---
title: "Update flow rules"
method: POST
path: "/api/v2beta/network/{id}/flow-rule"
tags: ["network"]
---

# Update flow rules

`POST /api/v2beta/network/{id}/flow-rule`

## Request

- Base URL: `https://central.zerotier.com`
- URL: `https://central.zerotier.com/api/v2beta/network/{id}/flow-rule`
- Auth: HTTP bearer

Update the flow rules for a network. Supports two modes: `custom` for raw flow rule source, and `isolation` for managed network isolation with service filters. **This endpoint is in beta and may change.**

## Path parameters

- `id` string, required

## Request body

- union
  - UpdateFlowRulesCustomRequest
    - `kind` 'custom', required: The kind of flow rule
    - `config` UpdateFlowRulesCustomConfig
      - `source` string: Raw ZeroTier flow rule source code
  - UpdateFlowRulesIsolationRequest
    - `kind` 'isolation', required: The kind of flow rule
    - `config` UpdateFlowRulesIsolationConfig: All fields are optional. Only provided fields are updated.
      - `blockNonIP` boolean: Whether to block non-IP traffic (e.g. ARP, IPv6 NDP)
      - `enableServiceFilter` boolean: Whether to restrict traffic to only the ports and protocols in `allowedServices`
      - `allowedServices` FlowRuleIsolationAllowedPorts[]: Ports and protocols to allow when service filtering is enabled
        - `ports` string, required: Port list in ZeroTier format: single port (`80`), range (`8000-9000`), or comma-separated
        - `protocol` integer, required: IP protocol number (e.g. 6 = TCP, 17 = UDP, 1 = ICMP)
      - `excludedDeviceIds` string[]: Device IDs exempt from isolation rules (can communicate freely)

## Response `200`

Updated flow rules

- union
  - FlowRulesCustom
    - `kind` 'custom', required: The kind of flow rule
    - `config` FlowRulesCustomConfig, required
      - `source` string, required: Raw ZeroTier flow rule source code
  - FlowRulesIsolation
    - `kind` 'isolation', required: The kind of flow rule
    - `config` FlowRulesIsolationConfig, required
      - `blockNonIP` boolean, required: Whether to block non-IP traffic (e.g. ARP, IPv6 NDP)
      - `enableServiceFilter` boolean, required: Whether to restrict traffic to only the ports and protocols in `allowedServices`
      - `allowedServices` FlowRuleIsolationAllowedPorts[], required: Ports and protocols to allow when service filtering is enabled
        - `ports` string, required: Port list in ZeroTier format: single port (`80`), range (`8000-9000`), or comma-separated
        - `protocol` integer, required: IP protocol number (e.g. 6 = TCP, 17 = UDP, 1 = ICMP)
      - `excludedDeviceIds` string[], required: Device IDs exempt from isolation rules (can communicate freely)

## Other responses

- `400`: Invalid data provided
- `401`: Missing or invalid authentication token
- `403`: Insufficient permissions
- `404`: Network not found
- `413`: Request body exceeds the 1 MB size limit
- `500`: Internal server error

---

[API](https://skmtc.dev/zerotier/apis/zerotier-central-v2-api.md) - [All operations](https://skmtc.dev/zerotier/apis/zerotier-central-v2-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zerotier/apis/zerotier-central-v2-api/revisions/b2e7468ad104?raw)