This page lists every origin network command. Commands that replace a whole rule or server list make you state the full new list; see Rule sets are replaced as a whole.
create-vpc
Create a VPC, with its default security group, network ACL, route table and first subnet.
origin network create-vpc [OPTIONS] --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
--ipv4-cidr <IPV4_CIDR> | no | IPv4 range of the VPC, in private address space (10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16), from /16 to /28. Omitted, a random /16 from 172.16.0.0/12 that doesn’t collide with your other VPCs is assigned. |
list-vpcs
List the VPCs of a project.
origin network list-vpcs --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
create-subnet
Create a subnet in a VPC.
origin network create-subnet --vpc-urn <VPC_URN> --auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
--auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP> | yes | Whether instances launched into the subnet automatically get a Floating IP: true or false. Required, so it reads the same as on update-subnet-auto-assign-public-ip. |
list-subnets
List the subnets of a project.
origin network list-subnets --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
get-network-interface
Get a single Network Interface. Interfaces are created via create-network-interface or implicitly during instance launch, and are removed automatically on instance termination or subnet/VPC deletion - use delete-network-interface to remove a standalone one directly.
origin network get-network-interface --network-interface-urn <NETWORK_INTERFACE_URN>| Option | Required | Description |
|---|---|---|
--network-interface-urn <NETWORK_INTERFACE_URN> | yes | URN of the Network Interface. |
delete-network-interface
Delete a standalone Network Interface. Refuses while it’s still attached to something (a Compute instance or an Internet Gateway); detach or terminate whatever’s using it first. Refuses too while a Floating IP is still associated with it - disassociate-floating-ip first, or the address could never be released afterwards.
origin network delete-network-interface --network-interface-urn <NETWORK_INTERFACE_URN>| Option | Required | Description |
|---|---|---|
--network-interface-urn <NETWORK_INTERFACE_URN> | yes | URN of the Network Interface. |
list-network-interfaces
List Network Interfaces for a project.
origin network list-network-interfaces --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
list-floating-ips
List Floating IPs for a project.
origin network list-floating-ips --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
get-internet-gateway
Get a VPC’s Internet Gateway, if it has one attached.
origin network get-internet-gateway --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
attach-internet-gateway
Attach an Internet Gateway to a VPC, making its subnets internet-facing.
origin network attach-internet-gateway --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
detach-internet-gateway
Detach a VPC’s Internet Gateway, making its subnets private again.
origin network detach-internet-gateway --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
delete-vpc
Delete a VPC and everything it owns, then release its claimed CIDR(s) back to the pool. Refuses if any subnet still has an attached network interface, or while any NAT gateway lives in the VPC - delete those with delete-nat-gateway first.
origin network delete-vpc --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
delete-subnet
Delete a subnet. Refuses if it still has an attached network interface, or while a NAT gateway lives in it. Never releases the owning VPC’s CIDR capacity - that only happens on delete-vpc
origin network delete-subnet --subnet-urn <SUBNET_URN>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the subnet. |
get-floating-ip
Get a Floating IP.
origin network get-floating-ip --floating-ip-urn <FLOATING_IP_URN>| Option | Required | Description |
|---|---|---|
--floating-ip-urn <FLOATING_IP_URN> | yes | URN of the Floating IP. |
allocate-floating-ip
Allocate a Floating IP from the platform’s public IPv4 pool. It stays unassociated until associate-floating-ip.
origin network allocate-floating-ip --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
associate-floating-ip
Associate a Floating IP with a network interface, enabling static 1:1 NAT for it. Errors if already associated - disassociate-floating-ip first.
origin network associate-floating-ip --floating-ip-urn <FLOATING_IP_URN> --network-interface-urn <NETWORK_INTERFACE_URN>| Option | Required | Description |
|---|---|---|
--floating-ip-urn <FLOATING_IP_URN> | yes | URN of the Floating IP. |
--network-interface-urn <NETWORK_INTERFACE_URN> | yes | URN of the network interface to associate it with. |
disassociate-floating-ip
Disassociate a Floating IP, removing its NAT rules. Idempotent.
origin network disassociate-floating-ip --floating-ip-urn <FLOATING_IP_URN>| Option | Required | Description |
|---|---|---|
--floating-ip-urn <FLOATING_IP_URN> | yes | URN of the Floating IP. |
release-floating-ip
Release a Floating IP back to the pool and delete it. Errors if still associated - disassociate-floating-ip first.
