# origin network commands

Every origin network command with its flags: VPCs, subnets, gateways, route tables, Floating IPs, ACLs, security groups and DNS policies.

This page lists every `origin network` command. Commands that replace a whole rule or server list make you state the full new list; see [Rule sets are replaced as a whole](/docs/network/traffic-control/replace-rule-sets).

## create-vpc [#create-vpc]

Create a VPC, with its default security group, network ACL, route table and first subnet.

```sh
origin network create-vpc [OPTIONS] --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |
| `--ipv4-cidr <IPV4_CIDR>` | no | IPv4 range of the VPC, in private address space (`10.0.0.0/8`, `172.16.0.0/12` or `192.168.0.0/16`), from `/16` to `/28`. Omitted, a random `/16` from `172.16.0.0/12` that doesn’t collide with your other VPCs is assigned. |

## list-vpcs [#list-vpcs]

List the VPCs of a project.

```sh
origin network list-vpcs --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## create-subnet [#create-subnet]

Create a subnet in a VPC.

```sh
origin network create-subnet --vpc-urn <VPC_URN> --auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |
| `--auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>` | yes | Whether instances launched into the subnet automatically get a Floating IP: `true` or `false`. Required, so it reads the same as on [`update-subnet-auto-assign-public-ip`](#update-subnet-auto-assign-public-ip). |

## list-subnets [#list-subnets]

List the subnets of a project.

```sh
origin network list-subnets --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## get-network-interface [#get-network-interface]

Get a single Network Interface. Interfaces are created via [`create-network-interface`](#create-network-interface) or implicitly during instance launch, and are removed automatically on instance termination or subnet/VPC deletion - use [`delete-network-interface`](#delete-network-interface) to remove a standalone one directly.

```sh
origin network get-network-interface --network-interface-urn <NETWORK_INTERFACE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--network-interface-urn <NETWORK_INTERFACE_URN>` | yes | URN of the Network Interface. |

## delete-network-interface [#delete-network-interface]

Delete a standalone Network Interface. Refuses while it’s still attached to something (a Compute instance or an Internet Gateway); detach or terminate whatever’s using it first. Refuses too while a Floating IP is still associated with it - [`disassociate-floating-ip`](#disassociate-floating-ip) first, or the address could never be released afterwards.

```sh
origin network delete-network-interface --network-interface-urn <NETWORK_INTERFACE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--network-interface-urn <NETWORK_INTERFACE_URN>` | yes | URN of the Network Interface. |

## list-network-interfaces [#list-network-interfaces]

List Network Interfaces for a project.

```sh
origin network list-network-interfaces --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## list-floating-ips [#list-floating-ips]

List Floating IPs for a project.

```sh
origin network list-floating-ips --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## get-internet-gateway [#get-internet-gateway]

Get a VPC’s Internet Gateway, if it has one attached.

```sh
origin network get-internet-gateway --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## attach-internet-gateway [#attach-internet-gateway]

Attach an Internet Gateway to a VPC, making its subnets internet-facing.

```sh
origin network attach-internet-gateway --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## detach-internet-gateway [#detach-internet-gateway]

Detach a VPC’s Internet Gateway, making its subnets private again.

```sh
origin network detach-internet-gateway --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## delete-vpc [#delete-vpc]

Delete a VPC and everything it owns, then release its claimed CIDR(s) back to the pool. Refuses if any subnet still has an attached network interface, or while any NAT gateway lives in the VPC - delete those with [`delete-nat-gateway`](#delete-nat-gateway) first.

```sh
origin network delete-vpc --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## delete-subnet [#delete-subnet]

Delete a subnet. Refuses if it still has an attached network interface, or while a NAT gateway lives in it. Never releases the owning VPC’s CIDR capacity - that only happens on [`delete-vpc`](#delete-vpc)

```sh
origin network delete-subnet --subnet-urn <SUBNET_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the subnet. |

## get-floating-ip [#get-floating-ip]

Get a Floating IP.

