# Firewall

Firewall rules are API objects kept outside the VM. A tenant with root inside the sandbox can't change them, and they survive every lifecycle step.

```sh
harebox new --name fw
harebox firewall set current --body '{"default_outbound":"deny","inbound":[],"outbound":[{"action":"allow","hosts":["registry.npmjs.org"]}]}'
harebox firewall current
```

**In this build,** inbound rules are enforced at the HareBox edge. Enforcing on each host with eBPF needs root on a real host, and isn't built yet. Outbound rules are stored, and aren't enforced yet.