Controlling outbound traffic
Most firewalls are built to keep bad things out. Controlling what your servers are allowed to send out is the half everyone forgets — and it is what limits the damage when something does get in.
Inbound firewalling decides who can reach your server. Egress filtering decides where your server may reach to — and it is the control that turns a break-in into a contained incident instead of a disaster. A compromised machine that cannot phone home or ship your data out is far less valuable to an attacker.
What it contains
- Malware calling back to its command server
- Data being exfiltrated to somewhere it should never go
- A compromised box being used to attack others — and the abuse notices that follow
- Spoofed-source packets leaving your machine — see anti-spoofing and BCP38
Default-deny is the strong version
The robust posture is to allow only the outbound connections a server actually needs — its updates, its database, the APIs it calls — and deny the rest. A web server rarely needs to make arbitrary outbound connections; when it suddenly tries to, that is a signal worth catching. See a firewall that does not lock you out.
Start by watching, then enforce
A default-deny egress policy applied blind will break things you forgot about — a licence check, an NTP server, a webhook. Log outbound traffic first to learn what is normal — see understanding your traffic — then tighten to allow exactly that. Enforcing before you understand is how you cause your own outage.
Mind the updates
Lock egress too hard and your server can no longer fetch its own security updates, which is its own kind of failure. Allow package mirrors and time sync explicitly — see automatic security updates.
It pairs with knowing your traffic
Egress control and traffic monitoring are two sides of one coin: you cannot filter what you have not measured, and once you filter, deviations stand out. Together they are how a quiet compromise gets noticed early rather than in an abuse report.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base