From e8d83b79247f25095346041d4af65c3e0dc3da16 Mon Sep 17 00:00:00 2001 From: Calvin Morrison Date: Wed, 19 Aug 2026 13:00:26 -0400 Subject: lib: the host rule set three files were already pointing at /lib/ndb/fw names it, fw(8) uses it in two examples, and the service file passes it as the rule file. Nothing provided it, so following any of them got you a firewall that would not start. Written for the qemu NAT segment this is developed on: the local /24 first, since the gateway and the resolver both live there, then name resolution and the web, icmp so there is something to test with that does not need a name resolved first, and one port answered on. Calvin's; committed so the tree stops referring to a file that is not in it. Co-Authored-By: Claude Opus 5 --- fw/lib/host.ndb | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 fw/lib/host.ndb (limited to 'fw') diff --git a/fw/lib/host.ndb b/fw/lib/host.ndb new file mode 100644 index 0000000..6be13f4 --- /dev/null +++ b/fw/lib/host.ndb @@ -0,0 +1,23 @@ +# +# the rules this machine runs behind, in card mode: everything ether0 +# sends or receives is matched here, whoever sent it. See fwrules(6). +# +# The local segment. On a qemu NAT this is where the gateway and the +# resolver both live, so it has to come before anything else works. +allow=out ip=10.0.2.0/24 + +# Name resolution and the web, for traffic leaving the segment. +allow=out proto=udp port=53 +allow=out proto=tcp port=53 +allow=out proto=tcp port=80 +allow=out proto=tcp port=443 + +# Ping, so there is something to check the firewall with that does not +# need a name resolved first. +allow=out proto=icmp + +# The one port this machine answers on: rcpu. +allow=in proto=tcp lport=17019 + +# Anything not named above is denied, in both directions. There is no +# rule for that; it is what happens when nothing matches. -- cgit v1.2.3