Add L2/misc provider resources (tunnel/stopped_rule/proxy_arp/proxy_ndp/arp_rule/maclist)

Batch 3 provider resources, id-keyed. proxy_arp/proxy_ndp share one
implementation (typeSuffix + endpoint). Register and document.

README.md

@@ -39,6 +39,15 @@ provider "tomswallapi" {
 | `tomswallapi_policy` | id | default zone-to-zone posture (`priority` ordered) |
 | `tomswallapi_blrule` | id | blacklist/whitelist rule (pre-rules) |
 | `tomswallapi_conntrack` | id | connection-tracking control (notrack/helper) |
+| `tomswallapi_host` | id | zone→address constraint on a `device` interface |
+| `tomswallapi_provider` | id | multi-ISP routing provider on a `device` |
+| `tomswallapi_route` | id | static route on a `device` (`oif` = egress iface) |
+| `tomswallapi_routing_rule` | id | policy routing to a provider table (rtrules) |
+| `tomswallapi_tunnel` | id | VPN tunnel definition on a `device` |
+| `tomswallapi_stopped_rule` | id | traffic allowed while the firewall is stopped |
+| `tomswallapi_proxy_arp` / `_proxy_ndp` | id | proxy ARP/NDP on a `device` |
+| `tomswallapi_arp_rule` | id | ARP-level rule on a `device` |
+| `tomswallapi_maclist` | id | MAC/IP verification on a `device` interface |
 
 ## Example
 

internal/provider/helpers.go

@@ -45,6 +45,15 @@ func stringsToList(ctx context.Context, s []string, diags *diag.Diagnostics) typ
 	return l
 }
 
+// optionalInt64 maps an omitempty API int back to state, preserving a prior null
+// when the API returns the zero value.
+func optionalInt64(apiVal int, prior types.Int64) types.Int64 {
+	if apiVal != 0 {
+		return types.Int64Value(int64(apiVal))
+	}
+	return prior
+}
+
 // optionalList maps an API string slice back to state for an optional list
 // attribute, preserving a null value the user left unset when the API returns none.
 func optionalList(ctx context.Context, apiVals []string, prior types.List, diags *diag.Diagnostics) types.List {

internal/provider/provider.go

@@ -81,6 +81,16 @@ func (p *tomswallProvider) Resources(_ context.Context) []func() resource.Resour
 		NewPolicyResource,
 		NewBlruleResource,
 		NewConntrackResource,
+		NewHostResource,
+		NewProviderResource,
+		NewRouteResource,
+		NewRoutingRuleResource,
+		NewTunnelResource,
+		NewStoppedRuleResource,
+		NewProxyARPResource,
+		NewProxyNDPResource,
+		NewArpRuleResource,
+		NewMaclistResource,
 	}
 }
 

internal/provider/resource_arp_rule.go

@@ -0,0 +1,171 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &arpRuleResource{}
+	_ resource.ResourceWithImportState = &arpRuleResource{}
+)
+
+type arpRuleResource struct{ client *apiClient }
+
+type arpRuleModel struct {
+	ID            types.Int64  `tfsdk:"id"`
+	Device        types.String `tfsdk:"device"`
+	Action        types.String `tfsdk:"action"`
+	ActionAddress types.String `tfsdk:"action_address"`
+	ActionMAC     types.String `tfsdk:"action_mac"`
+	Source        types.String `tfsdk:"source"`
+	Dest          types.String `tfsdk:"dest"`
+	Opcode        types.Int64  `tfsdk:"opcode"`
+	Comment       types.String `tfsdk:"comment"`
+}
+
+type arpRuleAPI struct {
+	ID            int64  `json:"id,omitempty"`
+	Device        string `json:"device"`
+	Action        string `json:"action"`
+	ActionAddress string `json:"action_address,omitempty"`
+	ActionMAC     string `json:"action_mac,omitempty"`
+	Source        string `json:"source,omitempty"`
+	Dest          string `json:"dest,omitempty"`
+	Opcode        int    `json:"opcode,omitempty"`
+	Comment       string `json:"comment,omitempty"`
+}
+
+func NewArpRuleResource() resource.Resource { return &arpRuleResource{} }
+
+func (r *arpRuleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_arp_rule"
+}
+
+func (r *arpRuleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "An ARP-level rule on a device.",
+		Attributes: map[string]schema.Attribute{
+			"id":             schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":         schema.StringAttribute{Description: "Owning device.", Required: true},
+			"action":         schema.StringAttribute{Required: true},
+			"action_address": schema.StringAttribute{Optional: true},
+			"action_mac":     schema.StringAttribute{Optional: true},
+			"source":         schema.StringAttribute{Optional: true},
+			"dest":           schema.StringAttribute{Optional: true},
+			"opcode":         schema.Int64Attribute{Optional: true},
+			"comment":        schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *arpRuleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *arpRuleResource) body(plan arpRuleModel) arpRuleAPI {
+	return arpRuleAPI{
+		Device:        plan.Device.ValueString(),
+		Action:        plan.Action.ValueString(),
+		ActionAddress: plan.ActionAddress.ValueString(),
+		ActionMAC:     plan.ActionMAC.ValueString(),
+		Source:        plan.Source.ValueString(),
+		Dest:          plan.Dest.ValueString(),
+		Opcode:        int(plan.Opcode.ValueInt64()),
+		Comment:       plan.Comment.ValueString(),
+	}
+}
+
+func (r *arpRuleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan arpRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out arpRuleAPI
+	if err := r.client.post(ctx, "/api/v1/arp-rules", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("create arp_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *arpRuleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state arpRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out arpRuleAPI
+	if err := r.client.post(ctx, "/api/v1/arp-rules", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("recreate arp_rule failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/arp-rules/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old arp_rule failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *arpRuleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state arpRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out arpRuleAPI
+	if err := r.client.get(ctx, "/api/v1/arp-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read arp_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
+}
+
+func (r *arpRuleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state arpRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/arp-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete arp_rule failed", err.Error())
+	}
+}
+
+func (r *arpRuleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "arp_rule id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *arpRuleResource) toModel(api arpRuleAPI, prior arpRuleModel) arpRuleModel {
+	return arpRuleModel{
+		ID:            types.Int64Value(api.ID),
+		Device:        types.StringValue(api.Device),
+		Action:        types.StringValue(api.Action),
+		ActionAddress: optionalString(api.ActionAddress, prior.ActionAddress),
+		ActionMAC:     optionalString(api.ActionMAC, prior.ActionMAC),
+		Source:        optionalString(api.Source, prior.Source),
+		Dest:          optionalString(api.Dest, prior.Dest),
+		Opcode:        optionalInt64(api.Opcode, prior.Opcode),
+		Comment:       optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_host.go

