diff --git a/pkg/nodeconfigs/node_config.go b/pkg/nodeconfigs/node_config.go
index 643cea6..35be39f 100644
--- a/pkg/nodeconfigs/node_config.go
+++ b/pkg/nodeconfigs/node_config.go
@@ -29,10 +29,11 @@ type NodeConfig struct {
 	GlobalConfig *serverconfigs.GlobalConfig `yaml:"globalConfig" json:"globalConfig"` // 全局配置
 
 	// 集群统一配置
-	HTTPFirewallPolicy *firewallconfigs.HTTPFirewallPolicy `yaml:"httpFirewallPolicy" json:"httpFirewallPolicy"`
-	HTTPCachePolicy    *serverconfigs.HTTPCachePolicy      `yaml:"httpCachePolicy" json:"httpCachePolicy"`
-	TOA                *TOAConfig                          `yaml:"toa" json:"toa"`
-	SystemServices     map[string]maps.Map                 `yaml:"systemServices" json:"systemServices"` // 系统服务配置 type => params
+	HTTPFirewallPolicy *firewallconfigs.HTTPFirewallPolicy     `yaml:"httpFirewallPolicy" json:"httpFirewallPolicy"`
+	HTTPCachePolicy    *serverconfigs.HTTPCachePolicy          `yaml:"httpCachePolicy" json:"httpCachePolicy"`
+	TOA                *TOAConfig                              `yaml:"toa" json:"toa"`
+	SystemServices     map[string]maps.Map                     `yaml:"systemServices" json:"systemServices"` // 系统服务配置 type => params
+	FirewallActions    []*firewallconfigs.FirewallActionConfig `yaml:"firewallActions" json:"firewallActions"`
 
 	paddedId string
 
@@ -129,6 +130,14 @@ func (this *NodeConfig) Init() error {
 		}
 	}
 
+	// firewall actions
+	for _, action := range this.FirewallActions {
+		err := action.Init()
+		if err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
diff --git a/pkg/rpc/pb/model_ip_item.pb.go b/pkg/rpc/pb/model_ip_item.pb.go
index 8c0f23a..1bbf281 100644
--- a/pkg/rpc/pb/model_ip_item.pb.go
+++ b/pkg/rpc/pb/model_ip_item.pb.go
@@ -30,15 +30,17 @@ type IPItem struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id        int64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	IpFrom    string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`
-	IpTo      string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`
-	Version   int64  `protobuf:"varint,4,opt,name=version,proto3" json:"version,omitempty"`
-	ExpiredAt int64  `protobuf:"varint,5,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"`
-	Reason    string `protobuf:"bytes,6,opt,name=reason,proto3" json:"reason,omitempty"`
-	ListId    int64  `protobuf:"varint,7,opt,name=listId,proto3" json:"listId,omitempty"`
-	IsDeleted bool   `protobuf:"varint,8,opt,name=isDeleted,proto3" json:"isDeleted,omitempty"`
-	Type      string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"`
+	Id         int64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	IpFrom     string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`
+	IpTo       string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`
+	Version    int64  `protobuf:"varint,4,opt,name=version,proto3" json:"version,omitempty"`
+	ExpiredAt  int64  `protobuf:"varint,5,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"`
+	Reason     string `protobuf:"bytes,6,opt,name=reason,proto3" json:"reason,omitempty"`
+	ListId     int64  `protobuf:"varint,7,opt,name=listId,proto3" json:"listId,omitempty"`
+	IsDeleted  bool   `protobuf:"varint,8,opt,name=isDeleted,proto3" json:"isDeleted,omitempty"`
+	Type       string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"`
+	EventLevel string `protobuf:"bytes,10,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"` // 级别
+	ListType   string `protobuf:"bytes,11,opt,name=listType,proto3" json:"listType,omitempty"`     // 所在名单类型，加此字段是为了快速定位IP的性质
 }
 
 func (x *IPItem) Reset() {
@@ -136,12 +138,26 @@ func (x *IPItem) GetType() string {
 	return ""
 }
 
+func (x *IPItem) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
+func (x *IPItem) GetListType() string {
+	if x != nil {
+		return x.ListType
+	}
+	return ""
+}
+
 var File_models_model_ip_item_proto protoreflect.FileDescriptor
 
 var file_models_model_ip_item_proto_rawDesc = []byte{
 	0x0a, 0x1a, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x69,
 	0x70, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70, 0x62,
-	0x22, 0xde, 0x01, 0x0a, 0x06, 0x49, 0x50, 0x49, 0x74, 0x65, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x22, 0x9a, 0x02, 0x0a, 0x06, 0x49, 0x50, 0x49, 0x74, 0x65, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x69,
 	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x02, 0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x69,
 	0x70, 0x46, 0x72, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69, 0x70, 0x46,
 	0x72, 0x6f, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x54, 0x6f, 0x18, 0x03, 0x20, 0x01, 0x28,
@@ -155,8 +171,11 @@ var file_models_model_ip_item_proto_rawDesc = []byte{
 	0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01,
 	0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x12, 0x0a,
 	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x6c, 0x69, 0x73, 0x74, 0x54, 0x79, 0x70, 0x65, 0x18, 0x0b, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x6c, 0x69, 0x73, 0x74, 0x54, 0x79, 0x70, 0x65, 0x42, 0x06, 0x5a,
+	0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/pkg/rpc/pb/model_node_cluster_firewall_action.pb.go b/pkg/rpc/pb/model_node_cluster_firewall_action.pb.go
new file mode 100644
index 0000000..45a1309
--- /dev/null
+++ b/pkg/rpc/pb/model_node_cluster_firewall_action.pb.go
@@ -0,0 +1,198 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0
+// 	protoc        v3.12.3
+// source: models/model_node_cluster_firewall_action.proto
+
+package pb
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type NodeClusterFirewallAction struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id            int64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	NodeClusterId int64  `protobuf:"varint,2,opt,name=nodeClusterId,proto3" json:"nodeClusterId,omitempty"`
+	Name          string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	EventLevel    string `protobuf:"bytes,4,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"`
+	ParamsJSON    []byte `protobuf:"bytes,5,opt,name=paramsJSON,proto3" json:"paramsJSON,omitempty"`
+	Type          string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"`
+}
+
+func (x *NodeClusterFirewallAction) Reset() {
+	*x = NodeClusterFirewallAction{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_models_model_node_cluster_firewall_action_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NodeClusterFirewallAction) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeClusterFirewallAction) ProtoMessage() {}
+
+func (x *NodeClusterFirewallAction) ProtoReflect() protoreflect.Message {
+	mi := &file_models_model_node_cluster_firewall_action_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeClusterFirewallAction.ProtoReflect.Descriptor instead.
