# Source: https://www.daytona.io/docs/en/network-limits.md

Daytona provides network egress limiting for sandboxes to control internet access. This feature can be automatically applied based on your organization's billing tier or manually configured for specific sandboxes.

## Tier-Based Network Restrictions

Network limits are automatically applied to sandboxes based on your organization's billing tier. This provides secure and controlled internet access for development environments:

- **Tier 1 & Tier 2**: Network access is restricted and cannot be overridden at the sandbox level
- **Tier 3 & Tier 4**: Full internet access is available by default, with the ability to configure custom network settings

:::note
**Tier 1 & 2**: Organization-level network restrictions take precedence over sandbox-level settings. Even if you specify `networkAllowList` when creating a sandbox, the organization's network restrictions will still apply.
:::

To learn more about organization tiers and limits, see the [Limits documentation](https://www.daytona.io/docs/limits.md).

## Managing Network Access

### Creating Sandboxes with Network Restrictions

You can control network access when creating sandboxes using the `networkAllowList` and `networkBlockAll` parameters:


```python
from daytona import CreateSandboxFromSnapshotParams, Daytona

daytona = Daytona()

# Allow access to specific IP addresses (Wikipedia, X/Twitter, private network)
sandbox = daytona.create(CreateSandboxFromSnapshotParams(
    network_allow_list='208.80.154.232/32,199.16.156.103/32,192.168.1.0/24'
))

# Or block all network access
sandbox = daytona.create(CreateSandboxFromSnapshotParams(
    network_block_all=True
))
```


```typescript
import { Daytona } from '@daytonaio/sdk'

const daytona = new Daytona()

// Allow access to specific IP addresses (Wikipedia, X/Twitter, private network)
const sandbox = await daytona.create({
  networkAllowList: '208.80.154.232/32,199.16.156.103/32,192.168.1.0/24'
})

// Or block all network access
const sandbox = await daytona.create({
  networkBlockAll: true
})
```



```ruby
require 'daytona'

daytona = Daytona::Daytona.new

# Allow access to specific IP addresses (Wikipedia, X/Twitter, private network)
sandbox = daytona.create(
  Daytona::CreateSandboxFromSnapshotParams.new(
    network_allow_list: '208.80.154.232/32,199.16.156.103/32,192.168.1.0/24'
  )
)

# Or block all network access
sandbox = daytona.create(
  Daytona::CreateSandboxFromSnapshotParams.new(
    network_block_all: true
  )
)
```



:::note
If both `networkBlockAll` and `networkAllowList` are specified, `networkBlockAll` takes precedence and all network access will be blocked, ignoring the allow list.
:::


### Network Allow List Format

The `networkAllowList` accepts up to 5 CIDR network blocks separated by commas:

- **Single IP**: `208.80.154.232/32` (Wikipedia)
- **Subnet**: `192.168.1.0/24` (Private network)
- **Multiple networks**: `208.80.154.232/32,199.16.156.103/32,10.0.0.0/8`

:::note
**Essential Services**: Services that are essential for development are accessible on all tiers, including package registries, container registries, Git repositories, CDN services, platform services, system package managers etc.\
If you experience issues with any essential development services, please contact [support@daytona.io](mailto:support@daytona.io) for assistance as these should be accessible on all tiers.

For a complete list of whitelisted services, see [Essential Services](#essential-services) below.
:::

## Organization Configuration

The network access policies for your organization are set automatically depending on your organization's limits tier and cannot be modified by organization administrators. These policies determine the default network behavior for all sandboxes in your organization.

## Testing Network Access

To test network connectivity from your sandbox:

```bash
# Test HTTP connectivity to allowed addresses
curl -I https://208.80.154.232

# Test package manager access (allowed on all tiers)
apt update  # For Ubuntu/Debian
npm ping    # For Node.js
pip install --dry-run requests  # For Python
```

## Security Benefits

Network limits provide several security advantages:

- **Prevents data exfiltration** from sandboxes
- **Reduces attack surface** by limiting external connections
- **Complies with security policies** for development environments
- **Enables fine-grained control** over network access

:::caution
Enabling unrestricted network access may pose security risks when executing untrusted code. It is recommended to whitelist specific network addresses using `networkAllowList` or block all network access using `networkBlockAll` instead.

