What Is Egress Filtering?
Egress filtering controls what leaves your network, not just what comes in. Most perimeter defense obsesses over inbound traffic, yet the traffic that matters most after a breach flows outbound: stolen data leaving, and compromised hosts phoning home. Restricting and monitoring egress is one of the highest-value, most-overlooked controls in network security.
Why does controlling outbound traffic matter?#
Because the attacker’s key actions after gaining access happen on the way out:
| Post-breach action | Needs outbound to… |
|---|---|
| Data exfiltration | An external destination |
| C2 / reverse shell | The attacker’s server |
| Downloading tools | The internet |
| Beaconing | External infrastructure |
If a database server is only allowed to talk to the application server, then an attacker who compromises it cannot exfiltrate to the internet or open a reverse shell — the outbound connection simply fails, and the attempt becomes an alert.
How do you apply egress filtering?#
- Default-deny outbound, then allow only necessary destinations and ports per system role.
- Force traffic through a proxy for inspection and logging.
- Monitor and alert on denied or anomalous outbound attempts.
The principle is least privilege applied to network egress: a system should reach only what its job requires.
Egress filtering defends the post-breach phase most perimeters ignore. More at the Network Security hub.
Frequently asked questions#
What is egress filtering?
Egress filtering controls outbound traffic leaving a network, allowing only connections that are expected and necessary. Most firewalls focus on inbound traffic; egress filtering applies the same discipline outbound, so a compromised host cannot freely reach the internet to exfiltrate data or contact an attacker’s command-and-control server.
Why is egress filtering often overlooked?
Because outbound traffic is assumed to be trustworthy — it originates from "our" systems — and unrestricted egress is convenient. But that assumption fails the moment a host is compromised. Egress filtering is one of the most underused high-value controls precisely because it defends against the post-breach phase, which perimeter thinking neglects.