# Replace firewall rules

`PUT /v1/sandboxes/{sandbox}/firewall`

**In this build:** Works on the simulator or a real VM. Rules are stored outside the guest. Enforcement needs the deployed edge for inbound and host eBPF, with root on a real host, for outbound.

**Scope:** `network.write`

**CLI:** `harebox firewall set`

## Request: `Firewall`

| Field | Type | Notes |
|---|---|---|
| `inbound` (required) | `array` |  |
| `outbound` (required) | `array` |  |
| `default_outbound` | `string` | One of: `allow`, `deny` |

## Response: 200

`Firewall`

| Field | Type | Notes |
|---|---|---|
| `inbound` (required) | `array` |  |
| `outbound` (required) | `array` |  |
| `default_outbound` | `string` | One of: `allow`, `deny` |

Errors follow [one format](../errors.html).