Protected Network Definition

net defines (optionally masked) IP addresses that belong to the protected network. The destination egress filter is currently applied only to outgoing requests directed to the intranet.

A configuration example:

net ip4 {
    127.0.0.1,
    127.0.0.0/8
}
net ip6 {
    3001:db8:85a3::8a2e:370:7334/120
}

By default, network rules use the protocol name as their identifier, so you can remove a rule in a patch with:

net=ip6/del;

Currently, specifying a protected network is required in the following cases:

1. Using the destination filter (dst) in host mode when the application layer performs load balancing or another type of proxying. In this scenario, eBPF programs do not “see” the final upstream destination addresses and ports, as they are defined at the application layer.

2. Using the destination filter (dst) with NAT in gate mode, where packets change their destination addresses and ports during NAT and must be tracked accordingly.

3. Using the TCP authentication filter, which tracks TCP handshake state and therefore needs to distinguish between ingress and egress traffic.