> ## Documentation Index > Fetch the complete documentation index at: https://orbit.nckrtl.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # List live UFW rules > Reads `ufw status numbered` over WireGuard and classifies each IPv4 rule against the desired managed set and operator firewall records. Live rules that do not match are drift. Desired or operator rules absent from live are missing. An inactive, absent, or unreachable backend returns empty live and missing lists. ## OpenAPI ````yaml /openapi.json get /api/v1/nodes/{node}/live-firewall-rules openapi: 3.1.0 info: title: Orbit Gateway API version: v1 description: >- The HTTP API of the active Orbit Gateway. The CLI and the PHP SDK send every fleet command through these endpoints over WireGuard. See [Using the API](/api/overview) for transport, authentication, envelopes, and errors. servers: - url: https://gateway.orbit description: >- The active Gateway on the private WireGuard network, resolved by Orbit private DNS. security: [] tags: - name: Gateway description: >- Status and trust of the active Gateway, and the releases of the Gateway itself. - name: Nodes description: Machines in the fleet, their roles, access grants, and storage settings. - name: Clusters description: Groups of Nodes with one Router and one development TLD. - name: Firewall description: Named UFW rules on one Node. - name: Fleet rollout description: >- The rollout of each verified Gateway release to the managed Nodes, and its catch-up. - name: Tools description: Packages that Orbit installs on a Node through a Tool Manager. - name: Metrics description: The Prometheus and Grafana role and its exporters. - name: GitHub App description: The Gateway's own read-only GitHub App and the accounts that installed it. - name: Analytics description: >- The analytics role, its Plausible version, and the Stats API key the Gateway uses to read visits. - name: Projects description: Repository records with one type, default branch, and web root each. - name: Instances description: Development checkouts and production releases of a Project on one Node. - name: Environment description: Stored Instance environment configuration and its .env projection. - name: Routes description: Domains that reach an Instance. - name: Database connections description: The registry of mysql, pgsql, and sqlite connections. - name: Processes description: >- systemd services and Docker containers owned by an Instance, a Node, or a Project definition. - name: Schedules description: Recurring commands run by native systemd timers. - name: Annotations description: Instance annotations, T3 delivery, and replayable status events. - name: Tasks description: Commander feature groups and ordered subtasks. - name: Extensions description: Gateway-owned extension switches. - name: Doctor description: Verify-only drift checks across the fleet. - name: Activities description: The Gateway log of authorized commands. - name: proxycli description: CLIProxyAPI quota snapshots, provider pools, and account controls. - name: Vaultwarden description: The copy of database credentials into a Vaultwarden collection. - name: Conn description: >- Profiles, shared workspace settings, registered T3 servers, and the pairing links the Gateway mints on them for each Node. - name: Realtime description: >- The record-change event feed broadcast to Reverb, its channel authorization, and Reverb connection discovery. - name: Node callbacks description: Endpoints that managed Nodes and Caddy call; operators do not call them. paths: /api/v1/nodes/{node}/live-firewall-rules: get: tags: - Firewall summary: List live UFW rules description: >- Reads `ufw status numbered` over WireGuard and classifies each IPv4 rule against the desired managed set and operator firewall records. Live rules that do not match are drift. Desired or operator rules absent from live are missing. An inactive, absent, or unreachable backend returns empty live and missing lists. operationId: firewall-live-list parameters: - name: node in: path required: true schema: type: integer minimum: 1 description: Numeric Node ID. responses: '200': description: The request succeeded. content: application/json: schema: type: object properties: data: type: object required: - backend_status - live - missing properties: backend_status: type: string enum: - active - inactive - absent - unreachable description: >- Whether UFW answered on the Node. `unreachable` means the Gateway could not read `ufw status numbered`. live: type: array description: IPv4 UFW rules currently on the Node, in status order. items: type: object properties: name: type: string description: >- Operator rule name, `orbit:` comment, or `unmanaged` when UFW has no comment. comment: type: string action: type: string source: type: string destination: type: string port: type: string protocol: type: string interface: type: - string - 'null' family: type: - string - 'null' match: type: string enum: - exact - drift - unmanaged description: >- `exact` matches a desired managed or operator rule. `drift` has a known comment with a different shape. `unmanaged` is not an Orbit managed or operator rule. missing: type: array description: >- Desired managed or operator rules that are absent from live UFW. items: type: object properties: name: type: string comment: type: string action: type: string source: type: string destination: type: string port: type: string protocol: type: string interface: type: - string - 'null' family: type: - string - 'null' match: type: string enum: - missing meta: $ref: '#/components/schemas/Meta' required: - data - meta '403': description: >- The caller is not an active WireGuard peer (`peer.identity_unknown`) or lacks Node access to the target (`node_access.required`). content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No record matches the path parameters. content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: bash label: curl source: > curl -sS "https://gateway.orbit/api/v1/nodes/7/live-firewall-rules" \ --cacert /path/to/orbit-root-ca.pem \ -H 'Accept: application/json' \ -H 'X-Orbit-Request-Id: 9d6b1e5c-4a3f-4a1b-9f0e-6d2c3f5a7b81' components: schemas: Meta: type: object properties: request_id: type: string format: uuid description: >- The request ID the Gateway assigned or accepted; the same value is in the `X-Orbit-Request-Id` response header and in the Activity record. required: - request_id Error: type: object properties: error: type: object properties: code: type: string description: >- Stable error code, namespaced by family, such as `node.not_active` or `route.target_conflict`. message: type: string description: >- Safe message without credentials, environment values, or remote output. details: type: object additionalProperties: true description: >- Bounded, redacted details such as the conflicting record IDs or the failed validation rule. request_id: type: string format: uuid required: - code - message required: - error ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.