@@ -0,0 +1,171 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &hostResource{}
+	_ resource.ResourceWithImportState = &hostResource{}
+)
+
+type hostResource struct{ client *apiClient }
+
+type hostModel struct {
+	ID         types.Int64  `tfsdk:"id"`
+	Device     types.String `tfsdk:"device"`
+	Zone       types.String `tfsdk:"zone"`
+	Interface  types.String `tfsdk:"interface"`
+	Addresses  types.List   `tfsdk:"addresses"`
+	Exclusions types.List   `tfsdk:"exclusions"`
+	Dynamic    types.Bool   `tfsdk:"dynamic"`
+}
+
+type hostAPI struct {
+	ID         int64    `json:"id,omitempty"`
+	Device     string   `json:"device"`
+	Zone       string   `json:"zone"`
+	Interface  string   `json:"interface"`
+	Addresses  []string `json:"addresses,omitempty"`
+	Exclusions []string `json:"exclusions,omitempty"`
+	Dynamic    bool     `json:"dynamic,omitempty"`
+}
+
+func NewHostResource() resource.Resource { return &hostResource{} }
+
+func (r *hostResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_host"
+}
+
+func (r *hostResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "Constrains a zone to specific addresses on a device's interface.",
+		Attributes: map[string]schema.Attribute{
+			"id":         schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":     schema.StringAttribute{Description: "Owning device.", Required: true},
+			"zone":       schema.StringAttribute{Required: true},
+			"interface":  schema.StringAttribute{Required: true},
+			"addresses":  schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"exclusions": schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"dynamic":    schema.BoolAttribute{Optional: true, Computed: true, Default: booldefault.StaticBool(false)},
+		},
+	}
+}
+
+func (r *hostResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *hostResource) body(ctx context.Context, plan hostModel, diags *diag.Diagnostics) hostAPI {
+	return hostAPI{
+		Device:     plan.Device.ValueString(),
+		Zone:       plan.Zone.ValueString(),
+		Interface:  plan.Interface.ValueString(),
+		Addresses:  listToStrings(ctx, plan.Addresses, diags),
+		Exclusions: listToStrings(ctx, plan.Exclusions, diags),
+		Dynamic:    plan.Dynamic.ValueBool(),
+	}
+}
+
+func (r *hostResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan hostModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out hostAPI
+	if err := r.client.post(ctx, "/api/v1/hosts", body, &out); err != nil {
+		resp.Diagnostics.AddError("create host failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *hostResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state hostModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out hostAPI
+	if err := r.client.post(ctx, "/api/v1/hosts", body, &out); err != nil {
+		resp.Diagnostics.AddError("recreate host failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/hosts/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old host failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *hostResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state hostModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out hostAPI
+	if err := r.client.get(ctx, "/api/v1/hosts/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read host failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
+}
+
+func (r *hostResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state hostModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/hosts/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete host failed", err.Error())
+	}
+}
+
+func (r *hostResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "host id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *hostResource) toModel(ctx context.Context, api hostAPI, prior hostModel, diags *diag.Diagnostics) hostModel {
+	return hostModel{
+		ID:         types.Int64Value(api.ID),
+		Device:     types.StringValue(api.Device),
+		Zone:       types.StringValue(api.Zone),
+		Interface:  types.StringValue(api.Interface),
+		Addresses:  optionalList(ctx, api.Addresses, prior.Addresses, diags),
+		Exclusions: optionalList(ctx, api.Exclusions, prior.Exclusions, diags),
+		Dynamic:    types.BoolValue(api.Dynamic),
+	}
+}