origin network release-floating-ip --floating-ip-urn <FLOATING_IP_URN>| Option | Required | Description |
|---|---|---|
--floating-ip-urn <FLOATING_IP_URN> | yes | URN of the Floating IP. |
get-vpc
Get a single VPC.
origin network get-vpc --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
get-subnet
Get a single Subnet.
origin network get-subnet --subnet-urn <SUBNET_URN>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the subnet. |
get-security-group
Get a Security Group and its rules.
origin network get-security-group --security-group-urn <SECURITY_GROUP_URN>| Option | Required | Description |
|---|---|---|
--security-group-urn <SECURITY_GROUP_URN> | yes | URN of the Security Group. |
list-security-groups
List every Security Group in a project.
origin network list-security-groups --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
create-security-group
Create an additional, non-default Security Group in a VPC. Starts with no ingress/egress rules - use update-security-group-rules afterwards to add rules.
origin network create-security-group --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
delete-security-group
Delete a non-default Security Group. Refuses to delete a VPC’s default Security Group, or one still attached to a Network Interface.
origin network delete-security-group --security-group-urn <SECURITY_GROUP_URN>| Option | Required | Description |
|---|---|---|
--security-group-urn <SECURITY_GROUP_URN> | yes | URN of the Security Group. |
get-acl
Get a Network ACL and its rules.
origin network get-acl --acl-urn <ACL_URN>| Option | Required | Description |
|---|---|---|
--acl-urn <ACL_URN> | yes | URN of the Network ACL. |
list-acls
List every Network ACL in a project.
origin network list-acls --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
list-nat-gateways
List the NAT Gateways in a project.
origin network list-nat-gateways --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
create-nat-gateway
Create a NAT Gateway so Instances without a Floating IP can reach the internet. It goes in a public Subnet - one whose Route Table has a default route to an Internet Gateway - and uses a Floating IP you have already allocated and not attached to anything. Point a private Subnet’s Route Table at it with update-route-table-routes to send that Subnet’s traffic through it. Instances behind it reach the internet as the Gateway’s address and are not reachable from it. The Floating IP stays yours when the Gateway is deleted.
origin network create-nat-gateway --subnet-urn <SUBNET_URN> --floating-ip-urn <FLOATING_IP_URN>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the public Subnet. |
--floating-ip-urn <FLOATING_IP_URN> | yes | URN of an allocated, unattached Floating IP. |
delete-nat-gateway
Delete a NAT Gateway. Refuses while any Route Table still routes through it.
origin network delete-nat-gateway --nat-gateway-urn <NAT_GATEWAY_URN>| Option | Required | Description |
|---|---|---|
--nat-gateway-urn <NAT_GATEWAY_URN> | yes | URN of the NAT Gateway. |
list-route-tables
List the Route Tables in a project.
origin network list-route-tables --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
get-route-table
Show one Route Table.
origin network get-route-table --route-table-urn <ROUTE_TABLE_URN>| Option | Required | Description |
|---|---|---|
--route-table-urn <ROUTE_TABLE_URN> | yes | URN of the Route Table. |
create-route-table
Create an additional Route Table in a VPC. It starts with the VPC’s local routes and no default route, so a Subnet associated with it reaches its own VPC and nothing else - the “private subnet” half of the public/private pattern. Add a default with update-route-table-routes.
origin network create-route-table --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
update-route-table-routes
Replace a Route Table’s routes. This is a wholesale replace, not a patch: pass every route the table should have. --route is repeatable and takes <destination>,<target>[,<target-urn>], where <target> is local, internet-gateway or nat-gateway - e.g. --route '0.0.0.0/0,internet-gateway,<internet-gateway-urn>', --route '0.0.0.0/0,nat-gateway,<nat-gateway-urn>' or --route '10.0.0.0/16,local'. Target URNs have the usual form urn:origin:cloud:network:<region>:<org-id>:<project-id>:<resource-id>; the CLI help still shows an internal ffs: prefix. A nat-gateway route carries a subnet’s whole way out, so its destination must be 0.0.0.0/0: it translates IPv4 only.
origin network update-route-table-routes --route-table-urn <ROUTE_TABLE_URN> --route <ROUTES>| Option | Required | Description |
|---|---|---|
--route-table-urn <ROUTE_TABLE_URN> | yes | URN of the Route Table. |
--route <ROUTES> | yes | Repeatable. <destination>,<target>[,<target-urn>] |
delete-route-table
Delete a Route Table. Refuses a VPC’s main table, and one a Subnet is still associated with.
