Export the firewall configuration of an appliance to a file, and import it on another appliance.
The import never applies anything by itself: it replaces the configuration inside a draft, which you preview, adjust, then apply with the usual confirmation.
eth0 → ens18).It does not contain:
The file is protected by a checksum: a file modified after export — even only re-indented by an editor — is refused at import.
firewall-<hostname>-<date>.json is downloaded.The file describes your filtering policy and the internal addresses of your networks. Store it like any other sensitive configuration file.
On the target appliance, go to Your Firewall › Configuration history, click Import, then Upload the exported file.
The file is checked (format, version, checksum, forbidden values) and kept for one hour. Nothing is written to the configuration at this stage.
The import is refused when:
The window shows the appliance and the date of the export, the number of object groups, then one line per interface used by the file: its addresses on the source appliance, and how many rules, NAT, masquerade entries, load-balanced links and bridges use it.
For each source interface, choose the interface of this appliance that receives its configuration. An interface with the same name is proposed automatically.
Click Import into a draft. This is refused while a draft is already open or a change waits for confirmation on this appliance, and when more than an hour has passed since the upload (upload the file again).
A draft is opened with the imported configuration, which replaces the current one. The banner tells where it comes from (imported from <appliance> (exported on <date>)), and the draft page starts with a panel Imported configuration: to check before applying:
| Item | What to check |
|---|---|
| Imported disabled | The rules, NAT and other entries disabled because their interface was set to None, or because the file referred to an object group it did not contain. |
| NAT, load-balanced links, bridges | Public addresses, internal servers and gateways belong to the source site: adapt them. |
| Trusted networks | The trusted addresses carried by the file. Check that they include the administration network of this appliance, or you may lose access when the policies are applied. |
| Interfaces that received nothing | Their settings are kept as they were. |
| Settings that are not imported / unknown fields | Options of the file that this appliance does not accept or does not know (an older version, for example). They are ignored. |
Object groups are recreated with new identifiers; the firewall objects of the target that the imported configuration no longer uses are removed (objects shared with the proxy are kept). Addresses are imported as they are: an address specific to the source site stays in the rules until you change it.
Then use the draft as usual: change what must be changed, click Preview to see the kernel rules, and finally Apply — or Discard to return to the previous configuration (the groups created by the import are removed).
Applying an imported draft follows the draft rules: a version of origin Draft is created and must be confirmed within the delay, otherwise the previous configuration comes back automatically. The Last used information of the rules starts again from zero, since the rule numbers now describe other rules.
Restoring later a version older than the import also removes the object groups the import had created.
| Method and path | Purpose |
|---|---|
GET /firewall/config/export | The export file. Save the response as it is: re-encoding it (with jq, for example) breaks the checksum. |
POST /firewall/config/import/analyze | Body: the export file. Returns a token (valid one hour), the source appliance, its interfaces and their use, the interfaces of this appliance and a proposed mapping. Nothing is written. |
POST /firewall/config/import/apply | Body {"token": "…", "mapping": {"eth0": "ens18", "eth1": ""}} — an empty value means None. Opens the draft with the imported configuration. |
Errors: HTTP 400 for an invalid file or mapping (detail lists the missing, unknown or duplicated interfaces), 410 for an expired token, 409 when a draft is open or a change waits for confirmation.
Example, from one appliance to another:
SOCK=/usr/share/artica-postfix/bin/run/articarest.sock
curl -s --unix-socket $SOCK http://localhost/firewall/config/export -o fw.json
# copy fw.json to the target appliance, then on the target:
curl -s --unix-socket $SOCK -X POST --data-binary @fw.json http://localhost/firewall/config/import/analyze
curl -s --unix-socket $SOCK -X POST -d '{"token":"<token>","mapping":{"eth0":"ens18"}}' \
http://localhost/firewall/config/import/applyThen preview and apply the draft (/firewall/config/draft/*), and confirm the version (POST /firewall/config/versions/confirm).