> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Limit the Hosts a Package Install Can Reach

> Allow a sandboxed package install to reach only the hosts it needs, and refuse every other destination.

A malicious install script sends stolen data to a host that the attacker controls. A network policy lists the hosts that an install can reach. The PMG proxy checks each connection against the policy.

Each built-in sandbox profile has a network policy. For example, the npm profile allows `registry.npmjs.org`, `registry.yarnpkg.com`, `npm.pkg.github.com`, and `github.com` on port 443, and denies every other destination.

The policy has two modes:

* `audit` (default): PMG records each destination that the policy denies, and lets the connection through.
* `enforce`: PMG refuses each destination that the policy denies.

> [!NOTE]
>
> Network policy needs PMG v0.33.0 or later, and the [sandbox](/package-security/pmg/sandbox) turned on.

## Build a policy from a run

**1. Run the install in audit mode**

```bash theme={null}
pmg npm install
```

When the policy denies a destination, the report starts with `Network policy would deny` and names each destination. The report also shows the run ID and the command to propose a profile.

**2. Propose a profile**

```bash theme={null}
pmg sandbox profile propose --last --new my-npm
```

PMG writes the user profile `my-npm`. It inherits the npm profile, allows each host that the run reached, and denies every other destination. Run the command without `--new` to see the proposal first.

**3. Review the profile**

```bash theme={null}
pmg sandbox profile edit my-npm
```

Remove each host that the install does not need. PMG checks the profile when you close the editor.

**4. Use the profile for npm**

```bash theme={null}
pmg config set sandbox.policies.npm.profile my-npm
```

**5. Turn on enforce mode**

```bash theme={null}
pmg config set sandbox.network_mode enforce
```

The mode applies to every package manager. The built-in profiles of the other package managers also deny every host that they do not list.

## Fix a refused destination

In enforce mode, the package manager gets an HTTP 403 error for a denied destination. The PMG report names the destination and the rule:

```text theme={null}
⊘ Network policy denied registry.example.com:443  rule *:*
  Allow it with pmg sandbox allow net-connect=registry.example.com:443.
```

To allow the destination for one run, use `--sandbox-allow`:

```bash theme={null}
pmg --sandbox-allow net-connect=registry.example.com:443 npm install
```

To keep the allowance for this repository, use `pmg sandbox allow`:

```bash theme={null}
pmg sandbox allow net-connect=registry.example.com:443
```

## Refuse connections that skip the proxy

The policy applies to the connections that go through the PMG proxy. A script that ignores the proxy variables can connect directly. To refuse direct connections, set `network_via_proxy_only: true` in the profile. Landlock and Seatbelt support this setting. Bubblewrap refuses a profile with this setting.

On a Linux host or a CI runner, [kernel enforcement](/package-security/pmg/kernel-enforcement) routes every process through the proxy.

## With SafeDep Cloud

The network policy is free in PMG. With SafeDep Cloud, you see the destinations that the policy refused on every endpoint. PMG records each destination that the policy refuses, or in audit mode would refuse. This query lists them:

```sql theme={null}
SELECT endpoints.identifier,
       package_guard_events.hostname,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE package_guard_events.event_type = 'PMG_EVENT_TYPE_NETWORK_POLICY_DECISION'
ORDER BY package_guard_events.timestamp DESC
```

Use the result to find a host that the policy must allow, or a package that tried to reach an unknown host.

> [!NOTE]
>
> This section needs the SafeDep Cloud Team or Enterprise plan, with PMG [connected to your tenant](/governance/cloud/endpoint-hub/package-guard). See [pricing](https://safedep.io/pricing).

## Next steps

For the rule syntax, IP literal rules, and how the proxy matches a host, see [Network rules](https://github.com/safedep/pmg/blob/main/docs/sandbox.md#network-rules) in the PMG repository.

> **[Allow Only Known Hosts in GitHub Actions](/package-security/pmg/github-actions-network-policy)**
>
> Apply a network policy to a CI job.

> **[Sandbox Your AI Coding Agent](/ai-security/sandbox-coding-agents)**
>
> Limit the hosts that a coding agent can reach.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.