+func (*NodeClusterFirewallAction) Descriptor() ([]byte, []int) {
+	return file_models_model_node_cluster_firewall_action_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *NodeClusterFirewallAction) GetId() int64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *NodeClusterFirewallAction) GetNodeClusterId() int64 {
+	if x != nil {
+		return x.NodeClusterId
+	}
+	return 0
+}
+
+func (x *NodeClusterFirewallAction) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *NodeClusterFirewallAction) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
+func (x *NodeClusterFirewallAction) GetParamsJSON() []byte {
+	if x != nil {
+		return x.ParamsJSON
+	}
+	return nil
+}
+
+func (x *NodeClusterFirewallAction) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+var File_models_model_node_cluster_firewall_action_proto protoreflect.FileDescriptor
+
+var file_models_model_node_cluster_firewall_action_proto_rawDesc = []byte{
+	0x0a, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e,
+	0x6f, 0x64, 0x65, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x72, 0x65,
+	0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x02, 0x70, 0x62, 0x22, 0xb9, 0x01, 0x0a, 0x19, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x49, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x6e, 0x6f, 0x64, 0x65,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a,
+	0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1e, 0x0a,
+	0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x4a, 0x53, 0x4f, 0x4e, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x4a, 0x53, 0x4f, 0x4e, 0x12, 0x12, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_models_model_node_cluster_firewall_action_proto_rawDescOnce sync.Once
+	file_models_model_node_cluster_firewall_action_proto_rawDescData = file_models_model_node_cluster_firewall_action_proto_rawDesc
+)
+
+func file_models_model_node_cluster_firewall_action_proto_rawDescGZIP() []byte {
+	file_models_model_node_cluster_firewall_action_proto_rawDescOnce.Do(func() {
+		file_models_model_node_cluster_firewall_action_proto_rawDescData = protoimpl.X.CompressGZIP(file_models_model_node_cluster_firewall_action_proto_rawDescData)
+	})
+	return file_models_model_node_cluster_firewall_action_proto_rawDescData
+}
+
+var file_models_model_node_cluster_firewall_action_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_models_model_node_cluster_firewall_action_proto_goTypes = []interface{}{
+	(*NodeClusterFirewallAction)(nil), // 0: pb.NodeClusterFirewallAction
+}
+var file_models_model_node_cluster_firewall_action_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_models_model_node_cluster_firewall_action_proto_init() }
+func file_models_model_node_cluster_firewall_action_proto_init() {
+	if File_models_model_node_cluster_firewall_action_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_models_model_node_cluster_firewall_action_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NodeClusterFirewallAction); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_models_model_node_cluster_firewall_action_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_models_model_node_cluster_firewall_action_proto_goTypes,
+		DependencyIndexes: file_models_model_node_cluster_firewall_action_proto_depIdxs,
+		MessageInfos:      file_models_model_node_cluster_firewall_action_proto_msgTypes,
+	}.Build()
+	File_models_model_node_cluster_firewall_action_proto = out.File
+	file_models_model_node_cluster_firewall_action_proto_rawDesc = nil
+	file_models_model_node_cluster_firewall_action_proto_goTypes = nil
+	file_models_model_node_cluster_firewall_action_proto_depIdxs = nil
+}
diff --git a/pkg/rpc/pb/service_ip_item.pb.go b/pkg/rpc/pb/service_ip_item.pb.go
index 9b73dbc..dabdb0e 100644
--- a/pkg/rpc/pb/service_ip_item.pb.go
+++ b/pkg/rpc/pb/service_ip_item.pb.go
@@ -35,12 +35,13 @@ type CreateIPItemRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	IpListId  int64  `protobuf:"varint,1,opt,name=ipListId,proto3" json:"ipListId,omitempty"`   // IP列表ID
-	IpFrom    string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`        // 开始IP
-	IpTo      string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`            // 结束IP（可选）
-	ExpiredAt int64  `protobuf:"varint,4,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"` // 过期时间戳（可选）
-	Reason    string `protobuf:"bytes,5,opt,name=reason,proto3" json:"reason,omitempty"`        // 加入理由（可选）
-	Type      string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"`            // 类型
+	IpListId   int64  `protobuf:"varint,1,opt,name=ipListId,proto3" json:"ipListId,omitempty"`    // IP列表ID
+	IpFrom     string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`         // 开始IP
+	IpTo       string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`             // 结束IP（可选）
+	ExpiredAt  int64  `protobuf:"varint,4,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"`  // 过期时间戳（可选）
+	Reason     string `protobuf:"bytes,5,opt,name=reason,proto3" json:"reason,omitempty"`         // 加入理由（可选）
+	Type       string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"`             // 类型
+	EventLevel string `protobuf:"bytes,7,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"` // 级别
 }
 
 func (x *CreateIPItemRequest) Reset() {
@@ -117,6 +118,13 @@ func (x *CreateIPItemRequest) GetType() string {
 	return ""
 }
 
+func (x *CreateIPItemRequest) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
 type CreateIPItemResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -170,12 +178,13 @@ type UpdateIPItemRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	IpItemId  int64  `protobuf:"varint,1,opt,name=ipItemId,proto3" json:"ipItemId,omitempty"`
-	IpFrom    string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`
-	IpTo      string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`
-	ExpiredAt int64  `protobuf:"varint,4,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"`
-	Reason    string `protobuf:"bytes,5,opt,name=reason,proto3" json:"reason,omitempty"`
-	Type      string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"` // 类型
+	IpItemId   int64  `protobuf:"varint,1,opt,name=ipItemId,proto3" json:"ipItemId,omitempty"`
+	IpFrom     string `protobuf:"bytes,2,opt,name=ipFrom,proto3" json:"ipFrom,omitempty"`
+	IpTo       string `protobuf:"bytes,3,opt,name=ipTo,proto3" json:"ipTo,omitempty"`
+	ExpiredAt  int64  `protobuf:"varint,4,opt,name=expiredAt,proto3" json:"expiredAt,omitempty"`
+	Reason     string `protobuf:"bytes,5,opt,name=reason,proto3" json:"reason,omitempty"`
+	Type       string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"`             // 类型
+	EventLevel string `protobuf:"bytes,7,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"` // 级别
 }
 
 func (x *UpdateIPItemRequest) Reset() {
@@ -252,6 +261,13 @@ func (x *UpdateIPItemRequest) GetType() string {
 	return ""
 }
 
+func (x *UpdateIPItemRequest) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
 // 删除IP
 type DeleteIPItemRequest struct {
 	state         protoimpl.MessageState
@@ -665,7 +681,7 @@ var file_service_ip_item_proto_rawDesc = []byte{
 	0x65, 0x6c, 0x73, 0x2f, 0x72, 0x70, 0x63, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d,
 	0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x22, 0xa7, 0x01, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x50, 0x49,
+	0x74, 0x6f, 0x22, 0xc7, 0x01, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x50, 0x49,
 	0x74, 0x65, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x70,
 	0x4c, 0x69, 0x73, 0x74, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x70,
