// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;

namespace Pulumi.Routeros.Ip
{
    /// <summary>
    /// ## # routeros.Ip.FirewallFilter (Resource)
    /// 
    /// ***
    /// 
    /// #### This is an alias for backwards compatibility between plugin versions.
    /// Please see documentation for routeros.Ip.IpFirewallFilter
    /// </summary>
    [RouterosResourceType("routeros:Ip/firewallFilter:FirewallFilter")]
    public partial class FirewallFilter : global::Pulumi.CustomResource
    {
        /// <summary>
        /// &lt;em&gt;Resource ID type (.id / name). This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Output("___id_")]
        public Output<int?> ___id_ { get; private set; } = null!;

        /// <summary>
        /// &lt;em&gt;Resource path for CRUD operations. This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Output("___path_")]
        public Output<string?> ___path_ { get; private set; } = null!;

        /// <summary>
        /// Action to take if a packet is matched by the rule
        /// </summary>
        [Output("action")]
        public Output<string> Action { get; private set; } = null!;

        /// <summary>
        /// Time interval after which the address will be removed from the address list specified by address-list parameter. Used in
        /// conjunction with add-dst-to-address-list or add-src-to-address-list actions.
        /// </summary>
        [Output("addressListTimeout")]
        public Output<string?> AddressListTimeout { get; private set; } = null!;

        /// <summary>
        /// The total amount of bytes matched by the rule.
        /// </summary>
        [Output("bytes")]
        public Output<int> Bytes { get; private set; } = null!;

        /// <summary>
        /// Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new
        /// chain will be created.
        /// </summary>
        [Output("chain")]
        public Output<string> Chain { get; private set; } = null!;

        [Output("comment")]
        public Output<string?> Comment { get; private set; } = null!;

        /// <summary>
        /// Matches packets only if a given amount of bytes has been transfered through the particular connection.
        /// </summary>
        [Output("connectionBytes")]
        public Output<string?> ConnectionBytes { get; private set; } = null!;

        /// <summary>
        /// Matches connections per address or address block after given value is reached. Should be used together with
        /// connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
        /// </summary>
        [Output("connectionLimit")]
        public Output<string?> ConnectionLimit { get; private set; } = null!;

        /// <summary>
        /// Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any
        /// unmarked connection.
        /// </summary>
        [Output("connectionMark")]
        public Output<string?> ConnectionMark { get; private set; } = null!;

        /// <summary>
        /// Can match connections that are srcnatted, dstnatted or both.
        /// </summary>
        [Output("connectionNatState")]
        public Output<string?> ConnectionNatState { get; private set; } = null!;

        /// <summary>
        /// Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection
        /// (0..4294967295).
        /// </summary>
        [Output("connectionRate")]
        public Output<string?> ConnectionRate { get; private set; } = null!;

        /// <summary>
        /// Interprets the connection tracking analysis data for a particular packet.
        /// </summary>
        [Output("connectionState")]
        public Output<string?> ConnectionState { get; private set; } = null!;

        /// <summary>
        /// Matches packets from related connections based on information from their connection tracking helpers.
        /// </summary>
        [Output("connectionType")]
        public Output<string?> ConnectionType { get; private set; } = null!;

        /// <summary>
        /// Match packets that contain specified text.
        /// </summary>
        [Output("content")]
        public Output<string?> Content { get; private set; } = null!;

        [Output("disabled")]
        public Output<bool?> Disabled { get; private set; } = null!;

        /// <summary>
        /// Matches DSCP IP header field.
        /// </summary>
        [Output("dscp")]
        public Output<int?> Dscp { get; private set; } = null!;

        /// <summary>
        /// Matches packets which destination is equal to specified IP or falls into specified IP range.
        /// </summary>
        [Output("dstAddress")]
        public Output<string?> DstAddress { get; private set; } = null!;

        /// <summary>
        /// Matches destination address of a packet against user-defined address list.
        /// </summary>
        [Output("dstAddressList")]
        public Output<string?> DstAddressList { get; private set; } = null!;

        /// <summary>
        /// Matches destination address type.
        /// </summary>
        [Output("dstAddressType")]
        public Output<string?> DstAddressType { get; private set; } = null!;

        /// <summary>
        /// Matches packets until a given rate is exceeded.
        /// </summary>
        [Output("dstLimit")]
        public Output<string?> DstLimit { get; private set; } = null!;

        /// <summary>
        /// List of destination port numbers or port number ranges.
        /// </summary>
        [Output("dstPort")]
        public Output<string?> DstPort { get; private set; } = null!;

        /// <summary>
        /// Configuration item created by software, not by management interface. It is not exported, and cannot be directly
        /// modified.
        /// </summary>
        [Output("dynamic")]
        public Output<bool> Dynamic { get; private set; } = null!;