internal/provider/resource_maclist.go

@@ -0,0 +1,175 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &maclistResource{}
+	_ resource.ResourceWithImportState = &maclistResource{}
+)
+
+type maclistResource struct{ client *apiClient }
+
+type maclistModel struct {
+	ID        types.Int64  `tfsdk:"id"`
+	Device    types.String `tfsdk:"device"`
+	Action    types.String `tfsdk:"action"`
+	Interface types.String `tfsdk:"interface"`
+	MAC       types.String `tfsdk:"mac"`
+	Addresses types.List   `tfsdk:"addresses"`
+	Log       types.String `tfsdk:"log"`
+	Comment   types.String `tfsdk:"comment"`
+}
+
+type maclistAPI struct {
+	ID        int64    `json:"id,omitempty"`
+	Device    string   `json:"device"`
+	Action    string   `json:"action"`
+	Interface string   `json:"interface"`
+	MAC       string   `json:"mac,omitempty"`
+	Addresses []string `json:"addresses,omitempty"`
+	Log       string   `json:"log,omitempty"`
+	Comment   string   `json:"comment,omitempty"`
+}
+
+func NewMaclistResource() resource.Resource { return &maclistResource{} }
+
+func (r *maclistResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_maclist"
+}
+
+func (r *maclistResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "A MAC/IP verification entry on a device's interface.",
+		Attributes: map[string]schema.Attribute{
+			"id":        schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":    schema.StringAttribute{Description: "Owning device.", Required: true},
+			"action":    schema.StringAttribute{Description: "accept, drop, ...", Required: true},
+			"interface": schema.StringAttribute{Required: true},
+			"mac":       schema.StringAttribute{Optional: true},
+			"addresses": schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"log":       schema.StringAttribute{Optional: true},
+			"comment":   schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *maclistResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *maclistResource) body(ctx context.Context, plan maclistModel, diags *diag.Diagnostics) maclistAPI {
+	return maclistAPI{
+		Device:    plan.Device.ValueString(),
+		Action:    plan.Action.ValueString(),
+		Interface: plan.Interface.ValueString(),
+		MAC:       plan.MAC.ValueString(),
+		Addresses: listToStrings(ctx, plan.Addresses, diags),
+		Log:       plan.Log.ValueString(),
+		Comment:   plan.Comment.ValueString(),
+	}
+}
+
+func (r *maclistResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan maclistModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out maclistAPI
+	if err := r.client.post(ctx, "/api/v1/maclist", body, &out); err != nil {
+		resp.Diagnostics.AddError("create maclist failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *maclistResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state maclistModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out maclistAPI
+	if err := r.client.post(ctx, "/api/v1/maclist", body, &out); err != nil {
+		resp.Diagnostics.AddError("recreate maclist failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/maclist/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old maclist failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *maclistResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state maclistModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out maclistAPI
+	if err := r.client.get(ctx, "/api/v1/maclist/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read maclist failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
+}
+
+func (r *maclistResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state maclistModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/maclist/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete maclist failed", err.Error())
+	}
+}
+
+func (r *maclistResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "maclist id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *maclistResource) toModel(ctx context.Context, api maclistAPI, prior maclistModel, diags *diag.Diagnostics) maclistModel {
+	return maclistModel{
+		ID:        types.Int64Value(api.ID),
+		Device:    types.StringValue(api.Device),
+		Action:    types.StringValue(api.Action),
+		Interface: types.StringValue(api.Interface),
+		MAC:       optionalString(api.MAC, prior.MAC),
+		Addresses: optionalList(ctx, api.Addresses, prior.Addresses, diags),
+		Log:       optionalString(api.Log, prior.Log),
+		Comment:   optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_provider.go