origin network delete-route-table --route-table-urn <ROUTE_TABLE_URN>| Option | Required | Description |
|---|---|---|
--route-table-urn <ROUTE_TABLE_URN> | yes | URN of the Route Table. |
associate-route-table
Point a Subnet at a Route Table, replacing whichever it used before.
origin network associate-route-table --subnet-urn <SUBNET_URN> --route-table-urn <ROUTE_TABLE_URN>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the Subnet. |
--route-table-urn <ROUTE_TABLE_URN> | yes | URN of the Route Table. |
create-acl
Create an additional, non-default Network ACL in a VPC. Starts with no rules - use update-acl-rules to add rules, and update-subnet-acl to attach it to a subnet.
origin network create-acl --vpc-urn <VPC_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
delete-acl
Delete a non-default Network ACL. Refuses to delete a VPC’s default ACL, or one still assigned to a Subnet.
origin network delete-acl --acl-urn <ACL_URN>| Option | Required | Description |
|---|---|---|
--acl-urn <ACL_URN> | yes | URN of the Network ACL. |
update-subnet-acl
Reassign which Network ACL enforces a subnet’s traffic. Refuses if the ACL belongs to a different VPC than the subnet.
origin network update-subnet-acl --subnet-urn <SUBNET_URN> --acl-urn <ACL_URN>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the subnet. |
--acl-urn <ACL_URN> | yes | URN of the Network ACL to assign. |
update-subnet-auto-assign-public-ip
Change whether instances launched into a subnet automatically get a Floating IP. Applies only to network interfaces created after the change - existing ones keep whatever Floating IP state they already have (use associate-floating-ip / disassociate-floating-ip for those)
origin network update-subnet-auto-assign-public-ip --subnet-urn <SUBNET_URN> --auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>| Option | Required | Description |
|---|---|---|
--subnet-urn <SUBNET_URN> | yes | URN of the subnet. |
--auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP> | yes | The new value. Required and explicit (true / false) rather than a bare flag, so that omitting it can never silently mean “disable” [possible values: true, false]. |
get-dns-policy
Get a DNS policy.
origin network get-dns-policy --dns-policy-urn <DNS_POLICY_URN>| Option | Required | Description |
|---|---|---|
--dns-policy-urn <DNS_POLICY_URN> | yes | URN of the DNS policy. |
list-dns-policies
List every DNS relay policy in a project.
origin network list-dns-policies --project-urn <PROJECT_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
create-dns-policy
Create an additional, non-default DNS policy in a project. It takes the same options as update-dns-policy.
origin network create-dns-policy --project-urn <PROJECT_URN> --relay-enabled <RELAY_ENABLED> <--upstream-server <UPSTREAM_SERVERS>|--no-upstream-servers>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
--relay-enabled <RELAY_ENABLED> | yes | Whether this policy relays unanswered queries upstream at all. Required and explicit (true / false) rather than a bare flag, so that it reads the same way as on update-dns-policy, where omitting it could otherwise silently mean “disable” [possible values: true, false]. |
--upstream-server <UPSTREAM_SERVERS> | one of --upstream-server, --no-upstream-servers | IPv4/IPv6 address of an upstream DNS server, repeatable. Required non-empty only while --relay-enabled true is given. |
--no-upstream-servers | one of --upstream-server, --no-upstream-servers | Start the policy with no upstream servers - only legal alongside --relay-enabled false. Exactly one of --upstream-server and --no-upstream-servers must be given. |
update-dns-policy
Replace a DNS relay policy’s own settings wholesale - not which policy is default or which VPC(s) it backs. The upstream server list is replaced on every invocation, so its new contents must be stated: --upstream-server for a non-empty list, --no-upstream-servers for an empty one.
origin network update-dns-policy --dns-policy-urn <DNS_POLICY_URN> --relay-enabled <RELAY_ENABLED> <--upstream-server <UPSTREAM_SERVERS>|--no-upstream-servers>| Option | Required | Description |
|---|---|---|
--dns-policy-urn <DNS_POLICY_URN> | yes | URN of the DNS policy. |
--relay-enabled <RELAY_ENABLED> | yes | Whether this policy relays unanswered queries upstream at all. Required and explicit (true / false) rather than a bare flag, so that omitting it can never silently mean “disable” on a policy that currently relays [possible values: true, false]. |
--upstream-server <UPSTREAM_SERVERS> | one of --upstream-server, --no-upstream-servers | IPv4/IPv6 address of an upstream DNS server, repeatable - the full given set replaces the existing upstream server list. Required non-empty while --relay-enabled true is given. |
--no-upstream-servers | one of --upstream-server, --no-upstream-servers | Replace the upstream server list with the empty set - only legal alongside --relay-enabled false. Exactly one of --upstream-server and --no-upstream-servers must be given. |
set-default-dns-policy
Reassign which policy is a project’s default DNS relay policy - does not touch any VPC’s current attachment.