        /// <summary>
        /// Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no
        /// fragments as system automatically assembles every packet
        /// </summary>
        [Output("fragment")]
        public Output<bool?> Fragment { get; private set; } = null!;

        /// <summary>
        /// Matches packets received from HotSpot clients against various HotSpot matchers.
        /// </summary>
        [Output("hotspot")]
        public Output<string?> Hotspot { get; private set; } = null!;

        /// <summary>
        /// Connection offloading for Fasttrack.
        /// </summary>
        [Output("hwOffload")]
        public Output<bool?> HwOffload { get; private set; } = null!;

        /// <summary>
        /// Matches ICMP type: code fields.
        /// </summary>
        [Output("icmpOptions")]
        public Output<string?> IcmpOptions { get; private set; } = null!;

        /// <summary>
        /// Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Output("inBridgePort")]
        public Output<string?> InBridgePort { get; private set; } = null!;

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-bridge-port.
        /// </summary>
        [Output("inBridgePortList")]
        public Output<string?> InBridgePortList { get; private set; } = null!;

        /// <summary>
        /// Interface the packet has entered the router.
        /// </summary>
        [Output("inInterface")]
        public Output<string?> InInterface { get; private set; } = null!;

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-interface.
        /// </summary>
        [Output("inInterfaceList")]
        public Output<string?> InInterfaceList { get; private set; } = null!;

        /// <summary>
        /// Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
        /// </summary>
        [Output("ingressPriority")]
        public Output<int?> IngressPriority { get; private set; } = null!;

        [Output("invalid")]
        public Output<bool> Invalid { get; private set; } = null!;

        /// <summary>
        /// Matches the policy used by IPsec. Value is written in the following format: direction, policy.
        /// </summary>
        [Output("ipsecPolicy")]
        public Output<string?> IpsecPolicy { get; private set; } = null!;

        /// <summary>
        /// Matches IPv4 header options.
        /// </summary>
        [Output("ipv4Options")]
        public Output<string?> Ipv4Options { get; private set; } = null!;

        /// <summary>
        /// Name of the target chain to jump to. Applicable only if action=jump.
        /// </summary>
        [Output("jumpTarget")]
        public Output<string?> JumpTarget { get; private set; } = null!;

        /// <summary>
        /// Layer7 filter name.
        /// </summary>
        [Output("layer7Protocol")]
        public Output<string?> Layer7Protocol { get; private set; } = null!;

        /// <summary>
        /// Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is
        /// reached. Parameters are written in the following format: rate[/time],burst:mode.
        /// </summary>
        [Output("limit")]
        public Output<string?> Limit { get; private set; } = null!;

        /// <summary>
        /// Add a message to the system log.
        /// </summary>
        [Output("log")]
        public Output<bool?> Log { get; private set; } = null!;

        /// <summary>
        /// Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
        /// </summary>
        [Output("logPrefix")]
        public Output<string?> LogPrefix { get; private set; } = null!;

        /// <summary>
        /// Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched
        /// by the rule
        /// </summary>
        [Output("nth")]
        public Output<string?> Nth { get; private set; } = null!;

        /// <summary>
        /// Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Output("outBridgePort")]
        public Output<string?> OutBridgePort { get; private set; } = null!;

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-bridge-port.
        /// </summary>
        [Output("outBridgePortList")]
        public Output<string?> OutBridgePortList { get; private set; } = null!;

        /// <summary>
        /// Interface the packet is leaving the router.
        /// </summary>
        [Output("outInterface")]
        public Output<string?> OutInterface { get; private set; } = null!;

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-interface.
        /// </summary>
        [Output("outInterfaceList")]
        public Output<string?> OutInterfaceList { get; private set; } = null!;

        /// <summary>
        /// Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any
        /// unmarked packet.
        /// </summary>
        [Output("packetMark")]
        public Output<string?> PacketMark { get; private set; } = null!;

        /// <summary>
        /// Matches packets of specified size or size range in bytes.
        /// </summary>
        [Output("packetSize")]
        public Output<string?> PacketSize { get; private set; } = null!;

        /// <summary>
        /// The total amount of packets matched by the rule.
        /// </summary>
        [Output("packets")]
        public Output<int> Packets { get; private set; } = null!;

        /// <summary>
        /// PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options
        /// in one particular stream.
        /// </summary>
        [Output("perConnectionClassifier")]
        public Output<string?> PerConnectionClassifier { get; private set; } = null!;

        /// <summary>
        /// Before which position the rule will be inserted. &gt; Please check the effect of this option, as it does not work as you
        /// think! &gt; Best way to use in conjunction with a data source. See [example](../data-sources/firewall.md#example-usage).
        /// </summary>
        [Output("placeBefore")]
        public Output<string?> PlaceBefore { get; private set; } = null!;