@@ -0,0 +1,180 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &providerResource{}
+	_ resource.ResourceWithImportState = &providerResource{}
+)
+
+type providerResource struct{ client *apiClient }
+
+type providerModel struct {
+	ID        types.Int64  `tfsdk:"id"`
+	Device    types.String `tfsdk:"device"`
+	Name      types.String `tfsdk:"name"`
+	Number    types.Int64  `tfsdk:"number"`
+	Mark      types.Int64  `tfsdk:"mark"`
+	Duplicate types.String `tfsdk:"duplicate"`
+	Interface types.String `tfsdk:"interface"`
+	Gateway   types.String `tfsdk:"gateway"`
+	Copy      types.List   `tfsdk:"copy"`
+}
+
+type providerAPI struct {
+	ID        int64    `json:"id,omitempty"`
+	Device    string   `json:"device"`
+	Name      string   `json:"name"`
+	Number    int      `json:"number"`
+	Mark      int      `json:"mark,omitempty"`
+	Duplicate string   `json:"duplicate,omitempty"`
+	Interface string   `json:"interface"`
+	Gateway   string   `json:"gateway,omitempty"`
+	Copy      []string `json:"copy,omitempty"`
+}
+
+func NewProviderResource() resource.Resource { return &providerResource{} }
+
+func (r *providerResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_provider"
+}
+
+func (r *providerResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "A multi-ISP routing provider on a device.",
+		Attributes: map[string]schema.Attribute{
+			"id":        schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":    schema.StringAttribute{Description: "Owning device.", Required: true},
+			"name":      schema.StringAttribute{Required: true},
+			"number":    schema.Int64Attribute{Description: "Provider routing table number.", Required: true},
+			"mark":      schema.Int64Attribute{Optional: true},
+			"duplicate": schema.StringAttribute{Optional: true},
+			"interface": schema.StringAttribute{Required: true},
+			"gateway":   schema.StringAttribute{Optional: true},
+			"copy":      schema.ListAttribute{Optional: true, ElementType: types.StringType},
+		},
+	}
+}
+
+func (r *providerResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *providerResource) body(ctx context.Context, plan providerModel, diags *diag.Diagnostics) providerAPI {
+	return providerAPI{
+		Device:    plan.Device.ValueString(),
+		Name:      plan.Name.ValueString(),
+		Number:    int(plan.Number.ValueInt64()),
+		Mark:      int(plan.Mark.ValueInt64()),
+		Duplicate: plan.Duplicate.ValueString(),
+		Interface: plan.Interface.ValueString(),
+		Gateway:   plan.Gateway.ValueString(),
+		Copy:      listToStrings(ctx, plan.Copy, diags),
+	}
+}
+
+func (r *providerResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan providerModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out providerAPI
+	if err := r.client.post(ctx, "/api/v1/providers", body, &out); err != nil {
+		resp.Diagnostics.AddError("create provider failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *providerResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state providerModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out providerAPI
+	if err := r.client.post(ctx, "/api/v1/providers", body, &out); err != nil {
+		resp.Diagnostics.AddError("recreate provider failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/providers/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old provider failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *providerResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state providerModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out providerAPI
+	if err := r.client.get(ctx, "/api/v1/providers/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read provider failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
+}
+
+func (r *providerResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state providerModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/providers/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete provider failed", err.Error())
+	}
+}
+
+func (r *providerResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "provider id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *providerResource) toModel(ctx context.Context, api providerAPI, prior providerModel, diags *diag.Diagnostics) providerModel {
+	return providerModel{
+		ID:        types.Int64Value(api.ID),
+		Device:    types.StringValue(api.Device),
+		Name:      types.StringValue(api.Name),
+		Number:    types.Int64Value(int64(api.Number)),
+		Mark:      optionalInt64(api.Mark, prior.Mark),
+		Duplicate: optionalString(api.Duplicate, prior.Duplicate),
+		Interface: types.StringValue(api.Interface),
+		Gateway:   optionalString(api.Gateway, prior.Gateway),
+		Copy:      optionalList(ctx, api.Copy, prior.Copy, diags),
+	}
+}

