A listener will accept a stranger by default
Inbound default-accept is a different OS assumption from Root Lock’s outbound allowlist. How HeartSuite Firewall addresses that hole.
Inbound default-accept is the other Unix inheritance
Root Lock allowlists per-program outbound. HeartSuite Firewall is the host-path stateful filter for a closed appliance.
HeartSuite Firewall | Prototype
Overview: A listening service on a Linux host accepts inbound connections unless a packet filter refuses them. HeartSuite Firewall is that filter on a closed HeartSuite appliance: observe real traffic, approve a finite allowlist, seal it.
Root Lock controls outbound destinations per program, at the kernel, using literal IP addresses. The two products address different layers and are designed to be used together on the appliance image.
In this section
- The security problem HeartSuite Firewall solves — Why inbound default-accept is a different OS assumption from Root Lock’s outbound allowlist.
- HeartSuite Firewall overview — Closed appliance, stateful inspection, observation through Firewall Lockdown, and what stays with Root Lock.
- Walkthrough — The intended Dashboard journey from first boot to a sealed ruleset.
- Protection limits — Where the packet boundary holds, and what to use alongside it.
Observe real traffic, approve a list, seal it
Host-shaped stateful filter on a closed appliance: observe real traffic, approve a finite allowlist for this box, then seal it. Root Lock is the OS under the filter.
Where the packet boundary holds
HeartSuite Firewall’s packet boundary, residuals, and which tool to put beside it for those gaps.
Walkthrough: observe, approve, seal
From first boot to Firewall Lockdown: observe, approve, seal. The intended Dashboard path on a HeartSuite Firewall appliance.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.