        /// <summary>
        /// Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if
        /// protocol is TCP or UDP
        /// </summary>
        [Output("port")]
        public Output<string?> Port { get; private set; } = null!;

        /// <summary>
        /// Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP
        /// bit, or from the priority that has been set using the set-priority action.
        /// </summary>
        [Output("priority")]
        public Output<int?> Priority { get; private set; } = null!;

        /// <summary>
        /// Matches particular IP protocol specified by protocol name or number.
        /// </summary>
        [Output("protocol")]
        public Output<string?> Protocol { get; private set; } = null!;

        /// <summary>
        /// Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold,
        /// LowPortWeight, HighPortWeight.
        /// </summary>
        [Output("psd")]
        public Output<string?> Psd { get; private set; } = null!;

        /// <summary>
        /// Matches packets randomly with a given probability.
        /// </summary>
        [Output("random")]
        public Output<int?> Random { get; private set; } = null!;

        /// <summary>
        /// Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
        /// </summary>
        [Output("rejectWith")]
        public Output<string?> RejectWith { get; private set; } = null!;

        /// <summary>
        /// Matches packets marked by mangle facility with particular routing mark.
        /// </summary>
        [Output("routingMark")]
        public Output<string?> RoutingMark { get; private set; } = null!;

        /// <summary>
        /// Matches packets which destination address is resolved in specific a routing table.
        /// </summary>
        [Output("routingTable")]
        public Output<string?> RoutingTable { get; private set; } = null!;

        /// <summary>
        /// Matches packets which source is equal to specified IP or falls into a specified IP range.
        /// </summary>
        [Output("srcAddress")]
        public Output<string?> SrcAddress { get; private set; } = null!;

        /// <summary>
        /// Matches source address of a packet against user-defined address list.
        /// </summary>
        [Output("srcAddressList")]
        public Output<string?> SrcAddressList { get; private set; } = null!;

        /// <summary>
        /// Matches source address type.
        /// </summary>
        [Output("srcAddressType")]
        public Output<string?> SrcAddressType { get; private set; } = null!;

        /// <summary>
        /// Matches source MAC address of the packet.
        /// </summary>
        [Output("srcMacAddress")]
        public Output<string?> SrcMacAddress { get; private set; } = null!;

        /// <summary>
        /// List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
        /// </summary>
        [Output("srcPort")]
        public Output<string?> SrcPort { get; private set; } = null!;

        /// <summary>
        /// Matches specified TCP flags.
        /// </summary>
        [Output("tcpFlags")]
        public Output<string?> TcpFlags { get; private set; } = null!;

        /// <summary>
        /// Matches TCP MSS value of an IP packet.
        /// </summary>
        [Output("tcpMss")]
        public Output<string?> TcpMss { get; private set; } = null!;

        /// <summary>
        /// Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time
        /// and date.
        /// </summary>
        [Output("time")]
        public Output<string?> Time { get; private set; } = null!;

        /// <summary>
        /// Allows matching HTTPS traffic based on TLS SNI hostname.
        /// </summary>
        [Output("tlsHost")]
        public Output<string?> TlsHost { get; private set; } = null!;

        /// <summary>
        /// Matches packets TTL value.
        /// </summary>
        [Output("ttl")]
        public Output<string?> Ttl { get; private set; } = null!;


        /// <summary>
        /// Create a FirewallFilter resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public FirewallFilter(string name, FirewallFilterArgs args, CustomResourceOptions? options = null)
            : base("routeros:Ip/firewallFilter:FirewallFilter", name, args ?? new FirewallFilterArgs(), MakeResourceOptions(options, ""))
        {
        }

        private FirewallFilter(string name, Input<string> id, FirewallFilterState? state = null, CustomResourceOptions? options = null)
            : base("routeros:Ip/firewallFilter:FirewallFilter", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing FirewallFilter resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static FirewallFilter Get(string name, Input<string> id, FirewallFilterState? state = null, CustomResourceOptions? options = null)
        {
            return new FirewallFilter(name, id, state, options);
        }
    }

    public sealed class FirewallFilterArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// &lt;em&gt;Resource ID type (.id / name). This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Input("___id_")]
        public Input<int>? ___id_ { get; set; }

        /// <summary>
        /// &lt;em&gt;Resource path for CRUD operations. This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Input("___path_")]
        public Input<string>? ___path_ { get; set; }

        /// <summary>
        /// Action to take if a packet is matched by the rule
        /// </summary>
        [Input("action", required: true)]
        public Input<string> Action { get; set; } = null!;

