Overview
A firewall says who may connect to a resource. Once a firewall names a resource, only what its rules allow gets in. Rules read like sentences: allow TCP 5432 from app/api.
When to use it
- Only the API may reach the database.
- SSH to a VM from one address.
- Nothing may leave for the internet.
How it works
- nftables
- Rules are applied inside each target’s own network namespace.
- Live addresses
- A rule naming a resource follows the current addresses of all its containers.
For each target, every firewall naming it is combined into one policy. Some traffic is always allowed: replies, the edge proxy, health probes, and load balancers on their target ports.
Architecture
- app/api to nftables: tcp 5432
- Any other app to nftables: dropped
- nftables to database/orders: allowed
Flows
Applying a rule
- You create or change a firewall.
- EnclaveStack resolves names to addresses.
- The rules are written into each target’s namespace.
Set it up
In the console
- Open Firewalls and choose New firewall.
- Choose what it protects.
- Add rules: protocol, ports and sources.
With the CLI
enclave firewall create db-access --target database/orders --allow "tcp 5432 from app/api" --waitWith OpenTofu
OpenTofu configuration
resource "enclave_firewall" "db_access" {
name = "db-access"
targets = ["database/orders"]
ingress = [
{ protocol = "tcp", ports = ["5432"], from = ["app/api"] },
]
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
name | text | required | Name of the firewall: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the firewall. |
targets | list of text | required | Resources to protect, e.g. ["database/orders", "app/api"]. |
egress | list of objects | optional | Outgoing rules (with egress_default = "deny"). |
egress_default | text | optional | Outgoing traffic no rule names: allow (default) or deny. |
ingress | list of objects | optional | Incoming rules. |
project | text | optional | The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource. |
applied_containers | number | output | How many containers carry these rules. |
id | text | output | Resource ID. |
Limits and security
Good to know
- Ports published on this computer stay reachable through the machine.
Security
- Default deny once named; outgoing traffic can be denied too.