 	0x4c, 0x69, 0x73, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x70, 0x46, 0x72, 0x6f, 0x6d,
@@ -675,11 +691,13 @@ var file_service_ip_item_proto_rawDesc = []byte{
 	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x64, 0x41, 0x74,
 	0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x32, 0x0a, 0x14,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x22, 0x32, 0x0a, 0x14,
 	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x50, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x65, 0x73, 0x70,
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x70, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x70, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64,
-	0x22, 0xa7, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x49, 0x50, 0x49, 0x74, 0x65,
+	0x22, 0xc7, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x49, 0x50, 0x49, 0x74, 0x65,
 	0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x70, 0x49, 0x74,
 	0x65, 0x6d, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x70, 0x49, 0x74,
 	0x65, 0x6d, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x70, 0x46, 0x72, 0x6f, 0x6d, 0x18, 0x02,
@@ -689,7 +707,9 @@ var file_service_ip_item_proto_rawDesc = []byte{
 	0x01, 0x28, 0x03, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x64, 0x41, 0x74, 0x12, 0x16,
 	0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
 	0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x31, 0x0a, 0x13, 0x44, 0x65,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x76,
+	0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x22, 0x31, 0x0a, 0x13, 0x44, 0x65,
 	0x6c, 0x65, 0x74, 0x65, 0x49, 0x50, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x70, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x70, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x22, 0x3b, 0x0a,
diff --git a/pkg/rpc/pb/service_node_cluster_firewall_action.pb.go b/pkg/rpc/pb/service_node_cluster_firewall_action.pb.go
new file mode 100644
index 0000000..d89c99c
--- /dev/null
+++ b/pkg/rpc/pb/service_node_cluster_firewall_action.pb.go
@@ -0,0 +1,1002 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0
+// 	protoc        v3.12.3
+// source: service_node_cluster_firewall_action.proto
+
+package pb
+
+import (
+	context "context"
+	proto "github.com/golang/protobuf/proto"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+// 创建动作
+type CreateNodeClusterFirewallActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterId int64  `protobuf:"varint,1,opt,name=nodeClusterId,proto3" json:"nodeClusterId,omitempty"`
+	Name          string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	EventLevel    string `protobuf:"bytes,3,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"`
+	Type          string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"`
+	ParamsJSON    []byte `protobuf:"bytes,5,opt,name=paramsJSON,proto3" json:"paramsJSON,omitempty"`
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) Reset() {
+	*x = CreateNodeClusterFirewallActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateNodeClusterFirewallActionRequest) ProtoMessage() {}
+
+func (x *CreateNodeClusterFirewallActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateNodeClusterFirewallActionRequest.ProtoReflect.Descriptor instead.
+func (*CreateNodeClusterFirewallActionRequest) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) GetNodeClusterId() int64 {
+	if x != nil {
+		return x.NodeClusterId
+	}
+	return 0
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *CreateNodeClusterFirewallActionRequest) GetParamsJSON() []byte {
+	if x != nil {
+		return x.ParamsJSON
+	}
+	return nil
+}
+
+type NodeClusterFirewallActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallActionId int64 `protobuf:"varint,1,opt,name=nodeClusterFirewallActionId,proto3" json:"nodeClusterFirewallActionId,omitempty"`
+}
+
+func (x *NodeClusterFirewallActionResponse) Reset() {
+	*x = NodeClusterFirewallActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NodeClusterFirewallActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeClusterFirewallActionResponse) ProtoMessage() {}
+
+func (x *NodeClusterFirewallActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeClusterFirewallActionResponse.ProtoReflect.Descriptor instead.
+func (*NodeClusterFirewallActionResponse) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *NodeClusterFirewallActionResponse) GetNodeClusterFirewallActionId() int64 {
+	if x != nil {
+		return x.NodeClusterFirewallActionId
+	}
+	return 0
+}
+
+// 修改动作
+type UpdateNodeClusterFirewallActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallActionId int64  `protobuf:"varint,1,opt,name=nodeClusterFirewallActionId,proto3" json:"nodeClusterFirewallActionId,omitempty"`
+	Name                        string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	EventLevel                  string `protobuf:"bytes,3,opt,name=eventLevel,proto3" json:"eventLevel,omitempty"`
+	Type                        string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"`
+	ParamsJSON                  []byte `protobuf:"bytes,5,opt,name=paramsJSON,proto3" json:"paramsJSON,omitempty"`
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) Reset() {
+	*x = UpdateNodeClusterFirewallActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateNodeClusterFirewallActionRequest) ProtoMessage() {}
+
+func (x *UpdateNodeClusterFirewallActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateNodeClusterFirewallActionRequest.ProtoReflect.Descriptor instead.
+func (*UpdateNodeClusterFirewallActionRequest) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) GetNodeClusterFirewallActionId() int64 {
+	if x != nil {
+		return x.NodeClusterFirewallActionId
+	}
+	return 0
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) GetEventLevel() string {
+	if x != nil {
+		return x.EventLevel
+	}
+	return ""
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *UpdateNodeClusterFirewallActionRequest) GetParamsJSON() []byte {
+	if x != nil {
+		return x.ParamsJSON
+	}
+	return nil
+}
+
+// 删除动作
+type DeleteNodeClusterFirewallActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallActionId int64 `protobuf:"varint,1,opt,name=nodeClusterFirewallActionId,proto3" json:"nodeClusterFirewallActionId,omitempty"`
+}
+
+func (x *DeleteNodeClusterFirewallActionRequest) Reset() {
+	*x = DeleteNodeClusterFirewallActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteNodeClusterFirewallActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteNodeClusterFirewallActionRequest) ProtoMessage() {}
+
+func (x *DeleteNodeClusterFirewallActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteNodeClusterFirewallActionRequest.ProtoReflect.Descriptor instead.
+func (*DeleteNodeClusterFirewallActionRequest) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *DeleteNodeClusterFirewallActionRequest) GetNodeClusterFirewallActionId() int64 {
+	if x != nil {
+		return x.NodeClusterFirewallActionId
+	}
+	return 0
+}
+
+// 查询集群的所有动作
+type FindAllEnabledNodeClusterFirewallActionsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterId int64 `protobuf:"varint,1,opt,name=nodeClusterId,proto3" json:"nodeClusterId,omitempty"`
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsRequest) Reset() {
+	*x = FindAllEnabledNodeClusterFirewallActionsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindAllEnabledNodeClusterFirewallActionsRequest) ProtoMessage() {}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindAllEnabledNodeClusterFirewallActionsRequest.ProtoReflect.Descriptor instead.
