A Network Firewall that Prevents rather than Detects
An INSPECT rule hands the flow to the threat engine, and inspection decides what happens next: INTRUSION_PREVENTION drops the session, INTRUSION_DETECTION logs it and forwards it, and the rule reads INSPECT either way. Every inspect rule is prevention unless detection is accepted by name; policy and appliance are both created, and the address the route tables must point at is an output.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "network_firewall" {
source = "www.iac-bazaar.com/iac-bazaar/oci-network-firewall/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/oci-network-firewall?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Network Firewall that Prevents rather than Detects](https://www.iac-bazaar.com/catalog/oci-network-firewall?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "network_firewall" {
source = "www.iac-bazaar.com/iac-bazaar/oci-network-firewall/oci"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-network-firewall
An OCI Network Firewall that prevents rather than detects. Works with
Terraform and OpenTofu (>= 1.6), oci provider >= 8.0, < 9.0.
INTRUSION_DETECTION inspects and forwards. An INSPECT rule hands the
flow to the Palo Alto engine, and inspection decides what happens when it
finds something: INTRUSION_PREVENTION drops the session,
INTRUSION_DETECTION writes a log line and lets it through. The rule shows as
INSPECT in the console either way and the threat log fills either way. Every
INSPECT rule here is prevention unless accept_detection_only says
otherwise, and prevents_intrusions reports which you have.
A firewall the route table does not point at sees nothing. The appliance
has an address in a subnet; traffic reaches it only because a route sends it
there. The address is exported; the routes are yours. A policy created
without a firewall (subnet_id = null) needs accept_policy_only.
The default is DROP, so a policy with no rules is a black hole. Refused.
Rules are appended in creation order, and Terraform creates in parallel.
OCI evaluates top to bottom, first match wins, and this provider positions
a new rule after the existing ones. With overlapping rules the order matters
and a parallel apply does not promise one. Write rules whose conditions do
not overlap (the example does), or apply with -parallelism=1 the first
time and check rule_names_in_order against the console.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-cloud-guard
Oracle ships every responder rule in USERACTION mode: a Remediate button appears on each problem and nothing happens until a person clicks it, so a tenancy with hundreds of findings has by default fixed none of them. Sets AUTOACTION per rule and exports the IAM statements each auto-action needs, since one without its policy fails on every execution.
oci-security-zone
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
oci-customer-identity
An OCI identity domain on the external-user licence. license_type is not updatable, so changing it replaces the domain with an empty one and every customer account is gone - and the admin email is create-time only too. A domain must be deactivated before it can be deleted, which the module exposes, and it stays off your staff sign-in page.
oci-waf
CHECK is the action that evaluates the rule, logs the match and lets the request through - the console shows the protection rules and every matched attack reached the backend. BLOCK by default, DETECT only by name. The policy and the firewall binding it to a load balancer are separate resources; both are created, and a policy alone has to be asked for.
oci-network-security-group
An NSG with no rules admits nothing and sends nothing, so a group written with ingress only has VNICs that cannot resolve DNS; a stateless rule drops every reply that has no matching egress; and the subnet's security list still applies, unioned with the NSG. Stateful always, egress explicit and open by default, SSH from 0.0.0.0/0 refused unless accepted, the security list named as still applying.
oci-bastion
Zero-footprint managed bastion with session-managed SSH/port-forward access to private subnets - replaces jump hosts.