internal/provider/resource_proxy.go

@@ -0,0 +1,178 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+// proxyResource backs both tomswallapi_proxy_arp and tomswallapi_proxy_ndp
+// (identical shape); typeSuffix and endpoint distinguish them.
+type proxyResource struct {
+	client     *apiClient
+	typeSuffix string
+	endpoint   string
+}
+
+func NewProxyARPResource() resource.Resource {
+	return &proxyResource{typeSuffix: "_proxy_arp", endpoint: "/api/v1/proxy-arp"}
+}
+func NewProxyNDPResource() resource.Resource {
+	return &proxyResource{typeSuffix: "_proxy_ndp", endpoint: "/api/v1/proxy-ndp"}
+}
+
+var (
+	_ resource.Resource                = &proxyResource{}
+	_ resource.ResourceWithImportState = &proxyResource{}
+)
+
+type proxyModel struct {
+	ID         types.Int64  `tfsdk:"id"`
+	Device     types.String `tfsdk:"device"`
+	Address    types.String `tfsdk:"address"`
+	Interface  types.String `tfsdk:"interface"`
+	External   types.String `tfsdk:"external"`
+	HaveRoute  types.Bool   `tfsdk:"haveroute"`
+	Persistent types.Bool   `tfsdk:"persistent"`
+	Comment    types.String `tfsdk:"comment"`
+}
+
+type proxyAPI struct {
+	ID         int64  `json:"id,omitempty"`
+	Device     string `json:"device"`
+	Address    string `json:"address"`
+	Interface  string `json:"interface,omitempty"`
+	External   string `json:"external"`
+	HaveRoute  bool   `json:"haveroute,omitempty"`
+	Persistent bool   `json:"persistent,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+func (r *proxyResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + r.typeSuffix
+}
+
+func (r *proxyResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "Answers ARP/NDP on behalf of another host (proxy arp/ndp), on a device.",
+		Attributes: map[string]schema.Attribute{
+			"id":         schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":     schema.StringAttribute{Description: "Owning device.", Required: true},
+			"address":    schema.StringAttribute{Required: true},
+			"interface":  schema.StringAttribute{Optional: true},
+			"external":   schema.StringAttribute{Description: "External interface.", Required: true},
+			"haveroute":  schema.BoolAttribute{Optional: true, Computed: true, Default: booldefault.StaticBool(false)},
+			"persistent": schema.BoolAttribute{Optional: true, Computed: true, Default: booldefault.StaticBool(false)},
+			"comment":    schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *proxyResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *proxyResource) body(plan proxyModel) proxyAPI {
+	return proxyAPI{
+		Device:     plan.Device.ValueString(),
+		Address:    plan.Address.ValueString(),
+		Interface:  plan.Interface.ValueString(),
+		External:   plan.External.ValueString(),
+		HaveRoute:  plan.HaveRoute.ValueBool(),
+		Persistent: plan.Persistent.ValueBool(),
+		Comment:    plan.Comment.ValueString(),
+	}
+}
+
+func (r *proxyResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan proxyModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out proxyAPI
+	if err := r.client.post(ctx, r.endpoint, r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("create proxy failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *proxyResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state proxyModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out proxyAPI
+	if err := r.client.post(ctx, r.endpoint, r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("recreate proxy failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, r.endpoint+"/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old proxy failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *proxyResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state proxyModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out proxyAPI
+	if err := r.client.get(ctx, r.endpoint+"/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read proxy failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
+}
+
+func (r *proxyResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state proxyModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, r.endpoint+"/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete proxy failed", err.Error())
+	}
+}
+
+func (r *proxyResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "proxy id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *proxyResource) toModel(api proxyAPI, prior proxyModel) proxyModel {
+	return proxyModel{
+		ID:         types.Int64Value(api.ID),
+		Device:     types.StringValue(api.Device),
+		Address:    types.StringValue(api.Address),
+		Interface:  optionalString(api.Interface, prior.Interface),
+		External:   types.StringValue(api.External),
+		HaveRoute:  types.BoolValue(api.HaveRoute),
+		Persistent: types.BoolValue(api.Persistent),
+		Comment:    optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_route.go

@@ -0,0 +1,167 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &routeResource{}
+	_ resource.ResourceWithImportState = &routeResource{}
+)
+
+type routeResource struct{ client *apiClient }
+
+type routeModel struct {
+	ID         types.Int64  `tfsdk:"id"`
+	Device     types.String `tfsdk:"device"`
+	Provider   types.String `tfsdk:"provider"`
+	Dest       types.String `tfsdk:"dest"`
+	Gateway    types.String `tfsdk:"gateway"`
+	Oif        types.String `tfsdk:"oif"`
+	Persistent types.Bool   `tfsdk:"persistent"`
+	Comment    types.String `tfsdk:"comment"`
+}
+
+type routeAPI struct {
+	ID         int64  `json:"id,omitempty"`
+	Device     string `json:"device"`
+	Provider   string `json:"provider,omitempty"`
+	Dest       string `json:"dest"`
+	Gateway    string `json:"gateway,omitempty"`
+	Oif        string `json:"oif,omitempty"`
+	Persistent bool   `json:"persistent,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+func NewRouteResource() resource.Resource { return &routeResource{} }
+
+func (r *routeResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_route"
+}
+
+func (r *routeResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "A static route on a device. `oif` is the egress interface.",
+		Attributes: map[string]schema.Attribute{
+			"id":         schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":     schema.StringAttribute{Description: "Owning device.", Required: true},
+			"provider":   schema.StringAttribute{Optional: true},
+			"dest":       schema.StringAttribute{Required: true},
+			"gateway":    schema.StringAttribute{Optional: true},
+			"oif":        schema.StringAttribute{Description: "Egress interface.", Optional: true},
+			"persistent": schema.BoolAttribute{Optional: true, Computed: true, Default: booldefault.StaticBool(false)},
+			"comment":    schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *routeResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *routeResource) body(plan routeModel) routeAPI {
+	return routeAPI{
+		Device:     plan.Device.ValueString(),
+		Provider:   plan.Provider.ValueString(),
+		Dest:       plan.Dest.ValueString(),
+		Gateway:    plan.Gateway.ValueString(),
+		Oif:        plan.Oif.ValueString(),
+		Persistent: plan.Persistent.ValueBool(),
+		Comment:    plan.Comment.ValueString(),
+	}
+}
+
+func (r *routeResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan routeModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routeAPI
+	if err := r.client.post(ctx, "/api/v1/routes", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("create route failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *routeResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state routeModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routeAPI
+	if err := r.client.post(ctx, "/api/v1/routes", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("recreate route failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/routes/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old route failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *routeResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state routeModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routeAPI
+	if err := r.client.get(ctx, "/api/v1/routes/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read route failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
+}
+
+func (r *routeResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state routeModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/routes/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete route failed", err.Error())
+	}
+}
+
+func (r *routeResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "route id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *routeResource) toModel(api routeAPI, prior routeModel) routeModel {
+	return routeModel{
+		ID:         types.Int64Value(api.ID),
+		Device:     types.StringValue(api.Device),
+		Provider:   optionalString(api.Provider, prior.Provider),
+		Dest:       types.StringValue(api.Dest),
+		Gateway:    optionalString(api.Gateway, prior.Gateway),
+		Oif:        optionalString(api.Oif, prior.Oif),
+		Persistent: types.BoolValue(api.Persistent),
+		Comment:    optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_routing_rule.go