+func (*FindAllEnabledNodeClusterFirewallActionsRequest) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsRequest) GetNodeClusterId() int64 {
+	if x != nil {
+		return x.NodeClusterId
+	}
+	return 0
+}
+
+type FindAllEnabledNodeClusterFirewallActionsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallActions []*NodeClusterFirewallAction `protobuf:"bytes,1,rep,name=nodeClusterFirewallActions,proto3" json:"nodeClusterFirewallActions,omitempty"`
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsResponse) Reset() {
+	*x = FindAllEnabledNodeClusterFirewallActionsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindAllEnabledNodeClusterFirewallActionsResponse) ProtoMessage() {}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindAllEnabledNodeClusterFirewallActionsResponse.ProtoReflect.Descriptor instead.
+func (*FindAllEnabledNodeClusterFirewallActionsResponse) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *FindAllEnabledNodeClusterFirewallActionsResponse) GetNodeClusterFirewallActions() []*NodeClusterFirewallAction {
+	if x != nil {
+		return x.NodeClusterFirewallActions
+	}
+	return nil
+}
+
+// 查询单个动作
+type FindEnabledNodeClusterFirewallActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallActionId int64 `protobuf:"varint,1,opt,name=nodeClusterFirewallActionId,proto3" json:"nodeClusterFirewallActionId,omitempty"`
+}
+
+func (x *FindEnabledNodeClusterFirewallActionRequest) Reset() {
+	*x = FindEnabledNodeClusterFirewallActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindEnabledNodeClusterFirewallActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindEnabledNodeClusterFirewallActionRequest) ProtoMessage() {}
+
+func (x *FindEnabledNodeClusterFirewallActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindEnabledNodeClusterFirewallActionRequest.ProtoReflect.Descriptor instead.
+func (*FindEnabledNodeClusterFirewallActionRequest) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *FindEnabledNodeClusterFirewallActionRequest) GetNodeClusterFirewallActionId() int64 {
+	if x != nil {
+		return x.NodeClusterFirewallActionId
+	}
+	return 0
+}
+
+type FindEnabledNodeClusterFirewallActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeClusterFirewallAction *NodeClusterFirewallAction `protobuf:"bytes,1,opt,name=nodeClusterFirewallAction,proto3" json:"nodeClusterFirewallAction,omitempty"`
+}
+
+func (x *FindEnabledNodeClusterFirewallActionResponse) Reset() {
+	*x = FindEnabledNodeClusterFirewallActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_node_cluster_firewall_action_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindEnabledNodeClusterFirewallActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindEnabledNodeClusterFirewallActionResponse) ProtoMessage() {}
+
+func (x *FindEnabledNodeClusterFirewallActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_service_node_cluster_firewall_action_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindEnabledNodeClusterFirewallActionResponse.ProtoReflect.Descriptor instead.
+func (*FindEnabledNodeClusterFirewallActionResponse) Descriptor() ([]byte, []int) {
+	return file_service_node_cluster_firewall_action_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *FindEnabledNodeClusterFirewallActionResponse) GetNodeClusterFirewallAction() *NodeClusterFirewallAction {
+	if x != nil {
+		return x.NodeClusterFirewallAction
+	}
+	return nil
+}
+
+var File_service_node_cluster_firewall_action_proto protoreflect.FileDescriptor
+
+var file_service_node_cluster_firewall_action_proto_rawDesc = []byte{
+	0x0a, 0x2a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x63,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70, 0x62,
+	0x1a, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e,
+	0x6f, 0x64, 0x65, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x72, 0x65,
+	0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x19, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x72, 0x70, 0x63, 0x5f, 0x6d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb6, 0x01, 0x0a,
+	0x26, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d,
+	0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x4a,
+	0x53, 0x4f, 0x4e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d,
+	0x73, 0x4a, 0x53, 0x4f, 0x4e, 0x22, 0x65, 0x0a, 0x21, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x1b, 0x6e, 0x6f,
+	0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c,
+	0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x1b, 0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65,
+	0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0xd2, 0x01, 0x0a,
+	0x26, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x1b, 0x6e, 0x6f, 0x64, 0x65, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x1b, 0x6e, 0x6f,
+	0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c,
+	0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a,
+	0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x12, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x4a, 0x53, 0x4f, 0x4e, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x4a, 0x53, 0x4f,
+	0x4e, 0x22, 0x6a, 0x0a, 0x26, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x1b, 0x6e,
+	0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x1b, 0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72,
+	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x57, 0x0a,
+	0x2f, 0x46, 0x69, 0x6e, 0x64, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e,
+	0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x24, 0x0a, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x22, 0x91, 0x01, 0x0a, 0x30, 0x46, 0x69, 0x6e, 0x64, 0x41,
+	0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x1a, 0x6e,
+	0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x70, 0x62, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x1a,
+	0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x6f, 0x0a, 0x2b, 0x46, 0x69,
+	0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x1b, 0x6e, 0x6f, 0x64,
+	0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x1b,
+	0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x8b, 0x01, 0x0a, 0x2c,
+	0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5b, 0x0a, 0x19,
+	0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x70, 0x62, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x19,
+	0x6e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0xfa, 0x04, 0x0a, 0x20, 0x4e, 0x6f,
+	0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c,
+	0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x74,
+	0x0a, 0x1f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x2a, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64,
+	0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e,
+	0x70, 0x62, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x1f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x6f,
+	0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c,
+	0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x2e, 0x70, 0x62, 0x2e, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x12, 0x5d, 0x0a, 0x1f, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x6f, 0x64,
+	0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72,
+	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x12, 0x95, 0x01, 0x0a, 0x28, 0x66, 0x69, 0x6e, 0x64, 0x41, 0x6c, 0x6c, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
+	0x33, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x34, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x41, 0x6c,
+	0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x89, 0x01, 0x0a, 0x24, 0x66,
+	0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46,
+	0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_service_node_cluster_firewall_action_proto_rawDescOnce sync.Once
+	file_service_node_cluster_firewall_action_proto_rawDescData = file_service_node_cluster_firewall_action_proto_rawDesc
+)
+
+func file_service_node_cluster_firewall_action_proto_rawDescGZIP() []byte {
+	file_service_node_cluster_firewall_action_proto_rawDescOnce.Do(func() {
+		file_service_node_cluster_firewall_action_proto_rawDescData = protoimpl.X.CompressGZIP(file_service_node_cluster_firewall_action_proto_rawDescData)
+	})
+	return file_service_node_cluster_firewall_action_proto_rawDescData
+}
+
