diff options
| -rw-r--r-- | fw/lib/host.ndb | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/fw/lib/host.ndb b/fw/lib/host.ndb new file mode 100644 index 0000000..6be13f4 --- /dev/null +++ b/fw/lib/host.ndb @@ -0,0 +1,23 @@ +# +# the rules this machine runs behind, in card mode: everything ether0 +# sends or receives is matched here, whoever sent it. See fwrules(6). +# +# The local segment. On a qemu NAT this is where the gateway and the +# resolver both live, so it has to come before anything else works. +allow=out ip=10.0.2.0/24 + +# Name resolution and the web, for traffic leaving the segment. +allow=out proto=udp port=53 +allow=out proto=tcp port=53 +allow=out proto=tcp port=80 +allow=out proto=tcp port=443 + +# Ping, so there is something to check the firewall with that does not +# need a name resolved first. +allow=out proto=icmp + +# The one port this machine answers on: rcpu. +allow=in proto=tcp lport=17019 + +# Anything not named above is denied, in both directions. There is no +# rule for that; it is what happens when nothing matches. |