        /// <summary>
        /// Time interval after which the address will be removed from the address list specified by address-list parameter. Used in
        /// conjunction with add-dst-to-address-list or add-src-to-address-list actions.
        /// </summary>
        [Input("addressListTimeout")]
        public Input<string>? AddressListTimeout { get; set; }

        /// <summary>
        /// Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new
        /// chain will be created.
        /// </summary>
        [Input("chain", required: true)]
        public Input<string> Chain { get; set; } = null!;

        [Input("comment")]
        public Input<string>? Comment { get; set; }

        /// <summary>
        /// Matches packets only if a given amount of bytes has been transfered through the particular connection.
        /// </summary>
        [Input("connectionBytes")]
        public Input<string>? ConnectionBytes { get; set; }

        /// <summary>
        /// Matches connections per address or address block after given value is reached. Should be used together with
        /// connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
        /// </summary>
        [Input("connectionLimit")]
        public Input<string>? ConnectionLimit { get; set; }

        /// <summary>
        /// Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any
        /// unmarked connection.
        /// </summary>
        [Input("connectionMark")]
        public Input<string>? ConnectionMark { get; set; }

        /// <summary>
        /// Can match connections that are srcnatted, dstnatted or both.
        /// </summary>
        [Input("connectionNatState")]
        public Input<string>? ConnectionNatState { get; set; }

        /// <summary>
        /// Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection
        /// (0..4294967295).
        /// </summary>
        [Input("connectionRate")]
        public Input<string>? ConnectionRate { get; set; }

        /// <summary>
        /// Interprets the connection tracking analysis data for a particular packet.
        /// </summary>
        [Input("connectionState")]
        public Input<string>? ConnectionState { get; set; }

        /// <summary>
        /// Matches packets from related connections based on information from their connection tracking helpers.
        /// </summary>
        [Input("connectionType")]
        public Input<string>? ConnectionType { get; set; }

        /// <summary>
        /// Match packets that contain specified text.
        /// </summary>
        [Input("content")]
        public Input<string>? Content { get; set; }

        [Input("disabled")]
        public Input<bool>? Disabled { get; set; }

        /// <summary>
        /// Matches DSCP IP header field.
        /// </summary>
        [Input("dscp")]
        public Input<int>? Dscp { get; set; }

        /// <summary>
        /// Matches packets which destination is equal to specified IP or falls into specified IP range.
        /// </summary>
        [Input("dstAddress")]
        public Input<string>? DstAddress { get; set; }

        /// <summary>
        /// Matches destination address of a packet against user-defined address list.
        /// </summary>
        [Input("dstAddressList")]
        public Input<string>? DstAddressList { get; set; }

        /// <summary>
        /// Matches destination address type.
        /// </summary>
        [Input("dstAddressType")]
        public Input<string>? DstAddressType { get; set; }

        /// <summary>
        /// Matches packets until a given rate is exceeded.
        /// </summary>
        [Input("dstLimit")]
        public Input<string>? DstLimit { get; set; }

        /// <summary>
        /// List of destination port numbers or port number ranges.
        /// </summary>
        [Input("dstPort")]
        public Input<string>? DstPort { get; set; }

        /// <summary>
        /// Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no
        /// fragments as system automatically assembles every packet
        /// </summary>
        [Input("fragment")]
        public Input<bool>? Fragment { get; set; }

        /// <summary>
        /// Matches packets received from HotSpot clients against various HotSpot matchers.
        /// </summary>
        [Input("hotspot")]
        public Input<string>? Hotspot { get; set; }

        /// <summary>
        /// Connection offloading for Fasttrack.
        /// </summary>
        [Input("hwOffload")]
        public Input<bool>? HwOffload { get; set; }

        /// <summary>
        /// Matches ICMP type: code fields.
        /// </summary>
        [Input("icmpOptions")]
        public Input<string>? IcmpOptions { get; set; }

        /// <summary>
        /// Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Input("inBridgePort")]
        public Input<string>? InBridgePort { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-bridge-port.
        /// </summary>
        [Input("inBridgePortList")]
        public Input<string>? InBridgePortList { get; set; }

        /// <summary>
        /// Interface the packet has entered the router.
        /// </summary>
        [Input("inInterface")]
        public Input<string>? InInterface { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-interface.
        /// </summary>
        [Input("inInterfaceList")]
        public Input<string>? InInterfaceList { get; set; }

        /// <summary>
        /// Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
        /// </summary>
        [Input("ingressPriority")]
        public Input<int>? IngressPriority { get; set; }

        /// <summary>
        /// Matches the policy used by IPsec. Value is written in the following format: direction, policy.
        /// </summary>
        [Input("ipsecPolicy")]
        public Input<string>? IpsecPolicy { get; set; }

