Oracle Cloud Infrastructure Documentation

Create an Address List

Create a list of IPv4 addresses, IPv6 addresses, or fully qualified domain names (FQDNs) you can use to build rules in a firewall policy.

You can specify individual IPv4 or IPv6 IP addresses, or use CIDR blocks in an IP address list. Each address is entered on its own line within the list.

FQDN addresses are available only for specific use cases. To use FQDN addresses for address lists, Create a service request. Before you create the service request, be aware of the following limitations:
  • Publicly resolvable FQDNs are supported. Private FQDNs aren't supported.
  • Regex support isn't available for FQDNs.
  • FQDN based filtering is supported when the count of IP addresses that an FQDN can resolve is less than or equal to 32.
  • Fast flux DNS names can return different IP addresses in rapid succession. The firewall and a client might therefore resolve the same FQDN to different IP addresses. A security rule that uses the FQDN address list might then fail to match the client's connection. See FQDN-based address filtering limitations for more information.
Note

You can configure a maximum of 20,000 IP addresses (or CIDRs) and 2,000 FQDNs across all address lists within a policy. Each individual address list can hold up to 1,000 addresses, but the total IP addresses across all lists must not exceed 20,000, and the total FQDNs must not exceed 2,000. You can create up to 20,000 address lists, as long as you adhere to these specified address limits.

To import multiple address lists using a .json file, see Import Firewall Policy Components.

    1. Open the navigation menu, and select Identity & Security. Under Firewalls, select Network Firewall policies.
    2. Select that compartment that contains the policy that you want to create the address list in.
    3. Select the policy.
    4. On the details page, select the Address lists tab.
    5. Select Create address list.
    6. In the Name field, enter a name for the address list. Avoid entering confidential information.
    7. (Optional) In the Description field, enter a brief summary of the address list.
      Use this field to provide details about the address list to help other users understand its purpose or configuration. You can enter up to 1,000 characters and can edit this field at any time.
    8. In the IP addresses/CIDR field, enter a list of IP addresses that you want to allow or deny access to.
      You can specify individual IPv4 or IPv6 IP addresses or CIDR block. For an FQDN address list, enter fully qualified domain names. You can't mix IP addresses and FQDN addresses in the same list. You can enter a maximum of 1,000 addresses, one on each line.
    9. Select Create.

  • Use the network-firewall address-list create command and required parameters to create an address list:

    oci network-firewall address-list create 
--network-firewall-policy-id network firewall policy OCID --compartment-id compartment OCID
--total-addresses integer --addresses '["address_1", "address_2"]' [OPTIONS]

    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  • Run the CreateAddressList operation to create an address list.