working rules
it's better with vagrant allowed in ssh