+var file_service_node_cluster_firewall_action_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_service_node_cluster_firewall_action_proto_goTypes = []interface{}{
+	(*CreateNodeClusterFirewallActionRequest)(nil),           // 0: pb.CreateNodeClusterFirewallActionRequest
+	(*NodeClusterFirewallActionResponse)(nil),                // 1: pb.NodeClusterFirewallActionResponse
+	(*UpdateNodeClusterFirewallActionRequest)(nil),           // 2: pb.UpdateNodeClusterFirewallActionRequest
+	(*DeleteNodeClusterFirewallActionRequest)(nil),           // 3: pb.DeleteNodeClusterFirewallActionRequest
+	(*FindAllEnabledNodeClusterFirewallActionsRequest)(nil),  // 4: pb.FindAllEnabledNodeClusterFirewallActionsRequest
+	(*FindAllEnabledNodeClusterFirewallActionsResponse)(nil), // 5: pb.FindAllEnabledNodeClusterFirewallActionsResponse
+	(*FindEnabledNodeClusterFirewallActionRequest)(nil),      // 6: pb.FindEnabledNodeClusterFirewallActionRequest
+	(*FindEnabledNodeClusterFirewallActionResponse)(nil),     // 7: pb.FindEnabledNodeClusterFirewallActionResponse
+	(*NodeClusterFirewallAction)(nil),                        // 8: pb.NodeClusterFirewallAction
+	(*RPCSuccess)(nil),                                       // 9: pb.RPCSuccess
+}
+var file_service_node_cluster_firewall_action_proto_depIdxs = []int32{
+	8, // 0: pb.FindAllEnabledNodeClusterFirewallActionsResponse.nodeClusterFirewallActions:type_name -> pb.NodeClusterFirewallAction
+	8, // 1: pb.FindEnabledNodeClusterFirewallActionResponse.nodeClusterFirewallAction:type_name -> pb.NodeClusterFirewallAction
+	0, // 2: pb.NodeClusterFirewallActionService.createNodeClusterFirewallAction:input_type -> pb.CreateNodeClusterFirewallActionRequest
+	2, // 3: pb.NodeClusterFirewallActionService.updateNodeClusterFirewallAction:input_type -> pb.UpdateNodeClusterFirewallActionRequest
+	3, // 4: pb.NodeClusterFirewallActionService.deleteNodeClusterFirewallAction:input_type -> pb.DeleteNodeClusterFirewallActionRequest
+	4, // 5: pb.NodeClusterFirewallActionService.findAllEnabledNodeClusterFirewallActions:input_type -> pb.FindAllEnabledNodeClusterFirewallActionsRequest
+	6, // 6: pb.NodeClusterFirewallActionService.findEnabledNodeClusterFirewallAction:input_type -> pb.FindEnabledNodeClusterFirewallActionRequest
+	1, // 7: pb.NodeClusterFirewallActionService.createNodeClusterFirewallAction:output_type -> pb.NodeClusterFirewallActionResponse
+	9, // 8: pb.NodeClusterFirewallActionService.updateNodeClusterFirewallAction:output_type -> pb.RPCSuccess
+	9, // 9: pb.NodeClusterFirewallActionService.deleteNodeClusterFirewallAction:output_type -> pb.RPCSuccess
+	5, // 10: pb.NodeClusterFirewallActionService.findAllEnabledNodeClusterFirewallActions:output_type -> pb.FindAllEnabledNodeClusterFirewallActionsResponse
+	7, // 11: pb.NodeClusterFirewallActionService.findEnabledNodeClusterFirewallAction:output_type -> pb.FindEnabledNodeClusterFirewallActionResponse
+	7, // [7:12] is the sub-list for method output_type
+	2, // [2:7] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_service_node_cluster_firewall_action_proto_init() }
+func file_service_node_cluster_firewall_action_proto_init() {
+	if File_service_node_cluster_firewall_action_proto != nil {
+		return
+	}
+	file_models_model_node_cluster_firewall_action_proto_init()
+	file_models_rpc_messages_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_service_node_cluster_firewall_action_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateNodeClusterFirewallActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NodeClusterFirewallActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateNodeClusterFirewallActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteNodeClusterFirewallActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindAllEnabledNodeClusterFirewallActionsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindAllEnabledNodeClusterFirewallActionsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindEnabledNodeClusterFirewallActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_node_cluster_firewall_action_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindEnabledNodeClusterFirewallActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_service_node_cluster_firewall_action_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_service_node_cluster_firewall_action_proto_goTypes,
+		DependencyIndexes: file_service_node_cluster_firewall_action_proto_depIdxs,
+		MessageInfos:      file_service_node_cluster_firewall_action_proto_msgTypes,
+	}.Build()
+	File_service_node_cluster_firewall_action_proto = out.File
+	file_service_node_cluster_firewall_action_proto_rawDesc = nil
+	file_service_node_cluster_firewall_action_proto_goTypes = nil
+	file_service_node_cluster_firewall_action_proto_depIdxs = nil
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConnInterface
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion6
+
+// NodeClusterFirewallActionServiceClient is the client API for NodeClusterFirewallActionService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type NodeClusterFirewallActionServiceClient interface {
+	// 创建动作
+	CreateNodeClusterFirewallAction(ctx context.Context, in *CreateNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*NodeClusterFirewallActionResponse, error)
+	// 修改动作
+	UpdateNodeClusterFirewallAction(ctx context.Context, in *UpdateNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*RPCSuccess, error)
+	// 删除动作
+	DeleteNodeClusterFirewallAction(ctx context.Context, in *DeleteNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*RPCSuccess, error)
+	// 查询集群的所有动作
+	FindAllEnabledNodeClusterFirewallActions(ctx context.Context, in *FindAllEnabledNodeClusterFirewallActionsRequest, opts ...grpc.CallOption) (*FindAllEnabledNodeClusterFirewallActionsResponse, error)
+	// 查询单个动作
+	FindEnabledNodeClusterFirewallAction(ctx context.Context, in *FindEnabledNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*FindEnabledNodeClusterFirewallActionResponse, error)
+}
+
+type nodeClusterFirewallActionServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewNodeClusterFirewallActionServiceClient(cc grpc.ClientConnInterface) NodeClusterFirewallActionServiceClient {
+	return &nodeClusterFirewallActionServiceClient{cc}
+}
+
+func (c *nodeClusterFirewallActionServiceClient) CreateNodeClusterFirewallAction(ctx context.Context, in *CreateNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*NodeClusterFirewallActionResponse, error) {
+	out := new(NodeClusterFirewallActionResponse)
+	err := c.cc.Invoke(ctx, "/pb.NodeClusterFirewallActionService/createNodeClusterFirewallAction", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeClusterFirewallActionServiceClient) UpdateNodeClusterFirewallAction(ctx context.Context, in *UpdateNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*RPCSuccess, error) {
+	out := new(RPCSuccess)
+	err := c.cc.Invoke(ctx, "/pb.NodeClusterFirewallActionService/updateNodeClusterFirewallAction", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeClusterFirewallActionServiceClient) DeleteNodeClusterFirewallAction(ctx context.Context, in *DeleteNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*RPCSuccess, error) {
+	out := new(RPCSuccess)
+	err := c.cc.Invoke(ctx, "/pb.NodeClusterFirewallActionService/deleteNodeClusterFirewallAction", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeClusterFirewallActionServiceClient) FindAllEnabledNodeClusterFirewallActions(ctx context.Context, in *FindAllEnabledNodeClusterFirewallActionsRequest, opts ...grpc.CallOption) (*FindAllEnabledNodeClusterFirewallActionsResponse, error) {
+	out := new(FindAllEnabledNodeClusterFirewallActionsResponse)
+	err := c.cc.Invoke(ctx, "/pb.NodeClusterFirewallActionService/findAllEnabledNodeClusterFirewallActions", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nodeClusterFirewallActionServiceClient) FindEnabledNodeClusterFirewallAction(ctx context.Context, in *FindEnabledNodeClusterFirewallActionRequest, opts ...grpc.CallOption) (*FindEnabledNodeClusterFirewallActionResponse, error) {
+	out := new(FindEnabledNodeClusterFirewallActionResponse)
+	err := c.cc.Invoke(ctx, "/pb.NodeClusterFirewallActionService/findEnabledNodeClusterFirewallAction", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// NodeClusterFirewallActionServiceServer is the server API for NodeClusterFirewallActionService service.
