blob: 6be13f4afd3e2c02932c2b9ed8b13064b3fdd12f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
#
# the rules this machine runs behind, in card mode: everything ether0
# sends or receives is matched here, whoever sent it. See fwrules(6).
#
# The local segment. On a qemu NAT this is where the gateway and the
# resolver both live, so it has to come before anything else works.
allow=out ip=10.0.2.0/24
# Name resolution and the web, for traffic leaving the segment.
allow=out proto=udp port=53
allow=out proto=tcp port=53
allow=out proto=tcp port=80
allow=out proto=tcp port=443
# Ping, so there is something to check the firewall with that does not
# need a name resolved first.
allow=out proto=icmp
# The one port this machine answers on: rcpu.
allow=in proto=tcp lport=17019
# Anything not named above is denied, in both directions. There is no
# rule for that; it is what happens when nothing matches.
|
