Outbound Rules

You do not control an outside server’s firewall. You can still control which connections leave a company computer.

Egress means outbound traffic. Inspect the practice computer’s outbound policy:

seclab inspect egress practice-laptop

You should see:

practice-laptop:
[
  {
    "action": "allow",
    "port": "any",
    "to": "any"
  }
]

Its rollout rule allows all destinations. Block its web connections to the internet before that broad allow:

seclab egress practice-laptop deny 443 internet at 1

You should see:

Outbound rules updated. First match wins; unmatched traffic is blocked.

Test the outside connection:

seclab probe demo-upload

You should see:

practice-laptop -> parcel-cache:443
Blocked: egress (rule 1)

The result says egress: the source computer’s outbound rule blocked it. This rule targets the internet zone, so it can leave approved connections to the storage zone available.