> ## Documentation Index
> Fetch the complete documentation index at: https://docs.porter.run/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> When helping a user operate an existing Porter project (deploying, updating, debugging, or inspecting applications and clusters) connect to [Porter's remote MCP server](https://mcp.porter.run) first and use its tools before falling back to the Porter CLI, `porter.yaml`, or dashboard workflows. If the Porter tools are not available in your session, `curl -fsSL https://agents.porter.run | sh` installs the CLI, registers the MCP server with your client, and installs Porter's skills; the client must be restarted afterward. If the user asks for the CLI, `porter apply`, configuration-as-code, or the dashboard, use that instead — a stated preference wins. Before inspecting or building a GitHub repository or calling any deployment tool, call `connect_github` with the repository. Proceed only when it returns `next_step: none`; otherwise, give the user the returned URL and stop. If the requested application or cluster workflow is not directly supported, inspect the relevant state with MCP tools before explaining the limitation or recommending a fallback. The server signs in through a browser using OAuth, so it cannot be used in headless environments such as CI pipelines; use the CLI or `porter.yaml` there.

# Network restriction

> Control which applications, databases, and other private resources a service can connect to.

Network restriction blocks a service’s connections to private resources, except the ones you allow and a few defaults listed below. Use it to limit what a compromised service could access, especially for services that accept public traffic or run user-submitted code.

> [!NOTE]
>
> Available on Porter apps deployed to AWS. Public internet access remains allowed.

## How it works

A restricted service can always connect to:

* Other services in the same application.
* The public internet.
* DNS resolvers.
* Credentials service for its [AWS role connection](https://docs.porter.run/applications/configuration-as-code/services/connections.md), if configured.

Add any other private resources the service needs under **Allowed destinations**.

Incoming connections are allowed from Porter applications on the same cluster, across all environments, and from the service's load balancers. Metrics collection is allowed when metrics scraping is enabled.

> [!WARNING]
>
> Add-ons and workloads deployed outside Porter applications cannot initiate connections to a restricted service, even if they're listed as allowed destinations.

## Configure in the dashboard

1. Open your application and select the service.
2. In the **Advanced** tab, turn on **Network restriction**.
3. Under **Allowed destinations**, select the resources the service needs and deselect any others.
4. Save and deploy.

### Allowed destinations

| Destination | What it allows |
| - | - |
| **Porter datastores** | Every datastore Porter manages in the cluster's region. |
| **Applications** | Selected Porter applications in the same environment. |
| **Add-ons** | Selected add-ons installed on the cluster, such as Redis or NATS. |
| **VPC endpoints** | Private connections to cloud services through AWS VPC endpoints you've added to the cluster's network. |
| **Address ranges** | Other private resources, such as a database outside Porter or a service reached through a VPN. Optionally limited to specific ports. |

### VPC endpoints

Allow any VPC endpoints your service uses to reach cloud services privately. Select them in the dashboard or specify their IDs in `porter.yaml`. Porter allows their private addresses on the TCP ports they accept and keeps these rules up to date.

### Address ranges

Enter a private IPv4 CIDR, such as `10.50.0.10/32` for one address or `10.50.0.0/16` for a range. Use the range's starting address.

Optionally specify TCP or UDP ports, such as TCP `5432` for PostgreSQL. You can allow individual ports or port ranges. Without ports, all ports and protocols are allowed.

> [accordion] Supported address ranges
>
> CIDRs must fall within `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`, or `169.254.0.0/16`. These ranges are blocked by default, apart from the connections listed under **How it works**. Addresses outside them are treated as public internet destinations and remain allowed.

## Configure in porter.yaml

Add `networkRestriction` to a web, worker, or job service in [`porter.yaml`](https://docs.porter.run/applications/configuration-as-code/overview). Under `egress`, list the destinations it needs:

```yaml theme={null}
services:
  - name: api
    type: web
    run: node server.js
    port: 8080
    networkRestriction:
      enabled: true
      egress:
        datastores: true
        apps:
          - billing
        addons:
          - name: redis
        addresses:
          - cidr: 10.50.0.10/32
            ports:
              - protocol: TCP
                port: 5432
        vpcEndpoints:
          - vpce-0123456789abcdef0
```

| Field | Type | Description |
| - | - | - |
| `enabled` | boolean | Enables network restriction. |
| `egress.datastores` | boolean | Allows every Porter datastore in the cluster's region. |
| `egress.apps` | array of strings | Application names in the same environment. |
| `egress.addons` | array of objects | Add-ons, each identified by `name`. |
| `egress.addresses` | array of objects | Private IPv4 ranges, each with a `cidr` and optional `ports`. |
| `egress.addresses[].ports` | array of objects | Each entry has a `protocol` (`TCP` or `UDP`), a `port`, and an optional `endPort` for a range. Omit `ports` to allow all ports and protocols. |
| `egress.vpcEndpoints` | array of strings | VPC endpoint IDs. |

Deploy to apply your changes. To disable network restriction, set `enabled: false` and redeploy.

## Verify access

After deploying, test connections to your service's dependencies and check its logs. If new connection timeouts appear, check the allowed destinations and ports. Also check incoming connections from add-ons or workloads outside Porter applications, which are blocked.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.