Test network connectivity before starting critical development work and consider upgrading your tier if you need access to many external services.
:::


## Essential Services

The following services are whitelisted and accessible on all tiers:

### NPM Registry and Package Managers

- **NPM Registry**: `registry.npmjs.org`, `registry.npmjs.com`, `nodejs.org`, `nodesource.com`, `npm.pkg.github.com`
- **Yarn Packages**: `classic.yarnpkg.com`, `registry.yarnpkg.com`, `repo.yarnpkg.com`, `releases.yarnpkg.com`, `yarn.npmjs.org`, `yarnpkg.netlify.com`, `dl.yarnpkg.com`, `yarnpkg.com`

### Git Hosting and Version Control

- **GitHub**: `github.com`, `api.github.com`, `raw.githubusercontent.com`, `github-releases.githubusercontent.com`, `codeload.github.com`, `ghcr.io`, `packages.github.com`
- **GitLab**: `gitlab.com`, `registry.gitlab.com`
- **Bitbucket**: `bitbucket.org`

### Python Package Managers

- **PyPI**: `pypi.org`, `pypi.python.org`, `files.pythonhosted.org`, `bootstrap.pypa.io`

### Ubuntu/Debian Package Repositories

- **Ubuntu Repos**: `archive.ubuntu.com`, `security.ubuntu.com`
- **Debian Repos**: `deb.debian.org`, `security.debian.org`, `cdn-fastly.deb.debian.org`, `ftp.debian.org`

### CDN and Content Delivery

- **CDN Services**: `fastly.com`, `cloudflare.com`
- **JavaScript CDNs**: `unpkg.com`, `jsdelivr.net`

### AI/ML Services

- **Anthropic**: `api.anthropic.com`
- **OpenAI**: `api.openai.com`
- **Perplexity**: `api.perplexity.ai`
- **DeepSeek**: `api.deepseek.com`
- **Groq**: `api.groq.com`
- **Expo**: `api.expo.dev`
- **OpenRouter**: `openrouter.ai`

### Docker Registries and Container Services

- **Docker Registries**: `download.docker.com`, `registry-1.docker.io`, `registry.docker.io`, `auth.docker.io`, `index.docker.io`, `hub.docker.com`, `docker.io`
- **Microsoft Container Registry**: `mcr.microsoft.com`
- **Kubernetes Registry**: `registry.k8s.io`
- **Google Container Registry**: `gcr.io`, `asia.gcr.io`, `eu.gcr.io`, `us.gcr.io`, `marketplace.gcr.io`, `registry.cloud.google.com`
- **Quay**: `quay.io`, `quay-registry.s3.amazonaws.com`

### Maven Repositories

- **Maven Repos**: `repo1.maven.org`, `repo.maven.apache.org`

### Google Fonts

- **Google Fonts**: `fonts.googleapis.com`, `fonts.gstatic.com`

### AWS S3 Endpoints

- **US East**: `s3.us-east-1.amazonaws.com`, `s3.us-east-2.amazonaws.com`
- **US West**: `s3.us-west-1.amazonaws.com`, `s3.us-west-2.amazonaws.com`
- **EU**: `s3.eu-central-1.amazonaws.com`, `s3.eu-west-1.amazonaws.com`, `s3.eu-west-2.amazonaws.com`

### Daytona Platform

- **Daytona**: `app.daytona.io`

:::note
This list is continuously updated. If you require access to additional essential development services, you can submit a request via the [sandbox-network-whitelist](https://github.com/daytonaio/sandbox-network-whitelist) repository or contact [support@daytona.io](mailto:support@daytona.io).
:::


## Getting Help

If you encounter network access issues or need unrestricted network access

1. Check your **organization tier** in the [Dashboard](https://app.daytona.io/dashboard/limits)
2. Upgrade your **organization tier** by completing the required verification steps to unlock higher limits tiers automatically
3. Verify your **network allow list** configuration
4. Contact support at [support@daytona.io](mailto:support@daytona.io) for assistance