delonix net egress

Firewall de SAÍDA (regras L4 + política de egress→Internet por-rede).

OUTBOUND firewall (L4 rules + per-network egress→Internet policy).

A outra metade do firewall. Governa a SAÍDA de um container (regras allow/deny + política por omissão) e, ao nível da REDE, a política de egress para a Internet: allow/deny, ou allowlist (nega tudo excepto DNS e os CIDRs dados). Tudo sobre o mesmo ContainerFw /nft do ingress.

The other half of the firewall. Governs a container's OUTBOUND traffic (allow/deny rules + default policy) and, at the NETWORK level, egress policy to the Internet: allow/deny, or allowlist (denies everything except DNS and the given CIDRs). All on the same ContainerFw/nft as ingress.

📄 Implementação real em Rust: cmd/firewall.rs

Usage: dlx net egress [OPTIONS] <COMMAND>

Commands:
  allow   Allow outbound traffic from a container: `[proto/]port` to an optional CIDR
  deny    Deny outbound traffic from a container (same shape as `allow`)
  policy  Set the default outbound policy when no rule matches
  net     Govern a whole network's egress to the Internet
  host    Allow a network's egress to a HOSTNAME (and `*.hostname`), learnt live from DNS answers — the FQDN allowlist nft/CIDR can't express. Repeatable
  ls      Show the outbound firewall (policy + rules)
  rm      Remove outbound rule(s) matching `[proto/]port` (all protos if none given)
  show    Show a NETWORK's egress policy: CIDR allowlist, FQDN hosts, and the IPs currently learnt from DNS for those hosts
  clear   Remove all outbound rules
  help    Print this message or the help of the given subcommand(s)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

`egress clear`

Remove all outbound rules

Usage: dlx net egress clear [OPTIONS] <CONTAINER>

Arguments:
  <CONTAINER>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Limpar as regras de saída desse container

delonix net egress clear web

`egress rm`

Remove outbound rule(s) matching [proto/]port (all protos if none given)

Usage: dlx net egress rm [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       `tcp/5432`, `5432` (any proto), or `*` (all ports)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --to <TO>       Only rules to this destination CIDR (default: any recorded destination)
  -h, --help          Print help

Exemplos

Tirar UMA regra de saída

delonix net egress rm web tcp/443

`egress deny`

Deny outbound traffic from a container (same shape as allow)

Usage: dlx net egress deny [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --to <TO>       
      --note <NOTE>   
  -h, --help          Print help

Exemplos

Bloquear a saída para uma rede

delonix net egress deny web --to 10.0.0.0/8

`egress allow`

Allow outbound traffic from a container: [proto/]port to an optional CIDR

Usage: dlx net egress allow [OPTIONS] <CONTAINER> <PORT>

Arguments:
  <CONTAINER>  
  <PORT>       

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --to <TO>       Only to this destination CIDR (default: anywhere)
      --note <NOTE>   
  -h, --help          Print help

Exemplos

Só deixar sair HTTPS

delonix net egress allow app tcp/443 --to 0.0.0.0/0

`egress policy`

Set the default outbound policy when no rule matches

Usage: dlx net egress policy [OPTIONS] <CONTAINER> <POLICY>

Arguments:
  <CONTAINER>  
  <POLICY>     [possible values: allow, deny]

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Default-deny de saída

delonix net egress policy app deny

`egress net`

Govern a whole network's egress to the Internet

Usage: dlx net egress net [OPTIONS] <NETWORK> <MODE>

Arguments:
  <NETWORK>
          

  <MODE>
          Possible values:
          - allow:     Allow all egress (the default)
          - deny:      Block all egress to the Internet
          - allowlist: Deny all egress EXCEPT DNS and the CIDRs given in `--to` (allowlist)

Options:
      --l18n <en|pt>
          Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand

      --to <TO>
          CIDRs for `allowlist` mode (comma-separated), e.g. `10.0.0.0/8,1.1.1.1/32`

  -h, --help
          Print help (see a summary with '-h')

Exemplos

Egress de uma rede em allowlist (só DNS + estes CIDRs)

delonix net egress net backend allowlist --to 10.0.0.0/8,1.1.1.1/32

`egress host`

Allow a network's egress to a HOSTNAME (and *.hostname), learnt live from DNS answers — the FQDN allowlist nft/CIDR can't express. Repeatable

Usage: dlx net egress host [OPTIONS] <NETWORK> <HOSTNAME>

Arguments:
  <NETWORK>   
  <HOSTNAME>  e.g. `github.com` (matches `github.com` and `*.github.com`)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

O que o nft/CIDR não faz: allowlist por hostname. O resolver DNS interno do ingress passa a snoopar os A-records das respostas e injecta-os num set nft por-rede (com timeout = expira com o TTL); o egress aceita esse set + DNS e dropa o resto. 100% rootless (sem eBPF) — a FQDN-policy do Cilium, via nftables. Repetível para vários hostnames.

Exemplos

Só deixar sair para o GitHub (e *.github.com), aprendido do DNS

delonix net egress host backend github.com

`egress show`

Show a NETWORK's egress policy: CIDR allowlist, FQDN hosts, and the IPs currently learnt from DNS for those hosts

Usage: dlx net egress show [OPTIONS] <NETWORK>

Arguments:
  <NETWORK>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Ver a política de egress de uma rede + os IPs FQDN aprendidos ao vivo

delonix net egress show backend

`egress ls`

Show the outbound firewall (policy + rules)

Usage: dlx net egress ls [OPTIONS] [CONTAINER]

Arguments:
  [CONTAINER]  Container to inspect (omit to list every container's outbound state)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

delonix net egress ls app

LaboratórioLab

Nega tudo excepto DNS e um destino específico — a política allowlist por rede.

delonix net egress policy minha-rede allowlist --allow 1.1.1.1/32
delonix container run --rm --net minha-rede alpine wget -qO- https://1.1.1.1
delonix container run --rm --net minha-rede alpine wget -qO- https://example.com

Deny everything except DNS and one specific destination — the per-network allowlist policy.

delonix net egress policy my-net allowlist --allow 1.1.1.1/32
delonix container run --rm --net my-net alpine wget -qO- https://1.1.1.1
delonix container run --rm --net my-net alpine wget -qO- https://example.com

DesafioChallenge

Abre uma ligação de saída de longa duração e só DEPOIS aplica egress policy deny. Confirma que a ligação já estabelecida continua viva — só ligações NOVAS são bloqueadas.

Open a long-lived outbound connection and only THEN apply egress policy deny. Confirm the already-established connection keeps working — only NEW connections get blocked.