# Should our servers be allowed to connect to any address on the internet?

No. Most servers need a short list of outbound destinations, such as update servers, a backup target and a few partner services, and nothing else. Unrestricted outbound access is what lets malware on a server call home, download tools and upload stolen data. Restrict it with egress filtering on the firewall: allow the destinations each server needs, route web access through a proxy if you have one, and deny and log the rest. Start in logging mode for a few weeks to find what the servers really use, then tighten. Domain-based rules are easier to maintain than lists of addresses, because cloud services change their addresses. The same applies to printers, cameras and OT devices. NetSenX shows which outside destinations monitored hosts connect to, flags beaconing and unusual outbound volume on every plan, and lists destinations on rented cloud servers in its review queue, which gives you the list you need to write the rules.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)
- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)
- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)
- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)
- [Does zero trust mean monitoring employees?](https://netsenx.com/en/faq/does-zero-trust-mean-monitoring-employees)