Programmatically modify firewall rules

[geekscrapy]

Hi, I'm looking to quickly modify firewall rules in response to captive portal output (e.g. if user is in group X, the route a different way than a user in group Y).

I'm thinking if doing this directly on the USG as it'll be used as soon as it's set, rather than waiting for a provision (which can take a while).

Any idea how to do this? I'm thinking that this API client interacts with the Unifi controller which can only update via provisioning?

Any suggestions welcome of however else to do this!

[malle-pietje]

@geekscrapy Unfortunately yes, when modifying the firewall rules through the web interface or API the UniFi gateway device needs to reprovision for the changes to take effect. This doesn't apply though, for example, when updating Radius entries within the Radius service on a UniFi gateway device.

[geekscrapy]

Thanks, unfortunate though!

Any additional thoughts on how to do this? I was looking at the mca command in the USG but even though it takes a JSON config, it doesn't seem to apply it.

In your year(s?) if making this Unifi client, have you heard/seen how the USG gets the JSON config applied by the controller (what commands are used in the comms between controller and USG)? Thinking of just replicating that process and slip in my new config.

[geekscrapy]

Also, thanks for the radius tip. This could be another option.
Does this client do that directly on the USG then? Or does it add/modify the accounts as soon as they are requested?

[malle-pietje]

Thanks, unfortunate though!

Any additional thoughts on how to do this? I was looking at the mca command in the USG but even though it takes a JSON config, it doesn't seem to apply it.

In your year(s?) if making this Unifi client, have you heard/seen how the USG gets the JSON config applied by the controller (what commands are used in the comms between controller and USG)? Thinking of just replicating that process and slip in my new config.

I'm afraid I haven't dived into the device provisioning protocol so can't help you there. I purely focus on the API, that alone keeps me busy 24x7...

[malle-pietje]

Also, thanks for the radius tip. This could be another option. Does this client do that directly on the USG then? Or does it add/modify the accounts as soon as they are requested?

The Radius updates are executed through the API and are almost immediately applied to the UniFi Gateway's Radius service.