# Egress policy


A VM's egress policy controls which outbound destinations it can reach. The
default policy is `all`. Set it to `integrations` to block public internet access
while keeping exe.dev metadata and attached integration endpoints available.

Check a VM's policy, restrict it, or remove the restriction:

```
ssh exe.dev egress my-vm
ssh exe.dev egress my-vm integrations
ssh exe.dev egress my-vm all
```

Set the policy when creating or copying a VM with `--egress`:

```
ssh exe.dev new --egress=integrations
ssh exe.dev cp my-vm --egress=integrations
```

A copy inherits the source VM's policy unless `--egress` is given.

## DNS

exe.dev is transitioning VMs to the DNS server at `169.254.169.254`. New VMs
are configured automatically. Older VMs must be configured manually so DNS
continues to work when outbound access is restricted:

```
echo "nameserver 169.254.169.254" | sudo tee /etc/resolv.conf
```