Skip to main content
Network restriction blocks a service’s connections to private resources, except the ones you allow and a few defaults listed below. Use it to limit what a compromised service could access, especially for services that accept public traffic or run user-submitted code.
Available on Porter apps deployed to AWS. Public internet access remains allowed.

​
How it works

A restricted service can always connect to:
  • Other services in the same application.
  • The public internet.
  • DNS resolvers.
  • Credentials service for its AWS role connection, if configured.
Add any other private resources the service needs under Allowed destinations. Incoming connections are allowed from Porter applications on the same cluster, across all environments, and from the service’s load balancers. Metrics collection is allowed when metrics scraping is enabled.
Add-ons and workloads deployed outside Porter applications cannot initiate connections to a restricted service, even if they’re listed as allowed destinations.

​
Configure in the dashboard

  1. Open your application and select the service.
  2. In the Advanced tab, turn on Network restriction.
  3. Under Allowed destinations, select the resources the service needs and deselect any others.
  4. Save and deploy.

​
Allowed destinations

​
VPC endpoints

Allow any VPC endpoints your service uses to reach cloud services privately. Select them in the dashboard or specify their IDs in porter.yaml. Porter allows their private addresses on the TCP ports they accept and keeps these rules up to date.

​
Address ranges

Enter a private IPv4 CIDR, such as 10.50.0.10/32 for one address or 10.50.0.0/16 for a range. Use the range’s starting address. Optionally specify TCP or UDP ports, such as TCP 5432 for PostgreSQL. You can allow individual ports or port ranges. Without ports, all ports and protocols are allowed.
CIDRs must fall within 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, or 169.254.0.0/16. These ranges are blocked by default, apart from the connections listed under How it works. Addresses outside them are treated as public internet destinations and remain allowed.

​
Configure in porter.yaml

Add networkRestriction to a web, worker, or job service in porter.yaml. Under egress, list the destinations it needs:
Deploy to apply your changes. To disable network restriction, set enabled: false and redeploy.

​
Verify access

After deploying, test connections to your service’s dependencies and check its logs. If new connection timeouts appear, check the allowed destinations and ports. Also check incoming connections from add-ons or workloads outside Porter applications, which are blocked.