Egress policies
EgressPolicy: which destinations a Space may open connections to, enforced by the host outside the guest.
The egress policy CreateSpaceRequest.egress and SpaceService.SetSpaceEgress take and Space.egress returns, and its host form for HostSpacesService.SetHostSpaceEgress.
Source: libs/cua/proto/cua/daemon/v1/egress.proto, libs/cua/proto/cua/env/v1/host_egress.proto.
Types in cua/daemon/v1/egress.proto#
EgressPolicy#
Which destinations a Space may open connections to. Everything is
allowed unless a rule says otherwise: every deny entry blocks that
destination, every allow entry is an exception that wins over deny
(deny "all" with allow "1.1.1.1" leaves only 1.1.1.1 reachable), and an
allow list with no deny blocks nothing. Entries are IPv4/IPv6
addresses or CIDRs; "all" is 0.0.0.0/0 and ::/0; a hostname is refused.
DNS works only while the resolver's address is not blocked (or is
allowed). Loopback, replies to connections made to the guest and IPv6
neighbor discovery are never filtered.
| Field | # | Type | Description |
|---|---|---|---|
allow | 1 | repeated string | Destinations that stay reachable where deny blocks them. |
deny | 2 | repeated string | Destinations that are blocked. |
SetSpaceEgressRequest#
Request for SpaceService.SetSpaceEgress.
| Field | # | Type | Description |
|---|---|---|---|
space | 1 | string | Space. |
egress | 2 | EgressPolicy | The whole policy; empty removes it. |
SetSpaceEgressResponse#
Response for SpaceService.SetSpaceEgress.
No fields.
Types in cua/env/v1/host_egress.proto#
HostEgressPolicy#
Which destinations a Space may open connections to: every deny entry
blocks that destination, every allow entry is an exception that wins
over deny. Entries are IPv4/IPv6 addresses or CIDRs; "all" is 0.0.0.0/0
and ::/0; a hostname is refused.
| Field | # | Type | Description |
|---|---|---|---|
allow | 1 | repeated string | Destinations that stay reachable where deny blocks them. |
deny | 2 | repeated string | Destinations that are blocked. |
SetHostSpaceEgressRequest#
Request for HostSpacesService.SetHostSpaceEgress.
| Field | # | Type | Description |
|---|---|---|---|
space | 1 | string | The relay machine of the Space (or its local:<name> on the host). |
egress | 2 | HostEgressPolicy | The whole policy; empty removes it. |
SetHostSpaceEgressResponse#
Response for HostSpacesService.SetHostSpaceEgress.
| Field | # | Type | Description |
|---|---|---|---|
enforced | 1 | string | Where the policy is enforced: "host"; empty after a removal. |