+type NodeClusterFirewallActionServiceServer interface {
+	// 创建动作
+	CreateNodeClusterFirewallAction(context.Context, *CreateNodeClusterFirewallActionRequest) (*NodeClusterFirewallActionResponse, error)
+	// 修改动作
+	UpdateNodeClusterFirewallAction(context.Context, *UpdateNodeClusterFirewallActionRequest) (*RPCSuccess, error)
+	// 删除动作
+	DeleteNodeClusterFirewallAction(context.Context, *DeleteNodeClusterFirewallActionRequest) (*RPCSuccess, error)
+	// 查询集群的所有动作
+	FindAllEnabledNodeClusterFirewallActions(context.Context, *FindAllEnabledNodeClusterFirewallActionsRequest) (*FindAllEnabledNodeClusterFirewallActionsResponse, error)
+	// 查询单个动作
+	FindEnabledNodeClusterFirewallAction(context.Context, *FindEnabledNodeClusterFirewallActionRequest) (*FindEnabledNodeClusterFirewallActionResponse, error)
+}
+
+// UnimplementedNodeClusterFirewallActionServiceServer can be embedded to have forward compatible implementations.
+type UnimplementedNodeClusterFirewallActionServiceServer struct {
+}
+
+func (*UnimplementedNodeClusterFirewallActionServiceServer) CreateNodeClusterFirewallAction(context.Context, *CreateNodeClusterFirewallActionRequest) (*NodeClusterFirewallActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateNodeClusterFirewallAction not implemented")
+}
+func (*UnimplementedNodeClusterFirewallActionServiceServer) UpdateNodeClusterFirewallAction(context.Context, *UpdateNodeClusterFirewallActionRequest) (*RPCSuccess, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateNodeClusterFirewallAction not implemented")
+}
+func (*UnimplementedNodeClusterFirewallActionServiceServer) DeleteNodeClusterFirewallAction(context.Context, *DeleteNodeClusterFirewallActionRequest) (*RPCSuccess, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteNodeClusterFirewallAction not implemented")
+}
+func (*UnimplementedNodeClusterFirewallActionServiceServer) FindAllEnabledNodeClusterFirewallActions(context.Context, *FindAllEnabledNodeClusterFirewallActionsRequest) (*FindAllEnabledNodeClusterFirewallActionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method FindAllEnabledNodeClusterFirewallActions not implemented")
+}
+func (*UnimplementedNodeClusterFirewallActionServiceServer) FindEnabledNodeClusterFirewallAction(context.Context, *FindEnabledNodeClusterFirewallActionRequest) (*FindEnabledNodeClusterFirewallActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method FindEnabledNodeClusterFirewallAction not implemented")
+}
+
+func RegisterNodeClusterFirewallActionServiceServer(s *grpc.Server, srv NodeClusterFirewallActionServiceServer) {
+	s.RegisterService(&_NodeClusterFirewallActionService_serviceDesc, srv)
+}
+
+func _NodeClusterFirewallActionService_CreateNodeClusterFirewallAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateNodeClusterFirewallActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeClusterFirewallActionServiceServer).CreateNodeClusterFirewallAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NodeClusterFirewallActionService/CreateNodeClusterFirewallAction",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeClusterFirewallActionServiceServer).CreateNodeClusterFirewallAction(ctx, req.(*CreateNodeClusterFirewallActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeClusterFirewallActionService_UpdateNodeClusterFirewallAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateNodeClusterFirewallActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeClusterFirewallActionServiceServer).UpdateNodeClusterFirewallAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NodeClusterFirewallActionService/UpdateNodeClusterFirewallAction",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeClusterFirewallActionServiceServer).UpdateNodeClusterFirewallAction(ctx, req.(*UpdateNodeClusterFirewallActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeClusterFirewallActionService_DeleteNodeClusterFirewallAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteNodeClusterFirewallActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeClusterFirewallActionServiceServer).DeleteNodeClusterFirewallAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NodeClusterFirewallActionService/DeleteNodeClusterFirewallAction",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeClusterFirewallActionServiceServer).DeleteNodeClusterFirewallAction(ctx, req.(*DeleteNodeClusterFirewallActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeClusterFirewallActionService_FindAllEnabledNodeClusterFirewallActions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FindAllEnabledNodeClusterFirewallActionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeClusterFirewallActionServiceServer).FindAllEnabledNodeClusterFirewallActions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NodeClusterFirewallActionService/FindAllEnabledNodeClusterFirewallActions",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeClusterFirewallActionServiceServer).FindAllEnabledNodeClusterFirewallActions(ctx, req.(*FindAllEnabledNodeClusterFirewallActionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NodeClusterFirewallActionService_FindEnabledNodeClusterFirewallAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FindEnabledNodeClusterFirewallActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NodeClusterFirewallActionServiceServer).FindEnabledNodeClusterFirewallAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NodeClusterFirewallActionService/FindEnabledNodeClusterFirewallAction",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NodeClusterFirewallActionServiceServer).FindEnabledNodeClusterFirewallAction(ctx, req.(*FindEnabledNodeClusterFirewallActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _NodeClusterFirewallActionService_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "pb.NodeClusterFirewallActionService",