```sh
origin network get-floating-ip --floating-ip-urn <FLOATING_IP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--floating-ip-urn <FLOATING_IP_URN>` | yes | URN of the Floating IP. |

## allocate-floating-ip [#allocate-floating-ip]

Allocate a Floating IP from the platform’s public IPv4 pool. It stays unassociated until [`associate-floating-ip`](#associate-floating-ip).

```sh
origin network allocate-floating-ip --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## associate-floating-ip [#associate-floating-ip]

Associate a Floating IP with a network interface, enabling static 1:1 NAT for it. Errors if already associated - [`disassociate-floating-ip`](#disassociate-floating-ip) first.

```sh
origin network associate-floating-ip --floating-ip-urn <FLOATING_IP_URN> --network-interface-urn <NETWORK_INTERFACE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--floating-ip-urn <FLOATING_IP_URN>` | yes | URN of the Floating IP. |
| `--network-interface-urn <NETWORK_INTERFACE_URN>` | yes | URN of the network interface to associate it with. |

## disassociate-floating-ip [#disassociate-floating-ip]

Disassociate a Floating IP, removing its NAT rules. Idempotent.

```sh
origin network disassociate-floating-ip --floating-ip-urn <FLOATING_IP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--floating-ip-urn <FLOATING_IP_URN>` | yes | URN of the Floating IP. |

## release-floating-ip [#release-floating-ip]

Release a Floating IP back to the pool and delete it. Errors if still associated - [`disassociate-floating-ip`](#disassociate-floating-ip) first.

```sh
origin network release-floating-ip --floating-ip-urn <FLOATING_IP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--floating-ip-urn <FLOATING_IP_URN>` | yes | URN of the Floating IP. |

## get-vpc [#get-vpc]

Get a single VPC.

```sh
origin network get-vpc --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## get-subnet [#get-subnet]

Get a single Subnet.

```sh
origin network get-subnet --subnet-urn <SUBNET_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the subnet. |

## get-security-group [#get-security-group]

Get a Security Group and its rules.

```sh
origin network get-security-group --security-group-urn <SECURITY_GROUP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--security-group-urn <SECURITY_GROUP_URN>` | yes | URN of the Security Group. |

## list-security-groups [#list-security-groups]

List every Security Group in a project.

```sh
origin network list-security-groups --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## create-security-group [#create-security-group]

Create an additional, non-default Security Group in a VPC. Starts with no ingress/egress rules - use [`update-security-group-rules`](#update-security-group-rules) afterwards to add rules.

```sh
origin network create-security-group --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## delete-security-group [#delete-security-group]

Delete a non-default Security Group. Refuses to delete a VPC’s default Security Group, or one still attached to a Network Interface.

```sh
origin network delete-security-group --security-group-urn <SECURITY_GROUP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--security-group-urn <SECURITY_GROUP_URN>` | yes | URN of the Security Group. |

## get-acl [#get-acl]

Get a Network ACL and its rules.

```sh
origin network get-acl --acl-urn <ACL_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--acl-urn <ACL_URN>` | yes | URN of the Network ACL. |

## list-acls [#list-acls]

List every Network ACL in a project.

```sh
origin network list-acls --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## list-nat-gateways [#list-nat-gateways]

List the NAT Gateways in a project.

```sh
origin network list-nat-gateways --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## create-nat-gateway [#create-nat-gateway]

Create a NAT Gateway so Instances without a Floating IP can reach the internet. It goes in a public Subnet - one whose Route Table has a default route to an Internet Gateway - and uses a Floating IP you have already allocated and not attached to anything. Point a private Subnet’s Route Table at it with [`update-route-table-routes`](#update-route-table-routes) to send that Subnet’s traffic through it. Instances behind it reach the internet as the Gateway’s address and are not reachable from it. The Floating IP stays yours when the Gateway is deleted.

```sh
origin network create-nat-gateway --subnet-urn <SUBNET_URN> --floating-ip-urn <FLOATING_IP_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the public Subnet. |
| `--floating-ip-urn <FLOATING_IP_URN>` | yes | URN of an allocated, unattached Floating IP. |

## delete-nat-gateway [#delete-nat-gateway]

Delete a NAT Gateway. Refuses while any Route Table still routes through it.

```sh
origin network delete-nat-gateway --nat-gateway-urn <NAT_GATEWAY_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--nat-gateway-urn <NAT_GATEWAY_URN>` | yes | URN of the NAT Gateway. |

## list-route-tables [#list-route-tables]

List the Route Tables in a project.

