Skip to content

Security policy

Security policy (under Security in the device menu) is where a device's firewall and NAT rules live. The page is titled Policies and has two tabs:

  • Firewall — which traffic is allowed. See Firewall.
  • NAT — how addresses are translated. See NAT.

They share one page because they are usually edited together: a port forward that no firewall rule allows does nothing.

Simple and Advanced

The Simple / Advanced switch at the top applies to both tabs.

  • Simple collapses the rules an integration created into one line — {count} rule(s) created automatically by a profile — with Show them to expand. The page reminds you: Rules created by a profile are summarised. Switch to advanced to see and edit them.
  • Advanced lists every rule.

Nothing changes on the device either way. Your choice is stored with your account, so it follows you to another machine.

Seeing the generated pf

Show pf.conf, at the foot of each tab, renders what will be loaded on the device. On the NAT tab, each rule also has Show pf rule.

Applying

Every edit on this page is a pending change. The bar at the top of the device says You have unsaved changes.

  1. Click Apply Changes. You can add a Change note (optional) first.
  2. The bar shows Config applied — {seconds}s to confirm or rollback.
  3. Check the device is still reachable, then click Confirm.

If you do not confirm in time, or click Rollback, the device restores its previous configuration on its own. This is what makes it safe to edit firewall rules on a device you can only reach over the network. See History.