Limit where servers can send traffic

Let servers send traffic only to the hosts they need. Databases send none to the internet at all.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

An attacker inside a server sends stolen data out, or downloads tools. Route outbound traffic through a firewall or proxy with an allow list of host names. A cloud network firewall or a proxy such as Squid will do. Reach cloud services through private endpoints, so that traffic never leaves the network. Turn on network flow logs, such as VPC flow logs, and alert on spikes of refused attempts.

Example

curl -sS -m 5 -o /dev/null -w '%{http_code}\n' https://api.payments.example.com/health   # 200
curl -sS -m 5 https://example.org && echo "FAIL: egress open"                            # times out

How to check

From an app server, a request to a host on the list succeeds and a request to https://example.org fails. A database server cannot reach any outside address.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control.