```sh
origin network list-route-tables --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## get-route-table [#get-route-table]

Show one Route Table.

```sh
origin network get-route-table --route-table-urn <ROUTE_TABLE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--route-table-urn <ROUTE_TABLE_URN>` | yes | URN of the Route Table. |

## create-route-table [#create-route-table]

Create an additional Route Table in a VPC. It starts with the VPC’s local routes and no default route, so a Subnet associated with it reaches its own VPC and nothing else - the “private subnet” half of the public/private pattern. Add a default with [`update-route-table-routes`](#update-route-table-routes).

```sh
origin network create-route-table --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## update-route-table-routes [#update-route-table-routes]

Replace a Route Table’s routes. This is a wholesale replace, not a patch: pass every route the table should have. `--route` is repeatable and takes `<destination>,<target>[,<target-urn>]`, where `<target>` is `local`, `internet-gateway` or `nat-gateway` - e.g. `--route '0.0.0.0/0,internet-gateway,<internet-gateway-urn>'`, `--route '0.0.0.0/0,nat-gateway,<nat-gateway-urn>'` or `--route '10.0.0.0/16,local'`. Target URNs have the usual form `urn:origin:cloud:network:<region>:<org-id>:<project-id>:<resource-id>`; the CLI help still shows an internal `ffs:` prefix. A `nat-gateway` route carries a subnet’s whole way out, so its destination must be `0.0.0.0/0`: it translates IPv4 only.

```sh
origin network update-route-table-routes --route-table-urn <ROUTE_TABLE_URN> --route <ROUTES>
```

| Option | Required | Description |
| --- | --- | --- |
| `--route-table-urn <ROUTE_TABLE_URN>` | yes | URN of the Route Table. |
| `--route <ROUTES>` | yes | Repeatable. `<destination>,<target>[,<target-urn>]` |

## delete-route-table [#delete-route-table]

Delete a Route Table. Refuses a VPC’s main table, and one a Subnet is still associated with.

```sh
origin network delete-route-table --route-table-urn <ROUTE_TABLE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--route-table-urn <ROUTE_TABLE_URN>` | yes | URN of the Route Table. |

## associate-route-table [#associate-route-table]

Point a Subnet at a Route Table, replacing whichever it used before.

```sh
origin network associate-route-table --subnet-urn <SUBNET_URN> --route-table-urn <ROUTE_TABLE_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the Subnet. |
| `--route-table-urn <ROUTE_TABLE_URN>` | yes | URN of the Route Table. |

## create-acl [#create-acl]

Create an additional, non-default Network ACL in a VPC. Starts with no rules - use [`update-acl-rules`](#update-acl-rules) to add rules, and [`update-subnet-acl`](#update-subnet-acl) to attach it to a subnet.

```sh
origin network create-acl --vpc-urn <VPC_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |

## delete-acl [#delete-acl]

Delete a non-default Network ACL. Refuses to delete a VPC’s default ACL, or one still assigned to a Subnet.

```sh
origin network delete-acl --acl-urn <ACL_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--acl-urn <ACL_URN>` | yes | URN of the Network ACL. |

## update-subnet-acl [#update-subnet-acl]

Reassign which Network ACL enforces a subnet’s traffic. Refuses if the ACL belongs to a different VPC than the subnet.

```sh
origin network update-subnet-acl --subnet-urn <SUBNET_URN> --acl-urn <ACL_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the subnet. |
| `--acl-urn <ACL_URN>` | yes | URN of the Network ACL to assign. |

## update-subnet-auto-assign-public-ip [#update-subnet-auto-assign-public-ip]

Change whether instances launched into a subnet automatically get a Floating IP. Applies only to network interfaces created after the change - existing ones keep whatever Floating IP state they already have (use [`associate-floating-ip`](#associate-floating-ip) / [`disassociate-floating-ip`](#disassociate-floating-ip) for those)

```sh
origin network update-subnet-auto-assign-public-ip --subnet-urn <SUBNET_URN> --auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>
```

| Option | Required | Description |
| --- | --- | --- |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the subnet. |
| `--auto-assign-public-ip <AUTO_ASSIGN_PUBLIC_IP>` | yes | The new value. Required and explicit (`true` / `false`) rather than a bare flag, so that omitting it can never silently mean “disable” [possible values: `true`, `false`]. |

## get-dns-policy [#get-dns-policy]

Get a DNS policy.

