lib: the host rule set three files were already pointing at

/lib/ndb/fw names it, fw(8) uses it in two examples, and the service
file passes it as the rule file.  Nothing provided it, so following any
of them got you a firewall that would not start.

Written for the qemu NAT segment this is developed on: the local /24
first, since the gateway and the resolver both live there, then name
resolution and the web, icmp so there is something to test with that
does not need a name resolved first, and one port answered on.

Calvin's; committed so the tree stops referring to a file that is not
in it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/fw/lib/host.ndb b/fw/lib/host.ndb
new file mode 100644
index 0000000..6be13f4
--- /dev/null
+++ b/fw/lib/host.ndb
@@ -0,0 +1,23 @@
+#
+# the rules this machine runs behind, in card mode: everything ether0
+# sends or receives is matched here, whoever sent it.  See fwrules(6).
+#
+# The local segment.  On a qemu NAT this is where the gateway and the
+# resolver both live, so it has to come before anything else works.
+allow=out	ip=10.0.2.0/24
+
+# Name resolution and the web, for traffic leaving the segment.
+allow=out	proto=udp	port=53
+allow=out	proto=tcp	port=53
+allow=out	proto=tcp	port=80
+allow=out	proto=tcp	port=443
+
+# Ping, so there is something to check the firewall with that does not
+# need a name resolved first.
+allow=out	proto=icmp
+
+# The one port this machine answers on: rcpu.
+allow=in	proto=tcp	lport=17019
+
+# Anything not named above is denied, in both directions.  There is no
+# rule for that; it is what happens when nothing matches.