origin network set-default-dns-policy --dns-policy-urn <DNS_POLICY_URN>| Option | Required | Description |
|---|---|---|
--dns-policy-urn <DNS_POLICY_URN> | yes | URN of the DNS policy to make default. |
delete-dns-policy
Delete a DNS relay policy. Refuses if it’s the project’s default, or if any VPC is still attached to it.
origin network delete-dns-policy --dns-policy-urn <DNS_POLICY_URN>| Option | Required | Description |
|---|---|---|
--dns-policy-urn <DNS_POLICY_URN> | yes | URN of the DNS policy. |
attach-dns-policy
Change which DNS relay policy a VPC relays through.
origin network attach-dns-policy --vpc-urn <VPC_URN> --dns-policy-urn <DNS_POLICY_URN>| Option | Required | Description |
|---|---|---|
--vpc-urn <VPC_URN> | yes | URN of the VPC. |
--dns-policy-urn <DNS_POLICY_URN> | yes | URN of the DNS policy to attach - must belong to the VPC’s own project. |
create-network-interface
Create a standalone network interface in a subnet.
origin network create-network-interface [OPTIONS] --project-urn <PROJECT_URN> --subnet-urn <SUBNET_URN>| Option | Required | Description |
|---|---|---|
--project-urn <PROJECT_URN> | yes | URN of the project. |
--subnet-urn <SUBNET_URN> | yes | URN of the subnet. |
--security-group-urn <SECURITY_GROUP_URNS> | no | URN of a Security Group to attach. Repeatable. Omitted defaults to the owning VPC’s default Security Group. |
update-acl-rules
Replace a Network ACL’s full rule list. State the new list with --rule (repeatable), or --no-rules for the empty one; stating neither is an error rather than a silent wipe.
origin network update-acl-rules --acl-urn <ACL_URN> <--rule <RULES>|--no-rules>| Option | Required | Description |
|---|---|---|
--acl-urn <ACL_URN> | yes | URN of the Network ACL. |
--rule <RULES> | one of --rule, --no-rules | One ACL rule, repeatable - the full given set replaces the existing rules. Format: priority=<u16>,direction=<ingress|egress>,protocol=<any|tcp|udp|icmp>,port=<N|N-M|any>,source=<cidr>,policy=<accept|drop>. icmp covers ICMP and ICMPv6 and takes port=any |
--no-rules | one of --rule, --no-rules | Replace the rules with the empty set, leaving the ACL deny-by-default. Required to say this out loud: exactly one of --rule and --no-rules must be given. |
update-security-group-rules
Replace a Security Group’s full ingress and egress rule lists. Both lists are replaced on every invocation, so each one’s new contents must be stated - --ingress-rule / --egress-rule for a non-empty list, --no-ingress-rules / --no-egress-rules for an empty one. Stating neither for a list is an error rather than a silent wipe.
origin network update-security-group-rules --security-group-urn <SECURITY_GROUP_URN> <--ingress-rule <INGRESS_RULES>|--no-ingress-rules> <--egress-rule <EGRESS_RULES>|--no-egress-rules>| Option | Required | Description |
|---|---|---|
--security-group-urn <SECURITY_GROUP_URN> | yes | URN of the Security Group. |
--ingress-rule <INGRESS_RULES> | one of --ingress-rule, --no-ingress-rules | One ingress rule, repeatable - the full given set replaces the existing ingress rules. Format: protocol=<any|tcp|udp|icmp>,port=<N|N-M|any>,(ip-range=<cidr>|security-group-urn=<urn>)[,description=<text>]. icmp covers ICMP and ICMPv6 and takes port=any |
--no-ingress-rules | one of --ingress-rule, --no-ingress-rules | Replace the ingress rules with the empty set, admitting no inbound traffic. Exactly one of --ingress-rule and --no-ingress-rules must be given. |
--egress-rule <EGRESS_RULES> | one of --egress-rule, --no-egress-rules | One egress rule, repeatable - same format as --ingress-rule. The full given set replaces the existing egress rules. |
--no-egress-rules | one of --egress-rule, --no-egress-rules | Replace the egress rules with the empty set, admitting no outbound traffic. Exactly one of --egress-rule and --no-egress-rules must be given. |