```sh
origin network get-dns-policy --dns-policy-urn <DNS_POLICY_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--dns-policy-urn <DNS_POLICY_URN>` | yes | URN of the DNS policy. |

## list-dns-policies [#list-dns-policies]

List every DNS relay policy in a project.

```sh
origin network list-dns-policies --project-urn <PROJECT_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |

## create-dns-policy [#create-dns-policy]

Create an additional, non-default DNS policy in a project. It takes the same options as [`update-dns-policy`](#update-dns-policy).

```sh
origin network create-dns-policy --project-urn <PROJECT_URN> --relay-enabled <RELAY_ENABLED> <--upstream-server <UPSTREAM_SERVERS>|--no-upstream-servers>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |
| `--relay-enabled <RELAY_ENABLED>` | yes | Whether this policy relays unanswered queries upstream at all. Required and explicit (`true` / `false`) rather than a bare flag, so that it reads the same way as on [`update-dns-policy`](#update-dns-policy), where omitting it could otherwise silently mean “disable” [possible values: `true`, `false`]. |
| `--upstream-server <UPSTREAM_SERVERS>` | one of `--upstream-server`, `--no-upstream-servers` | IPv4/IPv6 address of an upstream DNS server, repeatable. Required non-empty only while `--relay-enabled true` is given. |
| `--no-upstream-servers` | one of `--upstream-server`, `--no-upstream-servers` | Start the policy with no upstream servers - only legal alongside `--relay-enabled false`. Exactly one of `--upstream-server` and `--no-upstream-servers` must be given. |

## update-dns-policy [#update-dns-policy]

Replace a DNS relay policy’s own settings wholesale - not which policy is default or which VPC(s) it backs. The upstream server list is replaced on every invocation, so its new contents must be stated: `--upstream-server` for a non-empty list, `--no-upstream-servers` for an empty one.

```sh
origin network update-dns-policy --dns-policy-urn <DNS_POLICY_URN> --relay-enabled <RELAY_ENABLED> <--upstream-server <UPSTREAM_SERVERS>|--no-upstream-servers>
```

| Option | Required | Description |
| --- | --- | --- |
| `--dns-policy-urn <DNS_POLICY_URN>` | yes | URN of the DNS policy. |
| `--relay-enabled <RELAY_ENABLED>` | yes | Whether this policy relays unanswered queries upstream at all. Required and explicit (`true` / `false`) rather than a bare flag, so that omitting it can never silently mean “disable” on a policy that currently relays [possible values: `true`, `false`]. |
| `--upstream-server <UPSTREAM_SERVERS>` | one of `--upstream-server`, `--no-upstream-servers` | IPv4/IPv6 address of an upstream DNS server, repeatable - the full given set replaces the existing upstream server list. Required non-empty while `--relay-enabled true` is given. |
| `--no-upstream-servers` | one of `--upstream-server`, `--no-upstream-servers` | Replace the upstream server list with the empty set - only legal alongside `--relay-enabled false`. Exactly one of `--upstream-server` and `--no-upstream-servers` must be given. |

## set-default-dns-policy [#set-default-dns-policy]

Reassign which policy is a project’s default DNS relay policy - does not touch any VPC’s current attachment.

```sh
origin network set-default-dns-policy --dns-policy-urn <DNS_POLICY_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--dns-policy-urn <DNS_POLICY_URN>` | yes | URN of the DNS policy to make default. |

## delete-dns-policy [#delete-dns-policy]

Delete a DNS relay policy. Refuses if it’s the project’s default, or if any VPC is still attached to it.

