Firewall reference

Tables of the distributed firewall: rule and policy fields, actions, directions, categories, profiles, templates, modes, protection states and limits.

This page lists the values of the distributed firewall as the console and the API show them. The API names are in code font.

Rule fields

Console	API field	Values
Name	`name`	Text. Names that start with `sys:` are reserved for built-in objects
Direction	`direction`	`in`, `out`, `in-out` (default)
Action	`action`	`allow`, `drop`, `reject`, `pass`
IP versions	`ipVersion`	`any` (default), `v4`, `v6`
Sources	`sources`, `sourcesNegated`	Groups, addresses or prefixes. Empty means any. With `sourcesNegated`, everything except the list
Destinations	`destinations`, `destinationsNegated`	As the sources
Services	`services`	Service entries. Empty means any IP traffic
Applied to	`appliedTo`	Groups. Empty means the groups of the policy
Log matches	`logged`	`true` or `false`
Enabled	`enabled`	`true` (default) or `false`
Number	`number`	Given by Kyvernon, one counter for the whole domain. Numbers from `0xF0000000` up belong to rules that the platform maintains

Policy fields

Console	API field	Values
Name	`name`	Text, unique per scope
Description	`description`	Text
Category	`category`	`emergency`, `infrastructure`, `environment`, `application`
Sequence	`sequence`	Order inside the category, lowest first. Provider policies in Environment and Application use values below 1,000,000, tenant policies 1,000,000 and above. Without a value, the policy goes after the last one
Stateful	`stateful`	`true` (default): replies to allowed traffic are allowed. `false`: replies need their own rule
Enabled	`enabled`	`true` or `false`
Applied to	`appliedTo`	Groups. Empty means every network adapter in the scope

Service entries

`protocol`	Fields	Console text
`tcp`, `udp`, `sctp`	`ports`: ports or ranges such as `443` or `8000-8100`, 1 to 65535. Empty means any port	`TCP 443`, `UDP any port`
`icmp4`, `icmp6`	`icmpType`, `icmpCode`. A code needs a type	`ICMPv4 type 8`
`ip`	`number`: the IP protocol number, for example 47 for GRE	`IP protocol 47`
`named`	`id`: a service by name, such as `SSH` or `HTTPS`	The name of the service

Actions

Action	Console	Effect
`allow`	Allow	The packet passes. In a stateful policy the replies pass as well
`drop`	Drop	The packet is discarded without an answer
`reject`	Reject	The packet is discarded and the sender is answered: a TCP reset, or an ICMP unreachable message for other protocols
`pass`	Pass	Ends the evaluation of the current category and continues with the next. Not allowed in the category Application

Default actions of a profile are allow, drop or reject.

Directions

Value	Console	Meaning
`in`	Inbound	Traffic that arrives at the network adapter
`out`	Outbound	Traffic that leaves the network adapter
`in-out`	Both	Both. A rule applies at the adapter of each end

Order	Category	Who may use it	Use
1	Emergency	Provider	Evaluated first. Emergency bypass rules
2	Infrastructure	Provider	Platform rules, such as the block of outbound mail
3	Environment	Provider and tenants	Rules between zones and environments
4	Application	Provider and tenants	Rules of the applications, evaluated last

Origins of effective rules

Value	Console	Meaning
`provider`	Provider	A rule of a provider policy
`tenant`	Tenant	A rule of a tenant policy
`baseline`	Baseline	A rule of the baseline policy of the profile
`system`	System	A rule that the platform maintains
`default`	Default	The default action of the profile, with the number n/a

Default profiles

Profile	Inbound	Outbound	Baseline	Chosen by tenants
`public-default`	`drop`	`allow`	`allow` TCP 22, ICMPv4 echo and ICMPv6 echo	Yes
`private-default`	`allow`	`allow`	None	No
`closed`	`drop`	`allow`	None	Yes
`open`	`allow`	`allow`	None	No

An adapter with an address from an IP pool starts with public-default, and an adapter with a range lease on a host-bridge network with private-default. The choice for tenants is the setting Tenants may choose it of the profile, and the values above are those that the platform ships. See Default profiles.

