Struct Rule 

pub struct Rule {
    pub direction: Direction,
    pub destination: Destination,
    pub protocols: Vec<Protocol>,
    pub ports: Vec<PortRange>,
    pub action: Action,
}

A single network rule.

The destination field is direction-dependent: in an egress-direction rule, destination is what the guest is reaching; in an ingress- direction rule, destination is the source (peer) of the incoming connection. Both-direction rules apply in either path with the destination interpreted appropriately for each.

Fields

direction: Direction

Direction this rule applies to: outbound, inbound, or either.

destination: Destination

Destination filter. Direction-dependent interpretation.

protocols: Vec<Protocol>

Protocol set (empty = any protocol). The rule matches if the packet’s protocol is in this set.

ports: Vec<PortRange>

Port-range set (empty = any port). Always the guest-side port: destination port for egress, listening port for ingress.

action: Action

Action to take.

Implementations

impl Rule

pub fn allow_egress(destination: Destination) -> Self

Convenience: allow rule for egress, any protocol, any port.

pub fn deny_egress(destination: Destination) -> Self

Convenience: deny rule for egress, any protocol, any port.

pub fn allow_ingress(destination: Destination) -> Self

Convenience: allow rule for ingress, any protocol, any port.

pub fn deny_ingress(destination: Destination) -> Self

Convenience: deny rule for ingress, any protocol, any port.

pub fn allow_any(destination: Destination) -> Self

Convenience: allow rule for either direction, any protocol, any port.

pub fn deny_any(destination: Destination) -> Self

Convenience: deny rule for either direction, any protocol, any port.

pub fn allow_dns() -> Self

Allow plain DNS (UDP/53 and TCP/53) to the sandbox gateway, i.e. the in-process DNS forwarder.

Building block for deny-by-default policies: under the DNS-as-egress evaluation rules, generic IP-based destinations (Cidr / non-Host Group) cannot match a query because the name has no resolved IP yet, so a policy of default_egress = Deny with only those rules refuses every DNS query. Group::Host is the one IP-based destination that is honored at DNS-decision time, since it names the gateway forwarder the query is delivered to.

At connection-time this rule stays narrow: it only matches the gateway IPs, not arbitrary private resolvers a guest might aim at directly.

DoT (TCP/853) is not included; if you need it, add an explicit Group::Host tcp/853 allow rule (and pair it with TLS interception).

Trait Implementations

impl Clone for Rule

fn clone(&self) -> Rule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Rule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Rule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Rule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.