A Network Firewall that Prevents rather than Detects
An INSPECT rule hands the flow to the threat engine, and inspection decides what happens next: INTRUSION_PREVENTION drops the session, INTRUSION_DETECTION logs it and forwards it, and the rule reads INSPECT either way. Every inspect rule is prevention unless detection is accepted by name; policy and appliance are both created, and the address the route tables must point at is an output.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "network_firewall" {
source = "www.iac-bazaar.com/iac-bazaar/oci-network-firewall/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-network-firewall
An OCI Network Firewall that prevents rather than detects. Works with
Terraform and OpenTofu (>= 1.6), oci provider >= 8.0, < 9.0.
INTRUSION_DETECTION inspects and forwards. An INSPECT rule hands the
flow to the Palo Alto engine, and inspection decides what happens when it
finds something: INTRUSION_PREVENTION drops the session,
INTRUSION_DETECTION writes a log line and lets it through. The rule shows as
INSPECT in the console either way and the threat log fills either way. Every
INSPECT rule here is prevention unless accept_detection_only says
otherwise, and prevents_intrusions reports which you have.
A firewall the route table does not point at sees nothing. The appliance
has an address in a subnet; traffic reaches it only because a route sends it
there. The address is exported; the routes are yours. A policy created
without a firewall (subnet_id = null) needs accept_policy_only.
The default is DROP, so a policy with no rules is a black hole. Refused.
Rules are appended in creation order, and Terraform creates in parallel.
OCI evaluates top to bottom, first match wins, and this provider positions
a new rule after the existing ones. With overlapping rules the order matters
and a parallel apply does not promise one. Write rules whose conditions do
not overlap (the example does), or apply with -parallelism=1 the first
time and check rule_names_in_order against the console.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-cloud-guard
Oracle ships every responder rule in USERACTION mode: a Remediate button appears on each problem and nothing happens until a person clicks it, so a tenancy with hundreds of findings has by default fixed none of them. Sets AUTOACTION per rule and exports the IAM statements each auto-action needs, since one without its policy fails on every execution.
oci-security-zone
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
oci-waf
CHECK is the action that evaluates the rule, logs the match and lets the request through - the console shows the protection rules and every matched attack reached the backend. BLOCK by default, DETECT only by name. The policy and the firewall binding it to a load balancer are separate resources; both are created, and a policy alone has to be asked for.
oci-bastion
Zero-footprint managed bastion with session-managed SSH/port-forward access to private subnets - replaces jump hosts.
oci-vulnerability-scanning
scan_level = NONE is legal for both the agent scan and the port scan, so a recipe with both at NONE runs on schedule, updates its last-run time, and finds nothing because it looked for nothing. A recipe is not a target either: one with no target scans no instance. Refuses a recipe that scans for nothing and always creates the target with it.
azure-firewall
Every security feature on this service defaults to telling you, not to stopping it: threat_intelligence_mode defaults to Alert, which logs traffic to known-malicious destinations and forwards it, and intrusion detection does the same. Deny for both here, with the DNS proxy on so FQDN rules and the client agree on an answer.