Set-FactoryEgress.ps1

Source file scripts/factory/Set-FactoryEgress.ps1. This page is generated from the file’s own help comment when the site is built.

Help text

.SYNOPSIS Limits where the factory VM can connect: the Anthropic API, GitHub, NuGet and the Bifrost gateway, and nothing else.
.DESCRIPTION An owner step, run elevated inside the factory VM (for example over PowerShell Direct), never by the
factory. It sets Windows Firewall's default outbound action to Block on every profile and adds allow rules, each
named "House Style egress ...":
- DNS (port 53) for every account, only to the DNS servers the VM is configured with, so names still resolve.
- For the factory account only (-User): TCP 443 to the Anthropic API's published range, GitHub's published ranges
  (api.github.com/meta: web, api, git, actions), and the current addresses of NuGet and the other hosts in -Hosts.
Windows Firewall matches addresses, not names, and CDN addresses change, so run it again after a NuGet or GitHub
outage that looks like a block, and monthly with Reset-FactoryVM.ps1 -Refresh. Anything else the VM needs (Windows
Update, time sync) stays blocked; the nightly reset puts the VM back on its base anyway.
-DryRun lists the rules without changing anything. -Remove deletes the rules and sets outbound back to Allow.
.EXAMPLE scripts\factory\Set-FactoryEgress.ps1 -DryRun
.EXAMPLE scripts\factory\Set-FactoryEgress.ps1

Parameters

• -User
• -Hosts
• -DryRun
• -Remove