The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Add a Firewall rule

Prev Next

Adds a rule to the client-side rule group by specifying a number to the rule.

  1. Log on to the system as a user with administrator rights.

  2. Change the directory to the Firewall bin directory:

    /opt/McAfee/ens/fw/bin

  3. Run the command:

    ./mfefwcli --fw-rule-add

    • --name — Specify the name of the rule. This is a mandatory option.

    • --action — Specify the value of the action as allow or deny. This is a mandatory option.

    • --log — Enable logging for a specified rule when a new packet matches the rule. The subsequent packets within the same connection are not logged.

    • --direction — Specify the direction (in, out or either) of the traffic to match in a rule. You can specify only one argument.

    • --state — Specify the status of the rule as either enable or disable. The default value is enable.

    • --notes — Add a description for the rule for reference.

    • --netproto [network protocol name] — Specify the network protocol to match in a packet. If this option is not specified, the rule matches IPv4 addresses.

      The protocol name can have the following values:

      • ipv4 — to specify only ipv4 addresses

      • ipv6 — to specify only ipv6 addresses

      • any — to specify ipv4 and ipv6 addresses

Add a rule to deny a traffic on either direction with logging enabled

Add a rule to deny a traffic on either direction with logging enabled:

./mfefwcli --fw-rule-add --index 1--name rule_name --action deny --log enable --direction either --state enable --proto any