> For the complete documentation index, see [llms.txt](https://metalbear.com/mirrord/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://metalbear.com/mirrord/docs/sharing-the-cluster/policies/outgoing-traffic-policies.md).

# Outgoing Traffic Policies

Cluster administrators can restrict which resources and endpoints can be accessed when using mirrord. Outgoing traffic restrictions are defined using a `MirrordPolicy` or `MirrordClusterPolicy` resource and enforced by the mirrord operator.

*Supported in mirrord Operator version 3.135.1*

{% hint style="info" %}
This feature is available to users on the Team and Enterprise pricing plans.
{% endhint %}

#### Example Policy

```yaml
apiVersion: policies.mirrord.metalbear.co/v1alpha
kind: MirrordPolicy
metadata:
  name: block-mirroring-from-boats-deployment
  namespace: default
spec:
  block: []
  network:
    outgoing: 
      allow:
        - ipBlock:
            cidr: 10.0.0.0/16
            except:
              - 10.0.5.0/24
          ports:
            - protocol: TCP
              port: 80
            - protocol: TCP
              port: 443
            - protocol: UDP
              port: 53
        - hostname: "^metalbear\\.(co|com)$"
          ports:
            - protocol: TCP
              port: 443
      block:
        - ipBlock:
            cidr: 0.0.0.0/0
          ports:
            - protocol: TCP
              port: 22
```

### Rule fields

Rules under allow or block are arrays of objects. Each object matches when all its fields align with the connection details. ​

#### Available fields:

`ipBlock`: Specifies CIDR ranges via `cidr` field with optional exclusions (`except` field, array of CIDRs).

`hostname`: Regex pattern (e.g., `^metalbear\\.(co|com)$`) for flexible matching.

`ports`: Array of objects with protocol (TCP/UDP) and port. ​

### Evaluation Logic

Policies evaluate runtime outgoing connections as follows:

1. No rules: If no allow or block rules exist, the connection is permitted.
2. Allow rules check: If allow rules exist but none match, the connection is forbidden.
3. Block rules precedence: If block rules exist and any match, the connection is forbidden (even if an allow rule would permit it).
4. Otherwise permitted: All other cases allow the connection.

Note: This differs from a strict "block by default" when no rules are present - empty policies remain permissive until rules are added.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://metalbear.com/mirrord/docs/sharing-the-cluster/policies/outgoing-traffic-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.