Allowlist
The Allowlist is the set of addresses (or CIDRs) PortWall will never auto-block. It is the inviolable safety net: an allowlisted address is subtracted from every threat-intel feed and geo policy before any rule is programmed, and it can never be escalated to a block by the correlation engine.
Use it for:
- Your own management addresses and monitoring/uptime checks.
- Payment gateways, partner APIs, and other services you must never block.
- Anything a feed might list that you know is fine.
Each entry has a scope (WAF, feeds, or both), a reason, and who added it — so the list stays auditable. An address that is allowlisted but keeps appearing in the attack feed is marked as such, so you can see it was flagged but deliberately not blocked.
The allowlist is enforced at the outermost point, before anything is persisted or programmed, which is what makes self-lockout structurally impossible.
Outbound (egress) control
Egress control restricts what a site's application may connect out to — a defence against a compromised site being used to exfiltrate data or beacon to a command-and-control server.
Per site you can set an egress policy:
- Audit — record outbound connections but allow them (see what a site actually talks to first).
- Enforce (default-deny) — only the remotes you allow are permitted; everything else is blocked.
Reading the Overview card
- No policies / audit-only — green (nothing to enforce, or reporting by design).
- Enforce set but nothing applied — red: a site is set to default-deny but no egress rules are in force. Check the worker log and re-save the site's policy.
- Enforcing on N sites — green.
Start in audit, learn each site's legitimate destinations, add them to the allow-list, then switch to enforce.