        /// <summary>
        /// Matches IPv4 header options.
        /// </summary>
        [Input("ipv4Options")]
        public Input<string>? Ipv4Options { get; set; }

        /// <summary>
        /// Name of the target chain to jump to. Applicable only if action=jump.
        /// </summary>
        [Input("jumpTarget")]
        public Input<string>? JumpTarget { get; set; }

        /// <summary>
        /// Layer7 filter name.
        /// </summary>
        [Input("layer7Protocol")]
        public Input<string>? Layer7Protocol { get; set; }

        /// <summary>
        /// Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is
        /// reached. Parameters are written in the following format: rate[/time],burst:mode.
        /// </summary>
        [Input("limit")]
        public Input<string>? Limit { get; set; }

        /// <summary>
        /// Add a message to the system log.
        /// </summary>
        [Input("log")]
        public Input<bool>? Log { get; set; }

        /// <summary>
        /// Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
        /// </summary>
        [Input("logPrefix")]
        public Input<string>? LogPrefix { get; set; }

        /// <summary>
        /// Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched
        /// by the rule
        /// </summary>
        [Input("nth")]
        public Input<string>? Nth { get; set; }

        /// <summary>
        /// Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Input("outBridgePort")]
        public Input<string>? OutBridgePort { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-bridge-port.
        /// </summary>
        [Input("outBridgePortList")]
        public Input<string>? OutBridgePortList { get; set; }

        /// <summary>
        /// Interface the packet is leaving the router.
        /// </summary>
        [Input("outInterface")]
        public Input<string>? OutInterface { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-interface.
        /// </summary>
        [Input("outInterfaceList")]
        public Input<string>? OutInterfaceList { get; set; }

        /// <summary>
        /// Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any
        /// unmarked packet.
        /// </summary>
        [Input("packetMark")]
        public Input<string>? PacketMark { get; set; }

        /// <summary>
        /// Matches packets of specified size or size range in bytes.
        /// </summary>
        [Input("packetSize")]
        public Input<string>? PacketSize { get; set; }

        /// <summary>
        /// PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options
        /// in one particular stream.
        /// </summary>
        [Input("perConnectionClassifier")]
        public Input<string>? PerConnectionClassifier { get; set; }

        /// <summary>
        /// Before which position the rule will be inserted. &gt; Please check the effect of this option, as it does not work as you
        /// think! &gt; Best way to use in conjunction with a data source. See [example](../data-sources/firewall.md#example-usage).
        /// </summary>
        [Input("placeBefore")]
        public Input<string>? PlaceBefore { get; set; }

        /// <summary>
        /// Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if
        /// protocol is TCP or UDP
        /// </summary>
        [Input("port")]
        public Input<string>? Port { get; set; }

        /// <summary>
        /// Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP
        /// bit, or from the priority that has been set using the set-priority action.
        /// </summary>
        [Input("priority")]
        public Input<int>? Priority { get; set; }

        /// <summary>
        /// Matches particular IP protocol specified by protocol name or number.
        /// </summary>
        [Input("protocol")]
        public Input<string>? Protocol { get; set; }

        /// <summary>
        /// Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold,
        /// LowPortWeight, HighPortWeight.
        /// </summary>
        [Input("psd")]
        public Input<string>? Psd { get; set; }

        /// <summary>
        /// Matches packets randomly with a given probability.
        /// </summary>
        [Input("random")]
        public Input<int>? Random { get; set; }

        /// <summary>
        /// Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
        /// </summary>
        [Input("rejectWith")]
        public Input<string>? RejectWith { get; set; }

        /// <summary>
        /// Matches packets marked by mangle facility with particular routing mark.
        /// </summary>
        [Input("routingMark")]
        public Input<string>? RoutingMark { get; set; }

        /// <summary>
        /// Matches packets which destination address is resolved in specific a routing table.
        /// </summary>
        [Input("routingTable")]
        public Input<string>? RoutingTable { get; set; }

        /// <summary>
        /// Matches packets which source is equal to specified IP or falls into a specified IP range.
        /// </summary>
        [Input("srcAddress")]
        public Input<string>? SrcAddress { get; set; }

        /// <summary>
        /// Matches source address of a packet against user-defined address list.
        /// </summary>
        [Input("srcAddressList")]
        public Input<string>? SrcAddressList { get; set; }

        /// <summary>
        /// Matches source address type.
        /// </summary>
        [Input("srcAddressType")]
        public Input<string>? SrcAddressType { get; set; }

        /// <summary>
        /// Matches source MAC address of the packet.
        /// </summary>
        [Input("srcMacAddress")]
        public Input<string>? SrcMacAddress { get; set; }

        /// <summary>
        /// List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
        /// </summary>
        [Input("srcPort")]
        public Input<string>? SrcPort { get; set; }

