12. Command line

Everything you configure in the panel can also be done from the command line, on the device console or over SSH. In the restricted console or as root, type berrycade <command>.

The Tab key completes commands, sections, names that already exist in the configuration (policies, addresses, zones, interfaces…), fields and possible values. berrycade --help lists all commands and berrycade <command> --help shows the details of each one.

Figure 23 — Panel console: htop, ping and the CLI help

12.1 How changes are applied

The command line uses the same API and the same apply mechanism as the panel:

• validation is the same as in the panel; on an error, the message points to the field and suggests a fix (for example, campo desconhecido: coment — você quis dizer: comment?, meaning "unknown field: coment — did you mean: comment?");
• each change is recorded in the revision history and in the audit log with the user cli;
• after applying, the CLI asks Confirmar? [s/N] (Confirm? [y/N]). If you don't confirm within the time limit (60 s by default, in Sistema › Configurações (System › Settings)), the previous configuration rolls back automatically. If the change cuts off SSH access, the answer never arrives and nothing is lost;
• the --sim option confirms without asking, for use in scripts. It skips the protection against losing access: use it with care;
• when the panel is stopped, the configuration commands don't work. The recovery commands (12.5) remain available.

12.2 Configuration

Field format:

• field=value: text, number or true/false (also sim/não);
• subfields with a dot: dhcp_server.enabled=true, admin.https_port=8443;
• comma-separated lists: src_addr=servidor1,servidor2. field+=value adds to the list and field-=value removes from it;
• values with spaces go in quotes: "comment=Saída para a internet";
• field=null clears an optional field;
• web filter categories: categories.malware=block (or monitor, allow).

12.3 Configuration sections

12.4 Operation

12.5 Recovery and access

These commands work even when the panel is stopped:

12.6 Examples

View the policies and the details of the first one:

berrycade show policies
berrycade show policies 1

Create an address object and allow it in policy 1:

berrycade add addresses name=servidor type=subnet value=10.0.0.10/32 "comment=Servidor de arquivos"
berrycade set policies 1 src_addr+=servidor

Create a user VLAN with its own zone and DHCP (the .100–.200 range is filled in automatically):

berrycade add zones name=usuarios "description=VLAN de usuários"
berrycade add vlans name=usuarios parent=lan vid=10 zone=usuarios address=192.168.10.1/24 dhcp_server.enabled=true

General settings, web filter and IDS:

berrycade set system dns.servers=8.8.8.8,1.1.1.1
berrycade set webfilter_profiles Libera_Tudo categories.malware=block
berrycade ids zone lan alert

DHCP, logs and backup:

berrycade dhcp reserve 60:c7:27:08:bb:ae 172.16.1.50 lan --nome notebook
berrycade logs traffic --tipo denied --limite 20
berrycade backup export /root/backup.swbk --senha