---
title: "Limit where servers can send traffic · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control
updated: 2026-10-20
licence: "All rights reserved"
---

# Limit where servers can send traffic

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Let servers send traffic only to the hosts they need. Databases send none to the internet at all.
- How: An attacker inside a server sends stolen data out, or downloads tools. Route outbound traffic through a firewall or proxy with an allow list of host names. A cloud network firewall or a proxy such as Squid will do. Reach cloud services through private endpoints, so that traffic never leaves the network. Turn on network flow logs, such as VPC flow logs, and alert on spikes of refused attempts.
- Check: From an app server, a request to a host on the list succeeds and a request to `https://example.org` fails. A database server cannot reach any outside address.

Example:

```sh
curl -sS -m 5 -o /dev/null -w '%{http_code}\n' https://api.payments.example.com/health   # 200
curl -sS -m 5 https://example.org && echo "FAIL: egress open"                            # times out
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control`.

- Previous: [Close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports)
- Next: [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)