        /// <summary>
        /// Matches specified TCP flags.
        /// </summary>
        [Input("tcpFlags")]
        public Input<string>? TcpFlags { get; set; }

        /// <summary>
        /// Matches TCP MSS value of an IP packet.
        /// </summary>
        [Input("tcpMss")]
        public Input<string>? TcpMss { get; set; }

        /// <summary>
        /// Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time
        /// and date.
        /// </summary>
        [Input("time")]
        public Input<string>? Time { get; set; }

        /// <summary>
        /// Allows matching HTTPS traffic based on TLS SNI hostname.
        /// </summary>
        [Input("tlsHost")]
        public Input<string>? TlsHost { get; set; }

        /// <summary>
        /// Matches packets TTL value.
        /// </summary>
        [Input("ttl")]
        public Input<string>? Ttl { get; set; }

        public FirewallFilterArgs()
        {
        }
        public static new FirewallFilterArgs Empty => new FirewallFilterArgs();
    }

    public sealed class FirewallFilterState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// &lt;em&gt;Resource ID type (.id / name). This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Input("___id_")]
        public Input<int>? ___id_ { get; set; }

        /// <summary>
        /// &lt;em&gt;Resource path for CRUD operations. This is an internal service field, setting a value is not required.&lt;/em&gt;
        /// </summary>
        [Input("___path_")]
        public Input<string>? ___path_ { get; set; }

        /// <summary>
        /// Action to take if a packet is matched by the rule
        /// </summary>
        [Input("action")]
        public Input<string>? Action { get; set; }

        /// <summary>
        /// Time interval after which the address will be removed from the address list specified by address-list parameter. Used in
        /// conjunction with add-dst-to-address-list or add-src-to-address-list actions.
        /// </summary>
        [Input("addressListTimeout")]
        public Input<string>? AddressListTimeout { get; set; }

        /// <summary>
        /// The total amount of bytes matched by the rule.
        /// </summary>
        [Input("bytes")]
        public Input<int>? Bytes { get; set; }

        /// <summary>
        /// Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new
        /// chain will be created.
        /// </summary>
        [Input("chain")]
        public Input<string>? Chain { get; set; }

        [Input("comment")]
        public Input<string>? Comment { get; set; }

        /// <summary>
        /// Matches packets only if a given amount of bytes has been transfered through the particular connection.
        /// </summary>
        [Input("connectionBytes")]
        public Input<string>? ConnectionBytes { get; set; }

        /// <summary>
        /// Matches connections per address or address block after given value is reached. Should be used together with
        /// connection-state=new and/or with tcp-flags=syn because matcher is very resource intensive.
        /// </summary>
        [Input("connectionLimit")]
        public Input<string>? ConnectionLimit { get; set; }

        /// <summary>
        /// Matches packets marked via mangle facility with particular connection mark. If no-mark is set, rule will match any
        /// unmarked connection.
        /// </summary>
        [Input("connectionMark")]
        public Input<string>? ConnectionMark { get; set; }

        /// <summary>
        /// Can match connections that are srcnatted, dstnatted or both.
        /// </summary>
        [Input("connectionNatState")]
        public Input<string>? ConnectionNatState { get; set; }

        /// <summary>
        /// Connection Rate is a firewall matcher that allow to capture traffic based on present speed of the connection
        /// (0..4294967295).
        /// </summary>
        [Input("connectionRate")]
        public Input<string>? ConnectionRate { get; set; }

        /// <summary>
        /// Interprets the connection tracking analysis data for a particular packet.
        /// </summary>
        [Input("connectionState")]
        public Input<string>? ConnectionState { get; set; }

        /// <summary>
        /// Matches packets from related connections based on information from their connection tracking helpers.
        /// </summary>
        [Input("connectionType")]
        public Input<string>? ConnectionType { get; set; }

        /// <summary>
        /// Match packets that contain specified text.
        /// </summary>
        [Input("content")]
        public Input<string>? Content { get; set; }

        [Input("disabled")]
        public Input<bool>? Disabled { get; set; }

        /// <summary>
        /// Matches DSCP IP header field.
        /// </summary>
        [Input("dscp")]
        public Input<int>? Dscp { get; set; }

        /// <summary>
        /// Matches packets which destination is equal to specified IP or falls into specified IP range.
        /// </summary>
        [Input("dstAddress")]
        public Input<string>? DstAddress { get; set; }

        /// <summary>
        /// Matches destination address of a packet against user-defined address list.
        /// </summary>
        [Input("dstAddressList")]
        public Input<string>? DstAddressList { get; set; }

        /// <summary>
        /// Matches destination address type.
        /// </summary>
        [Input("dstAddressType")]
        public Input<string>? DstAddressType { get; set; }