@@ -0,0 +1,173 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64default"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &routingRuleResource{}
+	_ resource.ResourceWithImportState = &routingRuleResource{}
+)
+
+type routingRuleResource struct{ client *apiClient }
+
+type routingRuleModel struct {
+	ID         types.Int64  `tfsdk:"id"`
+	Device     types.String `tfsdk:"device"`
+	Source     types.String `tfsdk:"source"`
+	Dest       types.String `tfsdk:"dest"`
+	Provider   types.String `tfsdk:"provider"`
+	Priority   types.Int64  `tfsdk:"priority"`
+	Persistent types.Bool   `tfsdk:"persistent"`
+	Mark       types.String `tfsdk:"mark"`
+	Comment    types.String `tfsdk:"comment"`
+}
+
+type routingRuleAPI struct {
+	ID         int64  `json:"id,omitempty"`
+	Device     string `json:"device"`
+	Source     string `json:"source,omitempty"`
+	Dest       string `json:"dest,omitempty"`
+	Provider   string `json:"provider"`
+	Priority   int    `json:"priority,omitempty"`
+	Persistent bool   `json:"persistent,omitempty"`
+	Mark       string `json:"mark,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+func NewRoutingRuleResource() resource.Resource { return &routingRuleResource{} }
+
+func (r *routingRuleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_routing_rule"
+}
+
+func (r *routingRuleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "Directs traffic to a provider's routing table on a device (rtrules).",
+		Attributes: map[string]schema.Attribute{
+			"id":         schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":     schema.StringAttribute{Description: "Owning device.", Required: true},
+			"source":     schema.StringAttribute{Optional: true},
+			"dest":       schema.StringAttribute{Optional: true},
+			"provider":   schema.StringAttribute{Required: true},
+			"priority":   schema.Int64Attribute{Optional: true, Computed: true, Default: int64default.StaticInt64(0)},
+			"persistent": schema.BoolAttribute{Optional: true, Computed: true, Default: booldefault.StaticBool(false)},
+			"mark":       schema.StringAttribute{Optional: true},
+			"comment":    schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *routingRuleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *routingRuleResource) body(plan routingRuleModel) routingRuleAPI {
+	return routingRuleAPI{
+		Device:     plan.Device.ValueString(),
+		Source:     plan.Source.ValueString(),
+		Dest:       plan.Dest.ValueString(),
+		Provider:   plan.Provider.ValueString(),
+		Priority:   int(plan.Priority.ValueInt64()),
+		Persistent: plan.Persistent.ValueBool(),
+		Mark:       plan.Mark.ValueString(),
+		Comment:    plan.Comment.ValueString(),
+	}
+}
+
+func (r *routingRuleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan routingRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routingRuleAPI
+	if err := r.client.post(ctx, "/api/v1/routing-rules", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("create routing_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *routingRuleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state routingRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routingRuleAPI
+	if err := r.client.post(ctx, "/api/v1/routing-rules", r.body(plan), &out); err != nil {
+		resp.Diagnostics.AddError("recreate routing_rule failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/routing-rules/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old routing_rule failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
+}
+
+func (r *routingRuleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state routingRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out routingRuleAPI
+	if err := r.client.get(ctx, "/api/v1/routing-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read routing_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
+}
+
+func (r *routingRuleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state routingRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/routing-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete routing_rule failed", err.Error())
+	}
+}
+
+func (r *routingRuleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "routing_rule id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *routingRuleResource) toModel(api routingRuleAPI, prior routingRuleModel) routingRuleModel {
+	return routingRuleModel{
+		ID:         types.Int64Value(api.ID),
+		Device:     types.StringValue(api.Device),
+		Source:     optionalString(api.Source, prior.Source),
+		Dest:       optionalString(api.Dest, prior.Dest),
+		Provider:   types.StringValue(api.Provider),
+		Priority:   types.Int64Value(int64(api.Priority)),
+		Persistent: types.BoolValue(api.Persistent),
+		Mark:       optionalString(api.Mark, prior.Mark),
+		Comment:    optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_stopped_rule.go