+	HandlerType: (*NodeClusterFirewallActionServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "createNodeClusterFirewallAction",
+			Handler:    _NodeClusterFirewallActionService_CreateNodeClusterFirewallAction_Handler,
+		},
+		{
+			MethodName: "updateNodeClusterFirewallAction",
+			Handler:    _NodeClusterFirewallActionService_UpdateNodeClusterFirewallAction_Handler,
+		},
+		{
+			MethodName: "deleteNodeClusterFirewallAction",
+			Handler:    _NodeClusterFirewallActionService_DeleteNodeClusterFirewallAction_Handler,
+		},
+		{
+			MethodName: "findAllEnabledNodeClusterFirewallActions",
+			Handler:    _NodeClusterFirewallActionService_FindAllEnabledNodeClusterFirewallActions_Handler,
+		},
+		{
+			MethodName: "findEnabledNodeClusterFirewallAction",
+			Handler:    _NodeClusterFirewallActionService_FindEnabledNodeClusterFirewallAction_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "service_node_cluster_firewall_action.proto",
+}
diff --git a/pkg/rpc/protos/models/model_ip_item.proto b/pkg/rpc/protos/models/model_ip_item.proto
index f484f54..10763f9 100644
--- a/pkg/rpc/protos/models/model_ip_item.proto
+++ b/pkg/rpc/protos/models/model_ip_item.proto
@@ -13,4 +13,6 @@ message IPItem {
 	int64 listId = 7;
 	bool isDeleted = 8;
 	string type = 9;
+	string eventLevel = 10; // 级别
+	string listType = 11; // 所在名单类型，加此字段是为了快速定位IP的性质
 }
\ No newline at end of file
diff --git a/pkg/rpc/protos/models/model_node_cluster_firewall_action.proto b/pkg/rpc/protos/models/model_node_cluster_firewall_action.proto
new file mode 100644
index 0000000..5254b5f
--- /dev/null
+++ b/pkg/rpc/protos/models/model_node_cluster_firewall_action.proto
@@ -0,0 +1,13 @@
+syntax = "proto3";
+option go_package = "./pb";
+
+package pb;
+
+message NodeClusterFirewallAction {
+	int64 id = 1;
+	int64 nodeClusterId = 2;
+	string name = 3;
+	string eventLevel = 4;
+	bytes paramsJSON = 5;
+	string type = 6;
+}
\ No newline at end of file
diff --git a/pkg/rpc/protos/service_ip_item.proto b/pkg/rpc/protos/service_ip_item.proto
index 6792828..f61abfc 100644
--- a/pkg/rpc/protos/service_ip_item.proto
+++ b/pkg/rpc/protos/service_ip_item.proto
@@ -38,6 +38,7 @@ message CreateIPItemRequest {
 	int64 expiredAt = 4; // 过期时间戳（可选）
 	string reason = 5; // 加入理由（可选）
 	string type = 6; // 类型
+	string eventLevel = 7; // 级别
 }
 
 message CreateIPItemResponse {
@@ -52,6 +53,7 @@ message UpdateIPItemRequest {
 	int64 expiredAt = 4;
 	string reason = 5;
 	string type = 6; // 类型
+	string eventLevel = 7; // 级别
 }
 
 // 删除IP
diff --git a/pkg/rpc/protos/service_node_cluster_firewall_action.proto b/pkg/rpc/protos/service_node_cluster_firewall_action.proto
new file mode 100644
index 0000000..00766ef
--- /dev/null
+++ b/pkg/rpc/protos/service_node_cluster_firewall_action.proto
@@ -0,0 +1,70 @@
+syntax = "proto3";
+option go_package = "./pb";
+
+package pb;
+
+import "models/model_node_cluster_firewall_action.proto";
+import "models/rpc_messages.proto";
+
+// 防火墙动作服务
+service NodeClusterFirewallActionService {
+	// 创建动作
+	rpc createNodeClusterFirewallAction (CreateNodeClusterFirewallActionRequest) returns (NodeClusterFirewallActionResponse);
+
+	// 修改动作
+	rpc updateNodeClusterFirewallAction (UpdateNodeClusterFirewallActionRequest) returns (RPCSuccess);
+
+	// 删除动作
+	rpc deleteNodeClusterFirewallAction (DeleteNodeClusterFirewallActionRequest) returns (RPCSuccess);
+
+	// 查询集群的所有动作
+	rpc findAllEnabledNodeClusterFirewallActions (FindAllEnabledNodeClusterFirewallActionsRequest) returns (FindAllEnabledNodeClusterFirewallActionsResponse);
+
+	// 查询单个动作
+	rpc findEnabledNodeClusterFirewallAction (FindEnabledNodeClusterFirewallActionRequest) returns (FindEnabledNodeClusterFirewallActionResponse);
+}
+
+// 创建动作
+message CreateNodeClusterFirewallActionRequest {
+	int64 nodeClusterId = 1;
+	string name = 2;
+	string eventLevel = 3;
+	string type = 4;
+	bytes paramsJSON = 5;
+}
+
+message NodeClusterFirewallActionResponse {
+	int64 nodeClusterFirewallActionId = 1;
+}
+
+// 修改动作
+message UpdateNodeClusterFirewallActionRequest {
+	int64 nodeClusterFirewallActionId = 1;
+	string name = 2;
+	string eventLevel = 3;
+	string type = 4;
+	bytes paramsJSON = 5;
+}
+
+// 删除动作
+message DeleteNodeClusterFirewallActionRequest {
+	int64 nodeClusterFirewallActionId = 1;
+}
+
+// 查询集群的所有动作
+message FindAllEnabledNodeClusterFirewallActionsRequest {
+	int64 nodeClusterId = 1;
+}
+
+message FindAllEnabledNodeClusterFirewallActionsResponse {
+	repeated NodeClusterFirewallAction nodeClusterFirewallActions = 1;
+}
+
+// 查询单个动作
+message FindEnabledNodeClusterFirewallActionRequest {
+	int64 nodeClusterFirewallActionId = 1;
+}
+
