firewall rules

allowlist per box: scored, extras and trusted ranges stay open, everything else inbound gets dropped