Advanced egress firewall filtering for Vercel Sandbox
By Steven Van ·
Outbound connections are now checked by hostname or CIDR range at the TLS handshake, with policies that can tighten or reopen while a sandbox is running.
Vercel Sandbox now enforces egress network policies through Server Name Indication (SNI) filtering and CIDR blocks, giving developers control over which hosts a sandbox can reach. Outbound TLS connections are checked against the policy at the handshake, and unauthorized destinations are rejected before any data is transmitted.
Sandboxes default to unrestricted internet access. For untrusted or AI generated code, the network can be locked down to only the services a workload needs, so a compromised or hallucinated snippet can't exfiltrate data or make unintended API calls.
The firewall works by inspecting the initial unencrypted bytes of a TLS handshake to read the target hostname, an approach Vercel calls an SNI-peeking firewall. That lets rules target domains, including wildcarded ones behind CDNs that serve many hosts from a handful of IP addresses, without needing an HTTP proxy that would break non-HTTP protocols like Redis and Postgres. IP/CIDR-based rules remain available as a fallback for legacy or non-TLS systems.
Policies can also be changed on a running sandbox without restarting it. A single session can:
- Start with full internet access to install dependencies
- Lock the network down before executing untrusted code
- Reopen it to stream results after user approval
- Switch to deny-all to air gap the sandbox