delonix net ingress

Firewall de ENTRADA (regras L4 + publishes DNAT) de um container na SDN.

INBOUND firewall (L4 rules + DNAT publishes) for a container on the SDN.

Metade da superfície unificada de firewall (a outra é egress). Edita a única fonte de verdade — o ContainerFw por container, aplicado como regras nft na chain de ingress. ingress governa a ENTRADA: regras allow/deny por [proto/]porta e CIDR, a política por omissão, e os publishes DNAT. Só actua em containers numa rede custom (têm IP na delonix0); --net host é recusado.

Half of the unified firewall surface (the other is egress). Edits the single source of truth — the per-container ContainerFw, applied as nft rules in the ingress chain. ingress governs INBOUND traffic: allow/deny rules by [proto/]port and CIDR, the default policy, and DNAT publishes. Only acts on containers on a custom network (they have an IP on delonix0); --net host is refused.

📄 Implementação real em Rust: cmd/firewall.rs

Usage: dlx net ingress [OPTIONS] <COMMAND>

Commands:
  allow      Allow inbound traffic to a container: `[proto/]port` from an optional CIDR
  deny       Deny inbound traffic to a container (same shape as `allow`)
  policy     Set the default inbound policy when no rule matches
  publish    Publish a host port to the container (DNAT through the ingress)
  unpublish  Remove a published host port
  ls         Show the inbound firewall (policy + rules) and published ports
  rm         Remove inbound rule(s) matching `[proto/]port` (all protos if none given)
  clear      Remove all inbound rules (keeps published ports)
  help       Print this message or the help of the given subcommand(s)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

`ingress clear`

Remove all inbound rules (keeps published ports)

Usage: dlx net ingress clear [OPTIONS] <CONTAINER>

Arguments:
  <CONTAINER>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Limpar a firewall inteira desse container

delonix net ingress clear web

`ingress rm`

Remove inbound rule(s) matching [proto/]port (all protos if none given)

Usage: dlx net ingress rm [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       `tcp/5432`, `5432` (any proto), or `*` (all ports)

Options:
      --from <FROM>   Only rules from this source CIDR (default: any recorded source)
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Tirar UMA regra, sem limpar as outras

delonix net ingress rm web tcp/80

`ingress unpublish`

Remove a published host port

Usage: dlx net ingress unpublish [OPTIONS] <CONTAINER> <HOST_PORT>

Arguments:
  <CONTAINER>  
  <HOST_PORT>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Deixar de publicar uma porta

delonix net ingress unpublish 8080

`ingress allow`

Allow inbound traffic to a container: [proto/]port from an optional CIDR

Usage: dlx net ingress allow [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       `tcp/5432`, `udp/53`, `5432` (any proto), or `tcp/*` (all ports)

Options:
      --from <FROM>   Only from this source CIDR (default: anywhere)
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --note <NOTE>   Free-form note kept with the rule
  -h, --help          Print help

Exemplos

Deixar entrar Postgres só da própria SDN

delonix net ingress allow db tcp/5432 --from 10.219.0.0/16

`ingress deny`

Deny inbound traffic to a container (same shape as allow)

Usage: dlx net ingress deny [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       

Options:
      --from <FROM>   
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --note <NOTE>   
  -h, --help          Print help

Exemplos

Bloquear uma porta específica

delonix net ingress deny web tcp/22

`ingress policy`

Set the default inbound policy when no rule matches

Usage: dlx net ingress policy [OPTIONS] <CONTAINER> <POLICY>

Arguments:
  <CONTAINER>  
  <POLICY>     [possible values: allow, deny]

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Default-deny (allowlist)

delonix net ingress policy db deny

`ingress publish`

Publish a host port to the container (DNAT through the ingress)

Usage: dlx net ingress publish [OPTIONS] <CONTAINER> <SPEC>

Arguments:
  <CONTAINER>  
  <SPEC>       `hostPort:containerPort[/tcp|udp]` or just `port`

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Publicar uma porta pelo ingress (DNAT)

delonix net ingress publish web 8080:80

`ingress ls`

Show the inbound firewall (policy + rules) and published ports

Usage: dlx net ingress ls [OPTIONS] [CONTAINER]

Arguments:
  [CONTAINER]  Container to inspect (omit to list every container's inbound state)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Ver regras + publishes

delonix net ingress ls db

LaboratórioLab

Fecha tudo por omissão e abre só uma porta — o modelo default-deny.

delonix net ingress policy web deny
delonix net ingress allow web 80
curl web-host:80

Close everything by default and open just one port — the default-deny model.

delonix net ingress policy web deny
delonix net ingress allow web 80
curl web-host:80

DesafioChallenge

Reproduz o bug histórico já corrigido: ingress allow web 9999 (SEM indicar proto) só deveria abrir a porta 9999. Confirma com ingress ls que as outras portas continuam fechadas — o veredicto da coluna tem de bater com o que o curl mostra.

Reproduce the historical bug that's already fixed: ingress allow web 9999 (with NO proto given) should only open port 9999. Confirm with ingress ls that the other ports stay closed — the column's verdict has to match what curl actually shows.