        /// <summary>
        /// Matches packets until a given rate is exceeded.
        /// </summary>
        [Input("dstLimit")]
        public Input<string>? DstLimit { get; set; }

        /// <summary>
        /// List of destination port numbers or port number ranges.
        /// </summary>
        [Input("dstPort")]
        public Input<string>? DstPort { get; set; }

        /// <summary>
        /// Configuration item created by software, not by management interface. It is not exported, and cannot be directly
        /// modified.
        /// </summary>
        [Input("dynamic")]
        public Input<bool>? Dynamic { get; set; }

        /// <summary>
        /// Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no
        /// fragments as system automatically assembles every packet
        /// </summary>
        [Input("fragment")]
        public Input<bool>? Fragment { get; set; }

        /// <summary>
        /// Matches packets received from HotSpot clients against various HotSpot matchers.
        /// </summary>
        [Input("hotspot")]
        public Input<string>? Hotspot { get; set; }

        /// <summary>
        /// Connection offloading for Fasttrack.
        /// </summary>
        [Input("hwOffload")]
        public Input<bool>? HwOffload { get; set; }

        /// <summary>
        /// Matches ICMP type: code fields.
        /// </summary>
        [Input("icmpOptions")]
        public Input<string>? IcmpOptions { get; set; }

        /// <summary>
        /// Actual interface the packet has entered the router if the incoming interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Input("inBridgePort")]
        public Input<string>? InBridgePort { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-bridge-port.
        /// </summary>
        [Input("inBridgePortList")]
        public Input<string>? InBridgePortList { get; set; }

        /// <summary>
        /// Interface the packet has entered the router.
        /// </summary>
        [Input("inInterface")]
        public Input<string>? InInterface { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as in-interface.
        /// </summary>
        [Input("inInterfaceList")]
        public Input<string>? InInterfaceList { get; set; }

        /// <summary>
        /// Matches the priority of an ingress packet. Priority may be derived from VLAN, WMM, DSCP, or MPLS EXP bit.
        /// </summary>
        [Input("ingressPriority")]
        public Input<int>? IngressPriority { get; set; }

        [Input("invalid")]
        public Input<bool>? Invalid { get; set; }

        /// <summary>
        /// Matches the policy used by IPsec. Value is written in the following format: direction, policy.
        /// </summary>
        [Input("ipsecPolicy")]
        public Input<string>? IpsecPolicy { get; set; }

        /// <summary>
        /// Matches IPv4 header options.
        /// </summary>
        [Input("ipv4Options")]
        public Input<string>? Ipv4Options { get; set; }

        /// <summary>
        /// Name of the target chain to jump to. Applicable only if action=jump.
        /// </summary>
        [Input("jumpTarget")]
        public Input<string>? JumpTarget { get; set; }

        /// <summary>
        /// Layer7 filter name.
        /// </summary>
        [Input("layer7Protocol")]
        public Input<string>? Layer7Protocol { get; set; }

        /// <summary>
        /// Matches packets up to a limited rate (packet rate or bit rate). A rule using this matcher will match until this limit is
        /// reached. Parameters are written in the following format: rate[/time],burst:mode.
        /// </summary>
        [Input("limit")]
        public Input<string>? Limit { get; set; }

        /// <summary>
        /// Add a message to the system log.
        /// </summary>
        [Input("log")]
        public Input<bool>? Log { get; set; }

        /// <summary>
        /// Adds specified text at the beginning of every log message. Applicable if action=log or log=yes configured.
        /// </summary>
        [Input("logPrefix")]
        public Input<string>? LogPrefix { get; set; }

        /// <summary>
        /// Matches every nth packet: nth=2,1 rule will match every first packet of 2, hence, 50% of all the traffic that is matched
        /// by the rule
        /// </summary>
        [Input("nth")]
        public Input<string>? Nth { get; set; }

        /// <summary>
        /// Actual interface the packet is leaving the router if the outgoing interface is a bridge. Works only if use-ip-firewall
        /// is enabled in bridge settings.
        /// </summary>
        [Input("outBridgePort")]
        public Input<string>? OutBridgePort { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-bridge-port.
        /// </summary>
        [Input("outBridgePortList")]
        public Input<string>? OutBridgePortList { get; set; }

        /// <summary>
        /// Interface the packet is leaving the router.
        /// </summary>
        [Input("outInterface")]
        public Input<string>? OutInterface { get; set; }

        /// <summary>
        /// Set of interfaces defined in interface list. Works the same as out-interface.
        /// </summary>
        [Input("outInterfaceList")]
        public Input<string>? OutInterfaceList { get; set; }

