Domain Filtering and Egress Control

Most firewalls focus on inbound traffic, but egress (outbound) control is critical for security. Compromised workloads call out to attacker servers to receive commands or exfiltrate data. Restricting which destinations your resources can reach cuts off this path and limits the damage of a breach.

Security groups and NACLs can restrict outbound traffic only by IP and port, not by domain. Since attacker infrastructure uses rotating IPs and shared cloud hosts, IP-based egress rules are brittle. Domain-based filtering in Network Firewall solves this by controlling destinations by name.