How to enable/disable existing firewall rules?

[winstonw]

Hello. Thank you for creating this awesome project.

How do I enable/disable an existing fw rule via pfsense-api?
I tried to make a PUT request to /api/v1/firewall/rule with payloads:
'{"tracker": "#######", "disable": false}' or
'{"tracker": "#######", "disable": true}'

Nothing changed on the pfSense web UI after successful requests.

Did I misunderstood anything?

[jaredhendrickson13]

Looks like you are using disable in your request body instead of disabled. Here's an example curl request I just used for disabling an existing firewall rule:

curl -s -k -u admin:pfsense -X PUT https://localhost/api/v1/firewall/rule -d '{"tracker": 1714079391, "disabled": true}'

After running, the rule now shows as disabled:

[winstonw]

My bad. I misread the property name from GET request result as "disable". The api now works as expected. Thank you.

[magtimmermans]

How will this work on V2?

This seems not work:
curl --location --request PATCH 'http:///api/v2/firewall/rule'
--header 'X-API-Key: '
--header 'Content-Type: application/json'
--data-raw '{
"id": 9,
"disabled": false
}'

result:
{
"code": 400,
"status": "bad request",
"response_id": "MODEL_REQUIRES_ID",
"message": "Field id is required.",
"data": []
}

[jaredhendrickson13]

The disabled field works the same as v1 with the exception of it being a PATCH request instead of PUT. However, the error you're getting suggests that the API is not receiving your request body at all. Looks like you're making the request using http? If so and your pfSense instance is using HTTPS, you must use HTTPS to make the API request. Otherwise, the HTTP redirect will strip the original request of its original method and request body.

[magtimmermans]

Thanks that seems the issue. I overlook this.

[schneemaier]

Hello, I am working on migrating from v1 to v2 after updating pfsense to 2.8 and realized that v1 is not supported...

In v1 I was able to enable / disable firewall rules using the tracking ID. In v2 it seems that I have to use an ID, which is not presistent. Is there an easy way to get this ID based on the Tracking ID or I will have to always start with querying all the rules and find the ID based on the tracking ID?

Also in v1 i was able to use 'apply': true to apply the change directly. Does this work under v2 or I will have to call the /api/v2/firewall/apply endpoint to make the change?

Thanks

[jaredhendrickson13]

With v2 you will need to query for the object's current ID using a more persistent value like the rule tracker or description. The unfortunate reality is that objects in the pfSense configuration are only indexed by these dynamic IDs (except for objects indexed by an interface ID like interfaces and DHCP servers). Using any other object value requires single reads to iterate over all objects until it finds a match which causes major performance issues for users with large configs and v2's object relation management system.

And yes, v2 also has the apply control parameter.

[schneemaier]

thank you!