How do I manage firewall configs and ACL rules?

Requires Elite

Quick answer

The Firewall configs and ACL rules tabs in the Provisioning area document your network security configuration: a firewall config records a configuration snapshot as text (type Default or Custom); an ACL rule describes a single access decision — action (Allow/Deny), source, destination, port and protocol (TCP/UDP).

Prerequisites

Required role Administrator, Manager or Technician

— creating and changing requires write access; only administrators may delete. Programmatically: an API token with the write scope.

Provisioning is available from the Elite tier.

Instructions

GUI (web interface)

1. Record a firewall config. Open Provisioning → Firewall configs and click “Add Firewall config”:

   • Name (required) — e.g. “DMZ baseline rules”.
   • Type (required) — Default or Custom.
   • Configuration — the rule set as text (e.g. an nftables/iptables excerpt).
   • Description (optional).

   Screenshot pending provisioning-firewall-01 Firewall configs tab with the 'Add Firewall config' dialog and configuration text field

   A firewall config as a documented configuration snapshot.

2. Create an ACL rule. Switch to ACL rules and click “Add ACL rule”:

   • Name (required) — e.g. “HTTPS from LAN to DMZ”.
   • Action (required) — Allow or Deny.
   • Source / Destination — e.g. 10.0.10.0/24 → 10.0.20.5.
   • Port — e.g. 443.
   • Protocol — TCP or UDP.
   • Description (optional).

3. Maintain them. Make changes to existing entries via the pencil icon; an administrator removes outdated entries via the trash icon.

API (curl)

Create a firewall config — POST /api/v1/provisioning/firewall-configs:

Create a firewall config

curl -X POST https://demo.notory.io/api/v1/provisioning/firewall-configs \
  -H "Authorization: Bearer inv_dein_token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "DMZ Basisregeln",
    "config_type": "default",
    "content": "table inet dmz {\n  chain input { policy drop; tcp dport { 80, 443 } accept }\n}",
    "description": "Grundschutz für die DMZ"
  }'

Create an ACL rule — POST /api/v1/provisioning/acl-rules:

Create an ACL rule

curl -X POST https://demo.notory.io/api/v1/provisioning/acl-rules \
  -H "Authorization: Bearer inv_dein_token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "HTTPS aus dem LAN zur DMZ",
    "action": "allow",
    "source": "10.0.10.0/24",
    "destination": "10.0.20.5",
    "port": 443,
    "protocol": "tcp",
    "description": "Zugriff der Clients auf den Web-Proxy"
  }'

Response (201 Created, abridged)

{
  "id": "acl_9d0e…",
  "tenant_id": "3d9b0c12-…",
  "name": "HTTPS aus dem LAN zur DMZ",
  "action": "allow",
  "source": "10.0.10.0/24",
  "destination": "10.0.20.5",
  "port": 443,
  "protocol": "tcp",
  "description": "Zugriff der Clients auf den Web-Proxy",
  "created_at": "2026-07-08T11:40:00Z",
  "updated_at": "2026-07-08T11:40:00Z"
}

Both stores support GET (list/detail), PUT (change) and DELETE (administrators only).

Possible errors: 401, 403 (Provisioning is not in your tier or no write access), 404 (entry not found), 422 (validation, e.g. a port outside 0–65535).

What happens behind the scenes?

• Documentation of the intended configuration: Notory does not distribute firewall configs and ACL rules to devices — they are the documented target state of your network security, which your automation or your workflow implements.
• Tenant isolation & audit: Both stores are tenant-bound; creating, changing and deleting is recorded in the log.
• Auditability: A well-maintained ACL store serves as evidence in audits — see Compliance.

Related topics

• Create and render configuration templates
• Document a provisioning process as a workflow
• Network — IPs, VLANs, subnets
• Provisioning — Overview