network

ix controls two things per machine: whether the internet can reach it, and whether it can reach the internet. per-port policy (allowlists, rate limits, a waf) belongs in the machine’s own firewall, or in a gateway machine you build. private networking between machines is group membership, declared in default.ix.

publish a port through the proxy

--l7-proxy-port publishes an application port through the HTTPS proxy. repeat it for several ports. snapshot restores do not honor it.

a public ipv4 address

--ipv4 allocates a public ipv4 address at creation. an address is allocated once, at creation: no operation adds one to a live machine, so a machine that needs one later is recreated. in config, the declaration is ix.networking.ipv4 = true, and ix apply reads it the same way it reads group membership.

turn the internet on and off

ix vm set toggles inbound (--internet-ingress) and outbound (--internet-egress) internet for an existing machine. group traffic and the control plane keep working regardless.

open the port inside the machine

publishing a port does not open the guest firewall. in config, one declaration does both jobs: it claims the port (collisions fail at build time) and opens the in-guest firewall for it.

ix.networking.expose.http = {
  port = 8080;
  description = "public HTTP API";
};