        /// <summary>
        /// Matches packets marked via mangle facility with particular packet mark. If no-mark is set, the rule will match any
        /// unmarked packet.
        /// </summary>
        [Input("packetMark")]
        public Input<string>? PacketMark { get; set; }

        /// <summary>
        /// Matches packets of specified size or size range in bytes.
        /// </summary>
        [Input("packetSize")]
        public Input<string>? PacketSize { get; set; }

        /// <summary>
        /// The total amount of packets matched by the rule.
        /// </summary>
        [Input("packets")]
        public Input<int>? Packets { get; set; }

        /// <summary>
        /// PCC matcher allows dividing traffic into equal streams with the ability to keep packets with a specific set of options
        /// in one particular stream.
        /// </summary>
        [Input("perConnectionClassifier")]
        public Input<string>? PerConnectionClassifier { get; set; }

        /// <summary>
        /// Before which position the rule will be inserted. &gt; Please check the effect of this option, as it does not work as you
        /// think! &gt; Best way to use in conjunction with a data source. See [example](../data-sources/firewall.md#example-usage).
        /// </summary>
        [Input("placeBefore")]
        public Input<string>? PlaceBefore { get; set; }

        /// <summary>
        /// Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if
        /// protocol is TCP or UDP
        /// </summary>
        [Input("port")]
        public Input<string>? Port { get; set; }

        /// <summary>
        /// Matches the packet's priority after a new priority has been set. Priority may be derived from VLAN, WMM, DSCP, MPLS EXP
        /// bit, or from the priority that has been set using the set-priority action.
        /// </summary>
        [Input("priority")]
        public Input<int>? Priority { get; set; }

        /// <summary>
        /// Matches particular IP protocol specified by protocol name or number.
        /// </summary>
        [Input("protocol")]
        public Input<string>? Protocol { get; set; }

        /// <summary>
        /// Attempts to detect TCP and UDP scans. Parameters are in the following format WeightThreshold, DelayThreshold,
        /// LowPortWeight, HighPortWeight.
        /// </summary>
        [Input("psd")]
        public Input<string>? Psd { get; set; }

        /// <summary>
        /// Matches packets randomly with a given probability.
        /// </summary>
        [Input("random")]
        public Input<int>? Random { get; set; }

        /// <summary>
        /// Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject.
        /// </summary>
        [Input("rejectWith")]
        public Input<string>? RejectWith { get; set; }

        /// <summary>
        /// Matches packets marked by mangle facility with particular routing mark.
        /// </summary>
        [Input("routingMark")]
        public Input<string>? RoutingMark { get; set; }

        /// <summary>
        /// Matches packets which destination address is resolved in specific a routing table.
        /// </summary>
        [Input("routingTable")]
        public Input<string>? RoutingTable { get; set; }

        /// <summary>
        /// Matches packets which source is equal to specified IP or falls into a specified IP range.
        /// </summary>
        [Input("srcAddress")]
        public Input<string>? SrcAddress { get; set; }

        /// <summary>
        /// Matches source address of a packet against user-defined address list.
        /// </summary>
        [Input("srcAddressList")]
        public Input<string>? SrcAddressList { get; set; }

        /// <summary>
        /// Matches source address type.
        /// </summary>
        [Input("srcAddressType")]
        public Input<string>? SrcAddressType { get; set; }

        /// <summary>
        /// Matches source MAC address of the packet.
        /// </summary>
        [Input("srcMacAddress")]
        public Input<string>? SrcMacAddress { get; set; }

        /// <summary>
        /// List of source ports and ranges of source ports. Applicable only if a protocol is TCP or UDP.
        /// </summary>
        [Input("srcPort")]
        public Input<string>? SrcPort { get; set; }

        /// <summary>
        /// Matches specified TCP flags.
        /// </summary>
        [Input("tcpFlags")]
        public Input<string>? TcpFlags { get; set; }

        /// <summary>
        /// Matches TCP MSS value of an IP packet.
        /// </summary>
        [Input("tcpMss")]
        public Input<string>? TcpMss { get; set; }

        /// <summary>
        /// Allows to create a filter based on the packets' arrival time and date or, for locally generated packets, departure time
        /// and date.
        /// </summary>
        [Input("time")]
        public Input<string>? Time { get; set; }

        /// <summary>
        /// Allows matching HTTPS traffic based on TLS SNI hostname.
        /// </summary>
        [Input("tlsHost")]
        public Input<string>? TlsHost { get; set; }

        /// <summary>
        /// Matches packets TTL value.
        /// </summary>
        [Input("ttl")]
        public Input<string>? Ttl { get; set; }

        public FirewallFilterState()
        {
        }
        public static new FirewallFilterState Empty => new FirewallFilterState();
    }
}
