Destination allowlists

How rules work

• Rules belong to one credential. Other credentials of the same app keep their own rules.
• A credential with no rules can reach every destination the proxy allows. Adding the first rule restricts it to what the rules name.
• A connection is allowed when any rule matches its host or address and its port.
• Nodes enforce a new or deleted rule within seconds.
• Private and reserved address ranges stay blocked whatever the rules say.

Rule types

Host rules match the name your client sends, never an IP address. A connection to an IP literal such as 203.0.113.10 needs a CIDR rule, even when a host rule names a host that resolves to it. The proxy dials exactly the addresses it checked, so a name that later resolves elsewhere cannot slip past.

Add and test rules

In the dashboard, open the app, then Credentials, then Allowlist on the credential. Or use the API with an API key:

# Allow one host on port 443
curl -X POST https://api.fixedmark.com/v1/apps/APP_ID/credentials/CRED_ID/policy \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"host_pattern": "api.razorpay.com", "port": 443}'

# Ask whether a destination would be allowed, and by which rule
curl -X POST https://api.fixedmark.com/v1/apps/APP_ID/credentials/CRED_ID/policy/test \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"destination": "api.razorpay.com:443"}'

The test answers allowed with a reason: no_rules, match, no_match, resolve_failed, or reserved_address. Deleting the last rule allows every destination again. Each change is written to the org's audit log.

Plans with allowlists

Allowlists come with Business ($79 a month) and every larger plan. The 7-day trial is Starter, so it has none. On a plan without them, adding a rule answers 409 with the code plan.feature_required and "feature": "egress_firewall".

If your plan changes to one without allowlists, the rules you have stay in force, because dropping them would let the credential reach anything. You can still list, test, and delete them, but not add new ones.

What a denied connection looks like

Each denial is a row in your connection logs with result=denied_by_policy.

What an allowlist does not stop

• Domain fronting. A suffix rule for a CDN, such as *.cloudfront.net, allows every site on that CDN. A client can send an allowed name in TLS and reach another site behind the same CDN. Prefer exact hosts.
• Traffic inside an allowed connection. The proxy never decrypts TLS, so it cannot see paths or requests.
• Connections already open. A new rule, a deleted rule, or a revoked credential applies to new connections. A tunnel opened before the change stays open until it closes.