```sh
origin network delete-dns-policy --dns-policy-urn <DNS_POLICY_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--dns-policy-urn <DNS_POLICY_URN>` | yes | URN of the DNS policy. |

## attach-dns-policy [#attach-dns-policy]

Change which DNS relay policy a VPC relays through.

```sh
origin network attach-dns-policy --vpc-urn <VPC_URN> --dns-policy-urn <DNS_POLICY_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--vpc-urn <VPC_URN>` | yes | URN of the VPC. |
| `--dns-policy-urn <DNS_POLICY_URN>` | yes | URN of the DNS policy to attach - must belong to the VPC’s own project. |

## create-network-interface [#create-network-interface]

Create a standalone network interface in a subnet.

```sh
origin network create-network-interface [OPTIONS] --project-urn <PROJECT_URN> --subnet-urn <SUBNET_URN>
```

| Option | Required | Description |
| --- | --- | --- |
| `--project-urn <PROJECT_URN>` | yes | URN of the project. |
| `--subnet-urn <SUBNET_URN>` | yes | URN of the subnet. |
| `--security-group-urn <SECURITY_GROUP_URNS>` | no | URN of a Security Group to attach. Repeatable. Omitted defaults to the owning VPC’s default Security Group. |

## update-acl-rules [#update-acl-rules]

Replace a Network ACL’s full rule list. State the new list with `--rule` (repeatable), or `--no-rules` for the empty one; stating neither is an error rather than a silent wipe.

```sh
origin network update-acl-rules --acl-urn <ACL_URN> <--rule <RULES>|--no-rules>
```

| Option | Required | Description |
| --- | --- | --- |
| `--acl-urn <ACL_URN>` | yes | URN of the Network ACL. |
| `--rule <RULES>` | one of `--rule`, `--no-rules` | One ACL rule, repeatable - the full given set replaces the existing rules. Format: `priority=<u16>,direction=<ingress\|egress>,protocol=<any\|tcp\|udp\|icmp>,port=<N\|N-M\|any>,source=<cidr>,policy=<accept\|drop>`. `icmp` covers ICMP and ICMPv6 and takes `port=any` |
| `--no-rules` | one of `--rule`, `--no-rules` | Replace the rules with the empty set, leaving the ACL deny-by-default. Required to say this out loud: exactly one of `--rule` and `--no-rules` must be given. |

## update-security-group-rules [#update-security-group-rules]

Replace a Security Group’s full ingress and egress rule lists. Both lists are replaced on every invocation, so each one’s new contents must be stated - `--ingress-rule` / `--egress-rule` for a non-empty list, `--no-ingress-rules` / `--no-egress-rules` for an empty one. Stating neither for a list is an error rather than a silent wipe.

```sh
origin network update-security-group-rules --security-group-urn <SECURITY_GROUP_URN> <--ingress-rule <INGRESS_RULES>|--no-ingress-rules> <--egress-rule <EGRESS_RULES>|--no-egress-rules>
```

| Option | Required | Description |
| --- | --- | --- |
| `--security-group-urn <SECURITY_GROUP_URN>` | yes | URN of the Security Group. |
| `--ingress-rule <INGRESS_RULES>` | one of `--ingress-rule`, `--no-ingress-rules` | One ingress rule, repeatable - the full given set replaces the existing ingress rules. Format: `protocol=<any\|tcp\|udp\|icmp>,port=<N\|N-M\|any>,(ip-range=<cidr>\|security-group-urn=<urn>)[,description=<text>]`. `icmp` covers ICMP and ICMPv6 and takes `port=any` |
| `--no-ingress-rules` | one of `--ingress-rule`, `--no-ingress-rules` | Replace the ingress rules with the empty set, admitting no inbound traffic. Exactly one of `--ingress-rule` and `--no-ingress-rules` must be given. |
| `--egress-rule <EGRESS_RULES>` | one of `--egress-rule`, `--no-egress-rules` | One egress rule, repeatable - same format as `--ingress-rule`. The full given set replaces the existing egress rules. |
| `--no-egress-rules` | one of `--egress-rule`, `--no-egress-rules` | Replace the egress rules with the empty set, admitting no outbound traffic. Exactly one of `--egress-rule` and `--no-egress-rules` must be given. |