Unit 9: Firewalls and segmentation · Lesson 5 of 6 · 18 min

Egress control as containment

Compare servers' outbound traffic with the outbound policy and close the paths ransomware crews use to steal data.

mission

You are
The engineer tightening outbound rules on the server network.
Situation
Most servers never need the internet. When they can reach it anyway, stolen data and attacker tools flow freely. The policy is in ~/firewall/egress-policy.txt; a day of server flows is in ~/flows/server-egress.csv.
Goal
Find servers talking to the internet without permission.
Hand in
The servers, their destinations and the rule change.

Default allow versus default deny outbound

  1. Default deny outboundeach server gets only the destinations it needs; everything else is dropped and logged
  2. Allow 443 to anywherelooks safe, but stolen data and tools ride on 443 too
  3. Allow all outboundthe most common default, and the one ransomware crews count on
01

Read the policy

Three servers have a business need for the internet. Everyone else should have none.

analyst@net-lab
cat egress-policy.txt
outbound internet policy for servers, approved 2026-06-01
web01   updates.example.org tcp 443
mail01  any tcp 25
nms01   updates.nms-vendor.example tcp 443
all other servers: no internet access
02

Count outbound flows by server

Any server not in the policy with outbound flows is a finding.

analyst@net-lab
cut -d, -f2 server-egress.csv | sort | uniq -c
      2 db01
      1 dc01
      3 file01
      1 host
      5 mail01
      3 nms01
      6 web01

you should see db01, dc01 and file01 all reached the internet.

03

List their destinations

These are the destinations to explain, block or investigate.

analyst@net-lab
grep -E ',(db01|file01|dc01),' server-egress.csv | cut -d, -f2,3,4 | sort -u
db01,203.0.113.150,443
dc01,198.51.100.20,80
file01,198.51.100.230,443

you should see file01 sends to 198.51.100.230, the same address seen in earlier exfiltration. A domain controller browsing over plain HTTP is a finding by itself.

defender tip Roll out default deny in report-only mode first: log what would be dropped for a week, fix real needs, then enforce.

04

Total bytes sent per server

Volume tells you where to look first.

analyst@net-lab
awk -F, 'NR>1 {b[$2]+=$5} END {for (h in b) print h, b[h]}' server-egress.csv | sort
db01 41991
dc01 14589
file01 143375
mail01 133320
nms01 96716
web01 258466

you should see file01 sent the most of the three servers that should not reach the internet at all.

What a defender takes away

  1. 1Servers rarely need the internet; make outbound access a named exception.
  2. 2Outbound 443 to anywhere is not a control.
  3. 3Egress logs show theft and command channels even when inbound rules were fine.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.