Function Isolate

pkg/rules/action/isolate_windows.go:229–258

Isolate talks to the WFP (Windows Filtering Platform) engine to set up firewall rules that result in complete host isolation. The traffic is allowed for the IP addresses specified in the permitted parameter. If the firewall rules already exist and the whitelist IP addresses are given, the rules are

(whitelist []net.IP)

// are given, the rules are first removed and then recreated with the new
// allowed IP set.
func Isolate(whitelist []net.IP) error {
	if fw == nil {
		var err error
		fw, err = newFirewall()
		if err != nil {
			return err
		}
	}

	if err := fw.findAllowRules(); err != nil {
		return err
	}

	switch {
	case fw.hasAllowRules():
		// rules were added and no new permitted
		// addresses are supplied in the action
		return nil
	default:
		// rules were not added, so we set up
		// the rule to allow localhost in/out
		// traffic in addition to permitted
		// IP address.
		// Block the remaining in/out traffic
		if err := fw.allow(whitelist); err != nil {
			return err
		}
		return fw.deny()
	}
}