# Inbound default-accept is the other Unix inheritance

> Root Lock allowlists per-program outbound. Root Lock Firewall is the host-path stateful filter for a closed appliance.

---

LLMS index: [llms.txt](/llms.txt)

---

---

*Root Lock Firewall | Prototype*

---

**Overview**: A listening service on a Linux host accepts inbound connections unless a packet filter refuses them. Root Lock by HeartSuite does not provide that filter.

Root Lock controls outbound destinations per program, at the kernel, using literal IP addresses. Root Lock Firewall is the inbound and host-path stateful filter for a closed HeartSuite appliance: observe real traffic, approve a finite allowlist, seal it.

The two products address different layers and are designed to be used together on the appliance image.

## In this section

- [The security problem Root Lock Firewall solves](security-problem/) — Why inbound default-accept is a different OS assumption from Root Lock's outbound allowlist.
- [Root Lock Firewall overview](firewall-overview/) — Closed appliance, stateful inspection, observation through Firewall Lockdown, and what stays out of scope.
- [Walkthrough](walkthrough/) — The intended Dashboard journey from first boot to a sealed ruleset.
- [What Root Lock Firewall does and does not cover](limits/) — Where the packet boundary holds, where it does not, and what to use alongside it.

---

Section pages:

- [A listener will accept a stranger by default](/firewall/introduction/security-problem/): Inbound default-accept is a different OS assumption from Root Lock's outbound allowlist. How Root Lock Firewall addresses that hole.
- [Observe real traffic, approve a list, seal it](/firewall/introduction/firewall-overview/): Host-shaped stateful filter on a closed appliance: observe real traffic, approve a finite allowlist for this box, then seal it. Root Lock is the OS under the filter, not the filter.
- [Where the packet boundary holds — and where it does not](/firewall/introduction/limits/): Root Lock Firewall's packet boundary, what it does not see on the host, and which tool to put beside it for those gaps.
- [Walkthrough: observe, approve, seal](/firewall/introduction/walkthrough/): From first boot to Firewall Lockdown: observe, approve, seal. The intended Dashboard path on a Root Lock Firewall appliance.