Allow the Needed Work

Blocking all outbound traffic can contain a problem, but it also stops approved work. A narrow allow can restore the work that the computer actually needs.

Suppose the practice computer now has a deny-all policy. Allow its HTTPS connection to storage before that deny:

seclab egress practice-laptop allow 443 storage at 1

You should see:

Outbound rules updated. First match wins; unmatched traffic is blocked.

Inspect the resulting policy:

seclab inspect egress practice-laptop

You should see:

practice-laptop:
[
  {
    "action": "allow",
    "port": 443,
    "to": "storage"
  },
  {
    "action": "deny",
    "port": "any",
    "to": "any"
  }
]

The first rule allows port 443 to storage. The next rule still blocks other destinations. This is safer than restoring the earlier allow-any rule.

After making an exception, test both sides: the approved work should succeed, and the unwanted route should stay blocked.