Skip to main content

Contain a compromised host

You have a host you no longer trust. The instinct is to pull its network cable, but that destroys the volatile evidence you need and takes the service down with it.

What you usually want instead is narrower: stop it reaching anything new, keep watching it, and leave the machine running while you investigate.

Cut egress, keep visibility​

Firewall rules match in both directions. Where access rules answer is this source allowed to reach me, firewall rules answer is this conversation allowed — and they can stop a host reaching out, not just being reached.

Enforcement is stateless and runs in the kernel at the TC hook, so nothing sits in the application's path and a compromised userspace process cannot bypass it.

Matches on
AddressSource and destination, with a CIDR prefix
PortSource and destination ranges
ProtocolTCP, UDP, or any
TCP flagsA mask and the value it must equal
Directioningress or egress
Actionallow or drop

The containment shape​

Deny egress by default, then allow only what the investigation needs — your log collector, your management plane — and leave ingress monitoring untouched so you keep seeing what the host receives.

Order decides

Evaluation stops at the first matching rule, lowest order first. An allow placed below a broad drop never runs. Give the exceptions a lower order value than the deny they are meant to escape.

Only active rules are loaded into the kernel, so disabling a rule removes it from the datapath rather than leaving it resident and inert.

Rules survive the host​

The same policy can be written once and enforced by whatever the host offers — XDP/eBPF → nftables → iptables — which is what lets one containment policy cover a fleet that is not uniform.

Where this stops working​

  • Stateless means exactly that. There is no connection tracking, so a rule permitting a reply has to exist in its own right. This surprises people who have written stateful firewall rules for years.
  • Matching stops at the transport header. You can cut a destination and a port. You cannot express block this TLS SNI here — that is evaluated on the host by Amygdala, which then installs the resulting block.
  • A local-only compromise is untouched. Egress rules do nothing about something that never leaves the box.
  • Containment is not eradication. This buys time and limits blast radius; it is not a substitute for rebuilding the host.

See also​