@@ -0,0 +1,180 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &stoppedRuleResource{}
+	_ resource.ResourceWithImportState = &stoppedRuleResource{}
+)
+
+type stoppedRuleResource struct{ client *apiClient }
+
+type stoppedRuleModel struct {
+	ID      types.Int64  `tfsdk:"id"`
+	Device  types.String `tfsdk:"device"`
+	Action  types.String `tfsdk:"action"`
+	Source  types.String `tfsdk:"source"`
+	Dest    types.String `tfsdk:"dest"`
+	Proto   types.String `tfsdk:"proto"`
+	DPort   types.List   `tfsdk:"dport"`
+	SPort   types.List   `tfsdk:"sport"`
+	Comment types.String `tfsdk:"comment"`
+}
+
+type stoppedRuleAPI struct {
+	ID      int64    `json:"id,omitempty"`
+	Device  string   `json:"device"`
+	Action  string   `json:"action"`
+	Source  string   `json:"source,omitempty"`
+	Dest    string   `json:"dest,omitempty"`
+	Proto   string   `json:"proto,omitempty"`
+	DPort   []string `json:"dport,omitempty"`
+	SPort   []string `json:"sport,omitempty"`
+	Comment string   `json:"comment,omitempty"`
+}
+
+func NewStoppedRuleResource() resource.Resource { return &stoppedRuleResource{} }
+
+func (r *stoppedRuleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_stopped_rule"
+}
+
+func (r *stoppedRuleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "Traffic permitted when the firewall is stopped, on a device.",
+		Attributes: map[string]schema.Attribute{
+			"id":      schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":  schema.StringAttribute{Description: "Owning device.", Required: true},
+			"action":  schema.StringAttribute{Description: "accept, drop, ...", Required: true},
+			"source":  schema.StringAttribute{Optional: true},
+			"dest":    schema.StringAttribute{Optional: true},
+			"proto":   schema.StringAttribute{Optional: true},
+			"dport":   schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"sport":   schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"comment": schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *stoppedRuleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *stoppedRuleResource) body(ctx context.Context, plan stoppedRuleModel, diags *diag.Diagnostics) stoppedRuleAPI {
+	return stoppedRuleAPI{
+		Device:  plan.Device.ValueString(),
+		Action:  plan.Action.ValueString(),
+		Source:  plan.Source.ValueString(),
+		Dest:    plan.Dest.ValueString(),
+		Proto:   plan.Proto.ValueString(),
+		DPort:   listToStrings(ctx, plan.DPort, diags),
+		SPort:   listToStrings(ctx, plan.SPort, diags),
+		Comment: plan.Comment.ValueString(),
+	}
+}
+
+func (r *stoppedRuleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan stoppedRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out stoppedRuleAPI
+	if err := r.client.post(ctx, "/api/v1/stopped-rules", body, &out); err != nil {
+		resp.Diagnostics.AddError("create stopped_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *stoppedRuleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state stoppedRuleModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out stoppedRuleAPI
+	if err := r.client.post(ctx, "/api/v1/stopped-rules", body, &out); err != nil {
+		resp.Diagnostics.AddError("recreate stopped_rule failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/stopped-rules/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old stopped_rule failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *stoppedRuleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state stoppedRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out stoppedRuleAPI
+	if err := r.client.get(ctx, "/api/v1/stopped-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read stopped_rule failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
+}
+
+func (r *stoppedRuleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state stoppedRuleModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/stopped-rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete stopped_rule failed", err.Error())
+	}
+}
+
+func (r *stoppedRuleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "stopped_rule id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *stoppedRuleResource) toModel(ctx context.Context, api stoppedRuleAPI, prior stoppedRuleModel, diags *diag.Diagnostics) stoppedRuleModel {
+	return stoppedRuleModel{
+		ID:      types.Int64Value(api.ID),
+		Device:  types.StringValue(api.Device),
+		Action:  types.StringValue(api.Action),
+		Source:  optionalString(api.Source, prior.Source),
+		Dest:    optionalString(api.Dest, prior.Dest),
+		Proto:   optionalString(api.Proto, prior.Proto),
+		DPort:   optionalList(ctx, api.DPort, prior.DPort, diags),
+		SPort:   optionalList(ctx, api.SPort, prior.SPort, diags),
+		Comment: optionalString(api.Comment, prior.Comment),
+	}
+}

