Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › CLI › Rule Workflows

Rule Workflows

zwallctl rule and block workflows

SharedStatus: SUPPORTEDAudience: security engineer

Prerequisites

zwallctl login succeeded. Enforcement node in scope if you expect drops (Hosting Agents will not drop; assign/restart return 409).

Global flags: Command Index.

zwallctl allow / deny

Syntax.

zwallctl deny <ip> [--direction inbound] [--priority 100] [--scope global] [--duration 0]
zwallctl allow <ip> [--direction inbound] [--priority 100] [--scope global] [--duration 0]

Purpose. POST /api/v1/rules. deny uses rule_type=BLOCK_IP_INBOUND. allow uses ALLOW_IP.

Defaults. --direction/-d inbound; --priority/-p 100; --scope/-s global; --duration 0 (permanent). Non-zero duration is seconds.

Edition. SHARED.

Example.

zwallctl deny 203.0.113.10
zwallctl allow 203.0.113.10 --direction inbound --priority 100 --scope global

Expected output. Created rule id / success text.

Important errors. 400 validation; 403 license; 409 Hosting cannot receive rules.

Notes. Extra JSON keys name/action/direction/enabled are sent by the CLI; Manager CreateRuleRequest does not declare them (unknown JSON fields ignored).

Related. remove, list-rules, Rules.

zwallctl remove / whitelist / unwhitelist

Syntax. zwallctl remove <ip> / whitelist <ip> / unwhitelist <ip>

Purpose. Remove IP rules or manage whitelist rules via the rules API.

Edition. SHARED.

Example. zwallctl remove 203.0.113.10

zwallctl rate-limit

Syntax. zwallctl rate-limit <ip> <pps> [--burst|-b 10] [--duration|-t 0]

Purpose. Create a rate-limit rule. <pps> is the CLI argument name — not a published product PPS SLA.

Edition. SHARED.

zwallctl block-port

Syntax. zwallctl block-port <ip> <port> [--protocol tcp] [--direction inbound]

Purpose. Port block rule.

Edition. SHARED.

zwallctl temp-block / temp-allow / unblock

Syntax.

zwallctl temp-block <ip> <duration> [--port|-p 0] [--protocol tcp]
zwallctl temp-allow <ip> <duration> [--port|-p 0] [--protocol tcp]
zwallctl unblock <ip>

Purpose. Temporary block/allow; unblock calls Manager unblock (DELETE /api/v1/security/blocked-ips/:ip or equivalent).

Edition. SHARED.

Related. Blocks, temp-to-perm APIs.

zwallctl flush / enable / disable / reload

Syntax. zwallctl flush / enable / disable / reload

Purpose. Flush all rules (destructive); enable/disable all; force rule sync to Agents.

Edition. SHARED.

Security. flush is host/fleet policy destruction. Confirm before production.

zwallctl restart

Syntax. zwallctl restart --agent ID / zwallctl restart --all

Purpose. POST /api/v1/agents/:id/restart. Not a guaranteed SIGTERM.

Errors. 409 Hosting observation Agents cannot receive restart commands.

Related. systemd, Agent enrollment.

Testing mode 

zwallctl test-flush [interval]
zwallctl test-flush-disable
zwallctl test-flush-status

See Testing Mode. POSTs /api/v1/maintenance/testing-mode*.