Home / Knowledge hub / Egress filtering
Knowledge hub
Egress filtering
Limiting what your servers may connect out to, which blunts data theft.
What it means
Egress means traffic leaving your network. Egress filtering is a set of rules about where your servers are allowed to connect. Instead of letting them reach anything on the internet, you allow only the destinations they need, such as a payment provider, a package mirror and your own services.
Most teams spend their effort on what comes in. Outbound rules are the other half. An intruder who gets onto a server still needs a way to send data out or to ask for further instructions, and a default of no outbound access takes that away.
Why it matters
It limits the damage after something else goes wrong. A server hit by SSRF cannot be pushed into calling an attacker's address if outbound traffic is blocked. Malware cannot phone home. Stolen records cannot be posted to a random site. The attacker gets in but finds little to do.
It also helps you spot trouble. If a web server suddenly tries to reach a new destination, the blocked attempt is a clear signal. This supports defence in depth and is listed among firewall practices by NIST. It costs little once the allowed list exists.
How it shows up
You meet it in firewall and security group rules, cloud network settings, proxies for outbound web access and DNS controls. The default in many cloud accounts is to allow all outbound traffic, so unless someone changed it, your servers can reach anywhere.
Start with the servers that hold the most sensitive data. List what each one needs to reach, allow only those destinations and block the rest. Watch for the hard parts: wildcard rules that allow everything over HTTPS, DNS used as a way out, and services that need many changing addresses. Test by trying a harmless outbound connection from a test host.
Questions people ask
Egress filtering, answered
Is egress filtering the same as a firewall?
It is one use of a firewall: rules about outbound connections. Most firewall effort goes to inbound rules, while egress rules are often left open.
Both directions matter.
Will it break our app?
It can if the list is incomplete. Your app may call payment, email, analytics and update servers. Build the list from observed traffic first, run in logging mode, and then enforce.
Expect a few rounds of fixes.
Does it stop SSRF?
It reduces the harm. If the server cannot reach arbitrary addresses, a forged request cannot be sent to an attacker or used to read data back out. Internal targets still need their own controls.
It is a second layer, not the fix.
What about DNS?
DNS is an easy path out, since many networks allow it everywhere. Use a resolver you control, log queries and block direct outbound DNS to others.
Otherwise data can leave inside lookups.
How do we test our rules?
From a test host, try to reach an outside address that is not on your allowed list, over several ports and protocols. Each success shows a gap.
Do this in your own environment only.
Sources
Where this comes from
Related
Terms that sit next to this one
SSRF
Making your server fetch a URL of the attacker's choosing.
Firewall
A control deciding which traffic is allowed to reach a system.
Data exfiltration
Quietly copying data out of your systems to somewhere the attacker controls.
Defence in depth
Assume any one control will fail, and have something else behind it.
Security group
Cloud firewall rules that decide which traffic may reach a server.
Where can your servers phone home?
We test whether your application can be made to reach places it should not, such as internal services, and show the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.