internal/provider/resource_tunnel.go

@@ -0,0 +1,175 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &tunnelResource{}
+	_ resource.ResourceWithImportState = &tunnelResource{}
+)
+
+type tunnelResource struct{ client *apiClient }
+
+type tunnelModel struct {
+	ID           types.Int64  `tfsdk:"id"`
+	Device       types.String `tfsdk:"device"`
+	Type         types.String `tfsdk:"type"`
+	Zone         types.String `tfsdk:"zone"`
+	Gateways     types.List   `tfsdk:"gateways"`
+	GatewayZones types.List   `tfsdk:"gateway_zones"`
+	Port         types.Int64  `tfsdk:"port"`
+	Comment      types.String `tfsdk:"comment"`
+}
+
+type tunnelAPI struct {
+	ID           int64    `json:"id,omitempty"`
+	Device       string   `json:"device"`
+	Type         string   `json:"type"`
+	Zone         string   `json:"zone"`
+	Gateways     []string `json:"gateways,omitempty"`
+	GatewayZones []string `json:"gateway_zones,omitempty"`
+	Port         int      `json:"port,omitempty"`
+	Comment      string   `json:"comment,omitempty"`
+}
+
+func NewTunnelResource() resource.Resource { return &tunnelResource{} }
+
+func (r *tunnelResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_tunnel"
+}
+
+func (r *tunnelResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "A VPN tunnel definition on a device (allows encapsulated traffic).",
+		Attributes: map[string]schema.Attribute{
+			"id":            schema.Int64Attribute{Computed: true, PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}},
+			"device":        schema.StringAttribute{Description: "Owning device.", Required: true},
+			"type":          schema.StringAttribute{Description: "Tunnel type (ipsec, openvpn:udp, ...).", Required: true},
+			"zone":          schema.StringAttribute{Required: true},
+			"gateways":      schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"gateway_zones": schema.ListAttribute{Optional: true, ElementType: types.StringType},
+			"port":          schema.Int64Attribute{Optional: true},
+			"comment":       schema.StringAttribute{Optional: true},
+		},
+	}
+}
+
+func (r *tunnelResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	r.client = configureClient(req, resp)
+}
+
+func (r *tunnelResource) body(ctx context.Context, plan tunnelModel, diags *diag.Diagnostics) tunnelAPI {
+	return tunnelAPI{
+		Device:       plan.Device.ValueString(),
+		Type:         plan.Type.ValueString(),
+		Zone:         plan.Zone.ValueString(),
+		Gateways:     listToStrings(ctx, plan.Gateways, diags),
+		GatewayZones: listToStrings(ctx, plan.GatewayZones, diags),
+		Port:         int(plan.Port.ValueInt64()),
+		Comment:      plan.Comment.ValueString(),
+	}
+}
+
+func (r *tunnelResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan tunnelModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out tunnelAPI
+	if err := r.client.post(ctx, "/api/v1/tunnels", body, &out); err != nil {
+		resp.Diagnostics.AddError("create tunnel failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *tunnelResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state tunnelModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	body := r.body(ctx, plan, &resp.Diagnostics)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out tunnelAPI
+	if err := r.client.post(ctx, "/api/v1/tunnels", body, &out); err != nil {
+		resp.Diagnostics.AddError("recreate tunnel failed", err.Error())
+		return
+	}
+	if id := state.ID.ValueInt64(); id != 0 {
+		if err := r.client.del(ctx, "/api/v1/tunnels/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
+			resp.Diagnostics.AddError("delete old tunnel failed", err.Error())
+			return
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
+}
+
+func (r *tunnelResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state tunnelModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var out tunnelAPI
+	if err := r.client.get(ctx, "/api/v1/tunnels/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read tunnel failed", err.Error())
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
+}
+
+func (r *tunnelResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state tunnelModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if err := r.client.del(ctx, "/api/v1/tunnels/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
+		resp.Diagnostics.AddError("delete tunnel failed", err.Error())
+	}
+}
+
+func (r *tunnelResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	id, err := strconv.ParseInt(req.ID, 10, 64)
+	if err != nil {
+		resp.Diagnostics.AddError("invalid import ID", "tunnel id must be an integer")
+		return
+	}
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
+}
+
+func (r *tunnelResource) toModel(ctx context.Context, api tunnelAPI, prior tunnelModel, diags *diag.Diagnostics) tunnelModel {
+	return tunnelModel{
+		ID:           types.Int64Value(api.ID),
+		Device:       types.StringValue(api.Device),
+		Type:         types.StringValue(api.Type),
+		Zone:         types.StringValue(api.Zone),
+		Gateways:     optionalList(ctx, api.Gateways, prior.Gateways, diags),
+		GatewayZones: optionalList(ctx, api.GatewayZones, prior.GatewayZones, diags),
+		Port:         optionalInt64(api.Port, prior.Port),
+		Comment:      optionalString(api.Comment, prior.Comment),
+	}
+}