, or icmp<\/code>.<\/li>\n\n\n\n
          • ports<\/code>: required destination ports for TCP\/UDP rules, such as SNMP UDP\/161. ICMP does not use ports.<\/li>\n\n\n\n
          • snat_to<\/code>: source IP to translate matching packets to. Use an address actually owned by the Link host on the outgoing path; do not spoof an unrelated Powercode server address.<\/li>\n<\/ul>\n\n\n\n
            Confirm the Docker subnet, live-device destination CIDRs, outgoing interface, and local snat_to<\/code> address before applying SNAT. The Docker subnet may differ from 172.19.0.0\/16<\/code> on some deployments.<\/p>\n\n\n\n
            Save, validate, and apply<\/h2>\n\n\n\n
              \n
            1. Edit the JSON ruleset.<\/li>\n\n\n\n
            2. Select Save Draft<\/strong>.<\/li>\n\n\n\n
            3. Select Validate<\/strong>.<\/li>\n\n\n\n
            4. Fix any validation errors.<\/li>\n\n\n\n
            5. Set the Rollback timeout<\/strong>. The default is 60 seconds.<\/li>\n\n\n\n
            6. Select Apply Changes<\/strong>.<\/li>\n\n\n\n
            7. Confirm that you still have access.<\/li>\n\n\n\n
            8. Select Confirm Changes<\/strong> before the countdown expires.<\/li>\n<\/ol>\n\n\n\n
              \n
              Caution:<\/strong> Always keep a management access path open. Be especially careful when editing SSH, HTTPS, and management-network rules.<\/p>\n<\/blockquote>\n\n\n\n
              Use version history<\/h2>\n\n\n\n
              The page keeps saved firewall versions.<\/p>\n\n\n\n
              To load an earlier version:<\/p>\n\n\n\n
                \n
              1. Choose a version from Version history<\/strong>.<\/li>\n\n\n\n
              2. Select Load Version<\/strong>.<\/li>\n\n\n\n
              3. Review the loaded content.<\/li>\n\n\n\n
              4. Save, validate, and apply it like any other candidate.<\/li>\n<\/ol>\n\n\n\n
                Loading a version does not apply it immediately.<\/p>\n\n\n\n
                Troubleshooting<\/h2>\n\n\n\n
                  \n
                • If the UI loses connection after applying a change, wait for automatic rollback or use out-of-band server access.<\/li>\n\n\n\n
                • If validation fails, fix the JSON syntax or unsupported rule fields and validate again.<\/li>\n\n\n\n
                • If the firewall daemon shows an error, contact Powercode support or check the Link host service logs.<\/li>\n\n\n\n
                • If you are not authorized, ask for gateway:config:write<\/code> access.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
                  The Firewall page edits the Link host firewall through a safe apply workflow. Changes must be confirmed after they are applied; otherwise they automatically roll back. Open the Firewall page You need configuration\/write access to use this page. Understand the safety workflow Firewall changes can disconnect your browser session. Link…<\/p>\n","protected":false},"author":20,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":[],"ht-kb-category":[134],"ht-kb-tag":[],"_links":{"self":[{"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/ht-kb\/1785"}],"collection":[{"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1785"}],"version-history":[{"count":1,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/ht-kb\/1785\/revisions"}],"predecessor-version":[{"id":1786,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=\/wp\/v2\/ht-kb\/1785\/revisions\/1786"}],"wp:attachment":[{"href":"https:\/\/kb.powercode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1785"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fht-kb-category&post=1785"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/kb.powercode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fht-kb-tag&post=1785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}