Traffic rules
Limit what your services can reach on the internet, and which of your services can reach each database, key value store and web service.
By default, your services can reach anything on the internet, and everything in a project can reach everything else in it. Traffic rules narrow both. Open the project's Networking page and select the Traffic rules tab.
Outbound traffic
Turn on Limit outbound traffic to let your web services, workers and cron jobs reach only:
- the addresses you list
- the domains you list
- the project's own services, databases and key value stores
- Appentic itself, for sign-in emails and storage
Everything else is refused. Click Save after any change. Outbound traffic follows the new rules within a minute.
The limit doesn't apply to databases and key value stores, so their backups keep working.
Addresses
Click Add address and enter a label, an address or range (such as 203.0.113.7 or 203.0.113.0/24), and the ports (such as 443, 5432). Leave the ports empty to allow every port.
Use addresses for anything that isn't a web request, such as a database at another company. Addresses must be public IPv4 addresses. Private ranges aren't needed, because the project already reaches its own network.
Domains
List one domain per line, such as api.stripe.com. A domain includes its subdomains.
Domains need a fixed outbound address, which has its own monthly fee. Turn it on first; until you do, the Domains box is disabled. Requests to a listed domain go through the outbound address, so they work from HTTP clients that use HTTPS_PROXY (most do). A client that doesn't use it can reach only the addresses you list.
Limits
| Limit | Value |
|---|---|
| Addresses | 50 |
| Domains | 100 |
Inside the project
Under Inside the project, each database, key value store and web service has its own switch. A switch saves as soon as you change it, and the rule applies within a minute.
- A database or key value store. Turn on Only the services connected to it may reach it. Services you haven't connected to it can't open a connection, even if they know its address.
- A web service. Turn on Only the services you choose may reach it, then turn off each service that shouldn't reach it. When you first turn it on, every service is still allowed, so nothing is cut off before you choose.
A rule applies in every zone, and through the fixed outbound address too: going through it doesn't get a service past a rule.
Some connections always get through, whatever you choose:
- your devices over private access, and connected networks
- for a database or key value store, its own standby
- for a web service, its load balancer and the firewall
Until the project has a database, key value store or web service, this section shows Nothing to set rules for yet.