Templates

Each template adds inbound allow rules to the own policy of a virtual machine.

Template	Rules
`ssh-only`	TCP 22 and ICMP echo
`web`	TCP 22, 80 and 443 and ICMP echo
`mail-server`	TCP 22, 25, 465, 587, 143, 993, 110 and 995 and ICMP echo. Outbound port 25 is a separate switch

A provider administrator can add templates of 1 to 50 rules. Their rules are inbound allow rules with services and addresses, never groups.

Modes

Value	Console	Effect
`off`	Off	Traffic is switched as before the firewall existed. Nothing is filtered. New and existing adapters start here unless the setting Enforce new network adapters is on
`monitor`	Monitor	The rules run, packets that would be dropped are counted and reported, and every packet is forwarded
`enforce`	Enforce	Packets that no rule allows are dropped or rejected

Protection states

Value	Console	Meaning
`enforced`	Enforced	The adapter is firewalled in the mode `enforce`
`monitor`	Monitoring	The adapter is firewalled in the mode `monitor`
`off`	Off	The mode is `off`
`unprotected`	Unprotected	The adapter cannot be firewalled. The reason is `linux_or_quarantine_bridge` or `port_security_off`

Realization states

State	Console	Meaning
`realized`	In force	The host applied the version that the control plane wants
`waiting`	Waiting for the host	The host applies an older version
`precondition`	Precondition not met	The host does not meet a condition, such as `ct-zone-range`
`error`	Error	The host could not apply the plan and keeps the previous version

Settings

Console	API field	Default
Flow limit per bridge	`flowLimitPerBridge`	100,000
Tracked connections per adapter	`ctLimitPerPort`	65,536
Days a monitor report covers	`monitorReportDays`	7
Log rate per host	`logRatePps`	100 packets per second
Reject rate per bridge	`rejectRatePps`	200 answers per second
Enforce new network adapters	`enforceNew`	Off

Limits

Item	Limit
Rules in one policy	1,000
Groups in the domain	10,000
Nesting of groups	5 levels
Addresses that one group resolves to	4,096
Entries on a negated side of a rule	64
Mode confirmation timer	30 to 86,400 seconds in the API and the CLI. The console offers 1, 5, 10, 30 minutes, 1 hour and 4 hours
Bypass duration	60 to 86,400 seconds in the API and the CLI, 1,800 by default. The console offers 5, 15, 30 minutes, 1, 4, 12 and 24 hours
Bypass reason	1 to 500 characters
Log records kept	The last 30 days, at most 50,000 for all hosts
Log records in one answer	500 by default, at most 5,000
Counters kept	400 days after the last hit
Monitor entries kept	90 days after they were last seen, 16 sample sources for each

Tenant quotas apply to the objects of one tenant. When no value is set, the default applies, and it is not unlimited.

Quota	API field	Default
Groups	`fwGroups`	100
Policies	`fwPolicies`	50
Rules in all policies	`fwRules`	500
Group members, including tag criteria	`fwGroupMembers`	1,000

Privileges

Privilege	Allows	In tenant roles
`Kyvernon.Firewall.Read`	Read groups, services, policies, rules, effective rules, counters and realization	Yes
`Kyvernon.Firewall.ManageGroups`	Create, change and delete groups and services	Yes
`Kyvernon.Firewall.ManagePolicies`	Policies and rules in Environment and Application, open ports, templates	Yes
`Kyvernon.Firewall.SetProfile`	Choose a selectable profile for an adapter	Yes
`Kyvernon.Firewall.ManageProvider`	Policies in Emergency and Infrastructure, shared groups, profiles, settings, the mode of an adapter	No
`Kyvernon.Firewall.ReadLogs`	Read log records and monitor reports	Yes
`Kyvernon.Firewall.Bypass`	Enable and end an emergency bypass	No

The tenant administrator role holds the privileges for reading, groups, policies, profiles and logs. The tenant user role can read. See Privileges.