Firewalls

Loopback firewalls are policy objects separate from WireGuard (which provides encryption and transport). A firewall groups an ordered set of rules evaluated against traffic direction, protocol, source, and destination. They are designed so platform teams can express default deny with narrow allows, and so auditors can see intent distinct from mesh membership.

Scopes

Organization scope
Baseline policy meant to apply across all hosts in the organization unless refined further.

Workspace scope
Narrows policy to hosts in one workspace.

Host attachment
Firewalls can be assigned directly to hosts; hosts expose attach/detach flows. A host’s effective ruleset is layered: organization + workspace + host-attached firewalls combine.

Rule model

Each firewall rule belongs to a parent firewall and carries:

Priority - lower numbers evaluate earlier (higher precedence).
Action - allow or deny.
Direction - inbound or outbound.
Protocol - tcp, udp, icmp, or any.
Source / destination selectors (any, IP, CIDR, range) and optional port or port range constraints.
Enabled flag and optional logging.

The parent firewall defines a default action (allow or deny) for traffic that matches no rule.

Application status

Firewalls track apply status (pending, applied, failed) and last applied time so operators know whether agents have converged on the latest host-level enforcement (exact backend is agent-specific).

Permissions

Gated separately for organization firewalls vs workspace firewalls (and rule edits). Map capabilities in Access control & permissions to your role templates before granting least privilege.

Relationship to load balancer ACLs