Documentation / Operate and recover
Network permissions
Restrict outgoing connections and understand blocked connection observations.
Open and Restricted modes
Existing services use Open networking by default. Restricted mode permits new outgoing TCP connections only to selected services and ports in the same project environment. Incoming web requests and responses to those requests continue through the platform's ingress relay.
For example, an API can be allowed to reach postgres:5432 while being unable to open a new connection to an external API. With no allowed peers, new outgoing connections are blocked.
Isolation in Open mode
Open mode keeps full internet access but isolates each project environment. This is a platform setting with nothing to configure, and it applies to every deployment from 1 November 2026.
| Connection | Open mode |
|---|---|
Services of the same environment, by name or <service>.upferry.internal, any port | Allowed |
| Public internet, any port, TCP and UDP | Allowed |
| Your own sites through their public address | Allowed |
| Other projects and environments, the platform, private and link-local addresses, cloud metadata | Blocked |
| The server itself, except its public web ports 80 and 443 | Blocked |
| Outgoing IPv6 | Not available |
Names are resolved by Docker for services of the environment and by 1.1.1.1 and 8.8.8.8 for everything else, so internal hostnames of other networks do not resolve. Incoming web requests reach the service through the platform's ingress relay. A running service keeps its current network until its next deployment. To reach a service of another environment, use its public address. Restricted mode adds limits on top of this, it does not remove them.
Enable or disable
- Open the service, then Settings, then Network permissions.
- Select Restricted and choose allowed services and TCP ports.