What terminals reach

A terminal on your node reaches the internet and nothing private: not your LAN, not your data center, not the server it runs on. Your admin opens internal networks on the server itself, one at a time.

Always closed

Whatever networks you open, a terminal never reaches:

• the node itself: every address of the server, both of its bridges and its Incus API;
• link-local addresses, the cloud metadata address among them, and multicast;
• outbound mail on TCP port 25;
• other terminals: the network port of each one is isolated from the rest.

Closed until you open them

10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 100.64.0.0/10. Only networks inside these four ranges open; the public internet is open already.

Open a private network

On the server, as root:

sudo detachbox-node-host private-networks                          # what is open now
sudo detachbox-node-host private-networks --add 10.20.0.0/16       # open a network (repeat --add for more)
sudo detachbox-node-host private-networks --remove 10.20.0.0/16    # close it
sudo detachbox-node-host private-networks --clear                  # close them all

• Each change writes private_networks in /etc/detachbox-node/node-host.json and restarts node-host, which applies it to the terminals' firewall within seconds. Open terminals stay connected.
• A network that is nothing but the node, such as one of its bridges or its own address, is refused. Your LAN opens, and the command tells you that the node's own address in it stays closed.
• While an install or an uninstall runs, a change does nothing and names the run that holds the server.
• At install time, --private-network does the same, as Install the node shows.
• sudo detachbox-node-host doctor checks the firewall against the list.

The list lives on the node. The detachbox server can read it to show it, never change it: nothing opens or closes a network from afar.

The node's addresses

At enrollment the node gets a domain of its own: <id>.detachbox.dev, where <id> is 8 random lowercase letters and digits. Its names go into public certificate logs, so the id never carries your company's name.

All of them reach your server through its Cloudflare Tunnel. Your engineers' browsers need my.detachbox.com, api.detachbox.com and *.detachbox.dev.