+message FindEnabledNodeClusterFirewallActionResponse {
+	NodeClusterFirewallAction nodeClusterFirewallAction = 1;
+}
\ No newline at end of file
diff --git a/pkg/serverconfigs/firewallconfigs/firewall_action_config.go b/pkg/serverconfigs/firewallconfigs/firewall_action_config.go
new file mode 100644
index 0000000..621e59c
--- /dev/null
+++ b/pkg/serverconfigs/firewallconfigs/firewall_action_config.go
@@ -0,0 +1,16 @@
+package firewallconfigs
+
+import "github.com/iwind/TeaGo/maps"
+
+// 防火墙动作配置
+type FirewallActionConfig struct {
+	Id         int64    `yaml:"id" json:"id"`                 // Id
+	Type       string   `yaml:"type" json:"type"`             // 类型
+	Params     maps.Map `yaml:"params" json:"params"`         // 参数
+	EventLevel string   `yaml:"eventLevel" json:"eventLevel"` // 事件级别
+}
+
+// 初始化
+func (this *FirewallActionConfig) Init() error {
+	return nil
+}
diff --git a/pkg/serverconfigs/firewallconfigs/firewall_actions.go b/pkg/serverconfigs/firewallconfigs/firewall_actions.go
new file mode 100644
index 0000000..6d9a480
--- /dev/null
+++ b/pkg/serverconfigs/firewallconfigs/firewall_actions.go
@@ -0,0 +1,95 @@
+package firewallconfigs
+
+type FirewallActionType = string
+
+const (
+	FirewallActionTypeIPSet     FirewallActionType = "ipset"
+	FirewallActionTypeFirewalld FirewallActionType = "firewalld"
+	FirewallActionTypeIPTables  FirewallActionType = "iptables"
+	FirewallActionTypeScript    FirewallActionType = "script"
+	FirewallActionTypeHTTPAPI   FirewallActionType = "httpAPI"
+)
+
+type FirewallActionTypeDefinition struct {
+	Name        string             `json:"name"`
+	Code        FirewallActionType `json:"code"`
+	Description string             `json:"description"`
+}
+
+func FindAllFirewallActionTypes() []*FirewallActionTypeDefinition {
+	return []*FirewallActionTypeDefinition{
+		{
+			Name:        "ipset",
+			Code:        FirewallActionTypeIPSet,
+			Description: "使用特定的ipset管理IP，可以结合iptables和firewalld等工具一起工作。",
+		},
+		{
+			Name:        "firewalld",
+			Code:        FirewallActionTypeFirewalld,
+			Description: "使用Firewalld管理IP，非持久保存，reload之后重置规则。",
+		},
+		{
+			Name:        "iptables",
+			Code:        FirewallActionTypeIPTables,
+			Description: "使用IPTables管理IP，不支持超时时间设定，非持久保存，reload之后重置规则。",
+		},
+		{
+			Name:        "自定义脚本",
+			Code:        FirewallActionTypeScript,
+			Description: "使用自定义的脚本执行IP操作。",
+		},
+		{
+			Name:        "自定义HTTP API",
+			Code:        FirewallActionTypeHTTPAPI,
+			Description: "使用自定义的HTTP API执行IP操作。",
+		},
+	}
+}
+
+func FindFirewallActionTypeName(actionType FirewallActionType) string {
+	for _, a := range FindAllFirewallActionTypes() {
+		if a.Code == actionType {
+			return a.Name
+		}
+	}
+	return ""
+}
+
+type FirewallActionIPSetConfig struct {
+	Path               string `json:"path"`               // 命令路径 TODO 暂时不实现
+	WhiteName          string `json:"whiteName"`          // IPSet白名单名称
+	BlackName          string `json:"blackName"`          // IPSet黑名单名称
+	MaxElements        int    `json:"maxElements"`        // 最多IP数量 TODO 暂时不实现
+	AutoAddToIPTables  bool   `json:"autoAddToIPTables"`  // 是否自动创建IPTables规则
+	AutoAddToFirewalld bool   `json:"autoAddToFirewalld"` // 是否自动加入到Firewalld
+
+	// TODO 添加需要阻止的端口列表
+}
+
+type FirewallActionFirewalldConfig struct {
+	Path string `json:"path"` // 命令路径 TODO 暂时不实现
+
+	// TODO 添加需要阻止的端口列表
+}
+
+type FirewallActionIPTablesConfig struct {
+	Path string `json:"path"` // 命令路径 TODO 暂时不实现
+
+	// TODO 添加需要阻止的端口列表
+}
+
+type FirewallActionScriptConfig struct {
+	Path string   `json:"path"` // 脚本路径
+	Cwd  string   `json:"cwd"`  // 工作目录 TODO 暂时不实现
+	Args []string `json:"args"` // 附加参数 TODO 暂时不实现
+
+	// TODO 添加需要阻止的端口列表
+}
+
+type FirewallActionHTTPAPIConfig struct {
+	URL            string `json:"url"`            // URL路径
+	TimeoutSeconds int    `json:"timeoutSeconds"` // 超时时间 TODO 暂时不实现
+	Secret         string `json:"secret"`         // 认证密钥 TODO 暂时不实现
+
+	// TODO 添加需要阻止的端口列表
+}
diff --git a/pkg/serverconfigs/firewallconfigs/firewall_levels.go b/pkg/serverconfigs/firewallconfigs/firewall_levels.go
new file mode 100644
index 0000000..7463d70
--- /dev/null
+++ b/pkg/serverconfigs/firewallconfigs/firewall_levels.go
@@ -0,0 +1,51 @@
+package firewallconfigs
+
+type FirewallEventLevelDefinition struct {
+	Name        string `json:"name"`
+	Code        string `json:"code"`
+	Description string `json:"description"`
+}
+
+func FindAllFirewallEventLevels() []*FirewallEventLevelDefinition {
+	return []*FirewallEventLevelDefinition{
+		{
+			Name:        "调试",
+			Code:        "debug",
+			Description: "仅作为调试用途",
+		},
+		{
+			Name:        "通知",
+			Code:        "notice",
+			Description: "需要通知的事件",
+		},
+		{
+			Name:        "警告",
+			Code:        "warning",
+			Description: "需要警告的事件",
+		},
+		{
+			Name:        "错误",
+			Code:        "error",
+			Description: "发生系统错误的事件",
+		},
+		{
+			Name:        "严重",
+			Code:        "critical",
+			Description: "性质较为严重的事件",
+		},
+		{
+			Name:        "致命",
+			Code:        "fatal",
+			Description: "对系统有重大影响的事件",
+		},
+	}
+}
+
+func FindFirewallEventLevelName(code string) string {
+	for _, level := range FindAllFirewallEventLevels() {
+		if level.Code == code {
+			return level.Name
+		}
+	}
+	return ""
+}