Network Packet Flow

This page traces the path of a network packet from code running inside a sandbox to the internet and back, covering both HTTP and HTTPS flows with and without security scanning.

Physical network layout

Flow 1: HTTPS with no security scanning

When only a domain allowlist (no PII, no injection) is configured, the proxy uses TLS passthrough — it inspects the SNI without decrypting. The workload negotiates TLS directly with the destination — the proxy is invisible.

Flow 2: HTTPS with PII scanning (edge proxy active)

When PIIConfig.enabled=True, the proxy performs full TLS interception.

Flow 3: Domain blocked

Flow 4: IP blocked by iptables (CIDR rule)

IP and CIDR rules bypass the userspace proxy entirely — they are kernel-level DROP rules.

Flow 5: Metadata service block (always-on)

The cloud metadata endpoint 169.254.169.254 is blocked by a hardcoded DROP rule regardless of network policy:

Flow 6: envd traffic (API-to-sandbox)

SDK calls go through the orchestrator to envd via the private veth pair — this traffic never crosses the public network:

iptables rule structure

All rules live host-side in the sandbox’s network namespace — the guest VM has no iptables rules of its own. The orchestrator installs two rule sets per sandbox, both keyed on the TAP interface that carries VM-originated traffic:

nat table — PREROUTING REDIRECT (on the TAP interface)

Redirects VM-originated TCP onto the namespace proxy’s local listeners:

# Redirect HTTP to proxy
iptables -t nat -A PREROUTING -i tap0 -p tcp --dport 80 -j REDIRECT --to-port <proxy_http_port>

# Redirect HTTPS to proxy
iptables -t nat -A PREROUTING -i tap0 -p tcp --dport 443 -j REDIRECT --to-port <proxy_tls_port>

# Redirect other TCP (non-80/443) for domain checking
iptables -t nat -A PREROUTING -i tap0 -p tcp -m multiport ! --dports 80,443 -j REDIRECT --to-port <proxy_other_port>

filter table — FORWARD allow/deny

# Block metadata service (always)
iptables -A FORWARD -d 169.254.169.254 -j DROP

# Allow rules (higher priority)
iptables -A FORWARD -d 1.1.1.1 -j ACCEPT

# Deny rules
iptables -A FORWARD -d 0.0.0.0/0 -j DROP

Summary of interception points

Traffic type	Intercepted by	What happens
HTTP to blocked IP	Sandbox iptables (kernel)	DROP — no proxy involved
HTTP to blocked domain	Namespace proxy (userspace)	RST after Host header read
HTTP to allowed domain, no scan	Namespace proxy	Forward raw TCP
HTTPS to blocked IP	Sandbox iptables (kernel)	DROP — no proxy involved
HTTPS to blocked domain	Namespace proxy	RST after SNI peek
HTTPS to allowed domain, no scan	Namespace proxy	TLS passthrough
HTTPS to allowed domain, scan active	Namespace proxy (edge proxy)	Decrypt, scan, re-encrypt
API-to-envd traffic	Private veth pair	No interception, private network
Cloud metadata (169.254.169.254)	Sandbox iptables (hardcoded)	DROP always

Getting Started

Core Features

CLI

Security

Platform

Deployment

Architecture

Network Packet Flow

Physical network layout

Flow 1: HTTPS with no security scanning

Flow 2: HTTPS with PII scanning (edge proxy active)

Flow 3: Domain blocked

Flow 4: IP blocked by iptables (CIDR rule)

Flow 5: Metadata service block (always-on)

Flow 6: envd traffic (API-to-sandbox)

iptables rule structure

nat table — PREROUTING REDIRECT (on the TAP interface)

filter table — FORWARD allow/deny

Summary of interception points

​Physical network layout

​Flow 1: HTTPS with no security scanning

​Flow 2: HTTPS with PII scanning (edge proxy active)

​Flow 3: Domain blocked

​Flow 4: IP blocked by iptables (CIDR rule)

​Flow 5: Metadata service block (always-on)

​Flow 6: envd traffic (API-to-sandbox)

​iptables rule structure

​nat table — PREROUTING REDIRECT (on the TAP interface)

​filter table — FORWARD allow/deny

​Summary of interception points

Physical network layout

Flow 1: HTTPS with no security scanning

Flow 2: HTTPS with PII scanning (edge proxy active)

Flow 3: Domain blocked

Flow 4: IP blocked by iptables (CIDR rule)

Flow 5: Metadata service block (always-on)

Flow 6: envd traffic (API-to-sandbox)

iptables rule structure

nat table — PREROUTING REDIRECT (on the TAP interface)

filter table — FORWARD allow/deny

Summary of interception points