A draft lets you prepare several firewall changes without applying them, see exactly what they would change in the kernel, then apply them in one step — or throw them away.
Outside a draft nothing changes: each change is applied a few seconds later and must be confirmed.
Go to Your Firewall › Configuration history and click Open a draft, then confirm.
From now on:
A draft cannot be opened while a change is waiting for confirmation, or while a change is still being saved: confirm or roll back first, or try again a few seconds later.
Some settings are always applied immediately, even during a draft, and Discard does not undo them:
The preview lists the trusted-network changes made during the draft under Changes already applied, not undone by Discard.
Enabling or disabling the firewall feature is refused while a draft is open.
Click Preview in the banner (or open the page /firewall-draft), then Compute the preview. The computation takes a few seconds; the page refreshes by itself.
The preview is built exactly as the real firewall would be, then loaded and checked in a throw-away network namespace: the kernel of the appliance validates every line, but the live traffic is never touched.
| Section | Content |
|---|---|
| Configuration changes | What changed in the configuration since the draft was opened (rules, NAT, interfaces, objects, options), as in the history differences. |
| Kernel rules added or removed | The iptables lines that would appear or disappear. Lines that do not change are only counted (Unchanged lines). |
| Rules iptables would refuse | Lines the kernel rejected during the check, with the iptables error. They would be left out when applying, exactly as during a normal rebuild. |
| Routing commands that would run | The ip rule / ip route commands of marks, link balancer and policy routing. They are listed, never executed by the preview. |
| Deferred actions | Rebuilds and live updates requested during the draft (bandwidth limits, link balancer, CognixSys, published addresses) that will run when the draft is applied. |
| Changes already applied, not undone by Discard | See above. |
| Current rules the preview could not reproduce | Rarely, a rule of the current firewall cannot be loaded in the test namespace (a module only present on the live system). It is listed so that you know the comparison is incomplete for that rule. |
If the draft changes after the preview was computed, the page says so (The draft changed after this preview): compute it again before applying.
The objects (address sets) are recreated empty in the test namespace: the preview checks the rules that use them, not their content.
Click Apply, then confirm. If the last preview found rules the kernel would refuse, you are asked again (N rules will be refused by iptables. Apply anyway?).
A draft without any change is simply closed: no version is recorded and nothing is rebuilt (except the deferred requests, if any).
Click Discard, then confirm. The configuration returns to the version applied when the draft was opened, the draft is closed and the firewall is rebuilt (the deferred requests run). No version is recorded: nothing new was applied.
Changes made through the REST API go into the draft like changes made in the console: they are not applied and no version waiting for confirmation is created. A script that must change the firewall immediately has to check first that no draft is open (GET /firewall/config/draft).
| Method and path | Purpose |
|---|---|
GET /firewall/config/draft | State of the draft: open, author, opening date, base version, changes, deferred actions. |
POST /firewall/config/draft/open | Open a draft. HTTP 409 if a draft is open, a change waits for confirmation or a change is being saved. |
POST /firewall/config/draft/preview | Start computing the preview (HTTP 409 if one is already running). |
GET /firewall/config/draft/preview | The last preview, with stale: true if the draft changed since. |
POST /firewall/config/draft/apply | Apply the draft (a version waiting for confirmation is created). |
POST /firewall/config/draft/discard | Discard the draft. |
POST /firewall/config/draft/resume | Reopen the last suspended draft. |
While a draft is open, POST /firewall/config/versions/{id}/restore, /firewall/install and /firewall/uninstall answer HTTP 409.