Struct NetworkPolicy 

pub struct NetworkPolicy {
    pub default_action: Action,
    pub rules: Vec<Rule>,
}

Network policy with ordered rules.

Rules are evaluated in first-match-wins order. If no rule matches, the default action is applied.

Fields

default_action: Action

Default action for traffic not matching any rule.

rules: Vec<Rule>

Ordered list of rules (first match wins).

Implementations

impl NetworkPolicy

pub fn none() -> Self

No network access — deny everything.

pub fn allow_all() -> Self

Unrestricted network access — allow everything.

pub fn public_only() -> Self

Public internet only — deny loopback, private, link-local, and cloud metadata addresses.

pub fn evaluate_egress(&self, dst: SocketAddr, protocol: Protocol) -> Action

Evaluate an outbound connection against the policy.

Returns the action from the first matching rule, or the default action if no rule matches.

pub fn evaluate_egress_ip(&self, dst: IpAddr, protocol: Protocol) -> Action

Evaluate an outbound ICMP packet against the policy.

Same first-match-wins logic as Self::evaluate_egress but without port matching — ICMP has no ports. Rules with a ports filter are skipped since applying a port range to a portless protocol would be semantically incorrect.

Trait Implementations

impl Clone for NetworkPolicy

fn clone(&self) -> NetworkPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetworkPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NetworkPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.