Skip to main content
Use this as a checklist when writing firewall/egress rules. Everything here is outbound unless stated otherwise. You only need the rows for features you actually use — enable incrementally.
Hostnames reflect the platform’s defaults and may evolve as providers change. Treat per-provider model and integration hosts as “enable the ones you use”, not “allow them all”.

​
Inbound (edge)

All other service ports (workers 8080, plugin server 8500, sandbox) are internal only and must not be exposed.

​
Outbound — model providers

Embeddings use the same provider hosts (e.g. OpenAI / Vertex embedding endpoints) — allowlisting a provider covers its embedding models. The one exception is the Vertex reranker, which calls Discovery Engine (see its row). For an air-gapped setup, point a provider’s base_url at an in-network OpenAI-compatible server and skip these entirely.

​
Outbound — integrations & OAuth

Enable only the providers you connect. Each typically needs an authorize host (browser), a token host (backend, outbound), and an API host (nodes/tools, outbound).
By default managed-provider OAuth is brokered by NCS (below). If you use NCS brokering you still need egress to each provider’s API host to run its nodes, but the OAuth token exchange goes via NCS. With direct OAuth apps, you also need the token host above.

​
Outbound — platform services & storage

​
Outbound — web tools

​
Outbound — telemetry (optional)

All optional; leave unset to send nothing.

​
Outbound — build / plugin install (as needed)

Only relevant if you build images in-network or install plugins at runtime.

​
Outbound — your own callbacks

​
Minimal-egress checklist

For a tightly restricted deployment, the smallest viable egress set is usually:
  • One model endpoint (in-network OpenAI-compatible, or a single public provider)
  • Object storage (in-network S3-compatible, or one cloud storage host)
  • The specific integration API hosts you actually enable
  • (Optional) an in-network OTel collector
  • Nothing else — NCS, telemetry, web tools, and unused providers can stay blocked
See Outbound → Running with minimal egress for the step-by-step.