I don't really get what the definition of "network" is here, clearly the box has network access since it is SSH'able. Could you give an example of a situation when this is used?
e.g. you can't curl google.com
I've used this code in CTF competitions and Blue Team exercises where some machines behind a VPN don't have outgoing network access.
(Sometimes it's just simpler to organize this way, sometimes it's deliberate for security purposes.)
Suppose you configured your webserver to run with limited privileges so as if someone hacks it it has limited access. Suppose it still has access to DB and stuff. Well, filtering outgoing connections makes harder to exfiltrate the data OR hop to another hosts. And then you can monitor failed outgoing requests to be able to act/investigate when that happens.
* Incoming access is allowed to "stuff" when connected to the OpenVPN host.
* Outgoing access to services is very heavily restricted.
* Outgoing HTTP/HTTPS requires the site to be on an allow-list. By default all outgoing HTTP/HTTPS traffic is denied.
(We might add yum-repositories to the allowlist, or permit access to the various "Windows Updates" services, for example. But all other downloads from remote sites would be denied.)
Can you propose an alternative / more accurate name?
Naming things is hard. I love the project though, not because I need it, but it proves one of my point: "If you didn't want me to be able to do X, then you shouldn't have allowed SSH access".
I wish companies would hurry up and move away from "trusted" networks and move onto zero trust.
Erm ... mate....
A device is either air-gapped or it isn't. The clue is kinda in the name.
Yes, I know gov/mil networks use data-diodes, but that's a different kettle of very expensive fish which is certified to EAL6/7.
For everyone else, air-gapped means what it says on the tin.
Pseudo air-gapping via firewall rules is not air-gapping, its called writing ACLs.
This is a proxy or a bastion host, no more, no less. Calling it an airgap, even in "scare quotes", is clownishly terrible and serves no purpose beyond polluting the language.