Network and firewall

NULLos speaks IPv4 and IPv6. The firewall is on out of the box: nothing comes in from outside, everything is allowed out.

All examples were typed on 29 Oct 2026 in NULLos 0.2 in QEMU (QEMU user network, network card virtio-net).

Looking at the network

ip

lo         an    65536  -                  127.0.0.1/8 ::1/128
eth0       an     1500  52:54:00:12:34:56  10.0.2.15/24 fe80::5054:ff:fe12:3456/64 fec0::5054:ff:fe12:3456/64

ip shows the network interfaces with their addresses. net also shows the way out (gateway) and the name servers (DNS):

net

eth0     oben  52:54:00:12:34:56 10.0.2.15/24 fe80::5054:ff:fe12:3456/64 fec0::5054:ff:fe12:3456/64
gateway  10.0.2.2 über eth0
gateway  fe80::2 über eth0
dns      fec0::3 10.0.2.3

To check whether another computer answers, use pi (like ping):

pi -c 2 10.0.2.2

64 Bytes von 10.0.2.2: seq=1 ttl=255 Zeit=1.702 ms
64 Bytes von 10.0.2.2: seq=2 ttl=255 Zeit=0.256 ms
2 gesendet, 2 empfangen, 0 % Verlust, Zeit 1009 ms

You can find more network commands with h -s netz or h -s dns.

The firewall

Out of the box:

incoming: blocked
outgoing: allowed
replies to your own connections: allowed

This is what it looks like:

fw zeigen

standard ein sperre
standard aus erlaube
zustand an

Opening up a service

When you start a service, for example the SSH server ssd, it cannot be reached from outside at first. The firewall tells you so and asks:

fw dienste frage

Port 2222 (tcp, Prozess 5): lauscht, aber die Firewall lässt von außen nichts durch
  Von außen freigeben (erlaube ein tcp port 2222)? [j/N]

With j the rule is added at the top and loaded right away. Without frage, fw dienste only shows the current state:

Port 2222 (tcp, Prozess 4): von außen erreichbar

Why does something get through, or not?

fw warum tells you, quoting the rule word for word. The @ stands for the rules that are currently loaded:

fw warum @ ein tcp 10.0.2.2 10.0.2.15 2222
fw warum @ ein tcp 10.0.2.2 10.0.2.15 80

erlaube (Regel 1: erlaube ein tcp port 2222)
sperre (Standard: standard ein sperre)

The order is: direction, protocol, from which address, to which address, port.

Your own rules

Rules are short sentences, one rule per line. The first matching rule applies.

erlaube ein tcp port 2222
erlaube ein tcp von 192.168.0.0/16 port 22
sperre aus an 203.0.113.0/24

There is also a short form. fw rule shows you what a sentence means:

fw rule erlaube ssh

erlaube ein tcp port 22

You load rules from a file or straight from input:

fw laden meine-regeln.txt
pr 'auf rein ssh von heimnetz' | fw laden -

Careful: fw laden replaces all previous rules. If you want several rules, write them all into one file. You can check it first with fw check DATEI.

heimnetz stands for the addresses of a home network, for example 192.168.0.0/16 and fe80::/10. From the sentence above, fw makes six rules, for IPv4 and IPv6.

Ready-made profiles

fw profil zuhause

Profil zuhause geladen: 8 Regeln

There are unterwegs, zuhause and server. zuhause allows everything incoming from the home network, and ping. What a profile does exactly is shown afterwards by fw zeigen.

State and counters

fw status

Firewall: an, 1 Regeln, 0 Verbindungen im Zustandsspeicher
ein: geprüft 40, erlaubt 38, verworfen 2, abgewiesen 0
aus: geprüft 40, erlaubt 40, verworfen 0, abgewiesen 0

fw aus turns the firewall off completely. This is only meant for testing.

After a restart

The rules live only in memory. After a restart the factory state applies again (incoming closed). A rule file that should stay goes into /boot, and you load it after starting, as described in QEMU and SSH.

All rules and options: h fw.

Sharing the screen with `rdp`

rdp is a server and client for remote control: VNC and RDP, the Windows protocol. As an RDP server it can check the login in advance (NLA), before any picture is sent at all.

The server does not run on NULLos yet coming soon. In QEMU it reports on 30 Oct 2026:

rdp serve -P rdp -b ::

rdp: kann auf [::]:3389 nicht lauschen

On the Mac it already works. There, FreeRDP 3.32.2 logs in with NLA, and a wrong password is rejected (checked with the rdp test on 30 Oct 2026). The call with login:

rdp serve -P rdp -a zugang.txt

zugang.txt contains lines benutzer:passwort. The file must be readable only by you (chmod 600), otherwise rdp stops. What gets shared is a test picture or a picture from a file (-f BILD.ppm), not yet the NULLos screen. h rdp shows more.