# Inbound default-accept is the other Unix inheritance

> Root Lock allowlists per-program outbound. Root Lock Firewall is the host-path stateful filter for a closed appliance.

---

LLMS index: [llms.txt](/llms.txt)

---

---

*Root Lock Firewall | Prototype*

---

**Overview**: A listening service on a Linux host accepts inbound connections unless a packet filter refuses them. Root Lock Firewall is that filter on a closed HeartSuite appliance: observe real traffic, approve a finite allowlist, seal it.

Root Lock controls outbound destinations per program, at the kernel, using literal IP addresses. The two products address different layers and are designed to be used together on the appliance image.

## In this section

- [The security problem Root Lock Firewall solves](security-problem/) — Why inbound default-accept is a different OS assumption from Root Lock's outbound allowlist.
- [Root Lock Firewall overview](firewall-overview/) — Closed appliance, stateful inspection, observation through Firewall Lockdown, and what stays with Root Lock.
- [Walkthrough](walkthrough/) — The intended Dashboard journey from first boot to a sealed ruleset.
- [Protection limits](limits/) — Where the packet boundary holds, and what to use alongside it.

---

Section pages:

- [A listener will accept a stranger by default](/firewall/introduction/security-problem/): Inbound default-accept is a different OS assumption from Root Lock's outbound allowlist. How Root Lock Firewall addresses that hole.
- [Observe real traffic, approve a list, seal it](/firewall/introduction/firewall-overview/): Host-shaped stateful filter on a closed appliance: observe real traffic, approve a finite allowlist for this box, then seal it. Root Lock is the OS under the filter.
- [Where the packet boundary holds](/firewall/introduction/limits/): Root Lock Firewall's packet boundary, residuals, and which tool to put beside it for those gaps.
- [Walkthrough: observe, approve, seal](/firewall/introduction/walkthrough/): From first boot to Firewall Lockdown: observe, approve, seal. The intended Dashboard path on a Root Lock Firewall appliance.