> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Deny All

> Create a Declaw sandbox with all outbound network access denied, and compare it against a sandbox with open internet access.

## What You'll Learn

* Creating a sandbox with `allow_internet_access=False` (Python) / `allowInternetAccess: false` (TypeScript)
* Verifying blocked outbound traffic by attempting a raw TCP connection
* Comparing behavior against a sandbox with default (open) network access
* Proper cleanup of multiple sandboxes with `try/finally`

## Prerequisites

<Snippet file="snippets/env-setup.mdx" />

## Code Walkthrough

<Tabs>
  <Tab title="Python">
    The test script attempts a raw TCP connection to `1.1.1.1:80`. In a blocked sandbox, `socket.connect()` raises an exception:

    ```python theme={null}
    NET_TEST_SCRIPT = """
    import socket
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect(("1.1.1.1", 80))
        s.close()
        print("CONNECTED")
    except Exception as e:
        print(f"BLOCKED: {e}")
    """
    ```

    Create a sandbox with internet blocked:

    ```python theme={null}
    from declaw import Sandbox

    blocked_sbx = Sandbox.create(
        template="python", timeout=300, allow_internet_access=False
    )
    blocked_sbx.files.write("/tmp/net_test.py", NET_TEST_SCRIPT)

    result = blocked_sbx.commands.run("python3 /tmp/net_test.py", timeout=15)
    print(f"  Output: {result.stdout.strip()}")
    # Output: BLOCKED: [Errno 111] Connection refused  (or timed out)

    if "BLOCKED" in result.stdout:
        print("  [PASS] Outbound connection was blocked as expected.")
    ```

    Compare against a sandbox with default (open) network access:

    ```python theme={null}
    open_sbx = Sandbox.create(template="python", timeout=300)
    open_sbx.files.write("/tmp/net_test.py", NET_TEST_SCRIPT)

    result = open_sbx.commands.run("python3 /tmp/net_test.py", timeout=15)
    # Output: CONNECTED

    if "CONNECTED" in result.stdout:
        print("  [PASS] Outbound connection succeeded as expected.")
    ```
  </Tab>

  <Tab title="TypeScript">
    Create a sandbox with `allowInternetAccess: false`:

    ```typescript theme={null}
    import { Sandbox } from "@declaw/sdk";

    const blockedSbx = await Sandbox.create({ allowInternetAccess: false });
    ```

    Run a Python urllib test inside the blocked sandbox:

    ```typescript theme={null}
    const FETCH_CMD = [
      "python3 -c \"",
      "import urllib.request; ",
      "r = urllib.request.urlopen('http://1.1.1.1', timeout=5); ",
      "print(r.status)",
      "\"",
    ].join("");

    let result = await blockedSbx.commands.run(FETCH_CMD, { timeout: 15 });
    console.log(`exit_code: ${result.exitCode}`);
    console.log(`stdout:\n${result.stdout}`);

    if (result.exitCode !== 0) {
      console.log("\n[PASS] Outbound request was blocked as expected.");
    }
    ```

    Compare with an open sandbox (`allowInternetAccess` defaults to `true`):

    ```typescript theme={null}
    const openSbx = await Sandbox.create();
    result = await openSbx.commands.run(FETCH_CMD, { timeout: 15 });
    if (result.exitCode === 0) {
      console.log("\n[PASS] Outbound request succeeded as expected.");
    }
    ```
  </Tab>
</Tabs>

## Expected Output

```
============================================================
Network Deny All Example
============================================================

--- Creating sandbox with internet access DENIED ---
Sandbox created: sbx_abc123

--- Attempting to connect to 1.1.1.1:80 (should FAIL) ---
  Output: BLOCKED: [Errno 111] Connection refused
  Exit code: 0
  [PASS] Outbound connection was blocked as expected.

------------------------------------------------------------
--- Creating sandbox with internet access ALLOWED ---
Sandbox created: sbx_def456

--- Attempting to connect to 1.1.1.1:80 (should SUCCEED) ---
  Output: CONNECTED
  Exit code: 0
  [PASS] Outbound connection succeeded as expected.

--- Cleaning Up ---
  Sandbox sbx_abc123 killed.
  Sandbox sbx_def456 killed.

============================================================
Done!
============================================================
```