New Transparent capture is in preview. Record every app's traffic with no proxy configuration, on Windows, macOS and Linux. Learn more

ipEgressFilter Filter

Select exchanges by the destination (upstream) IP address that Fluxzy will connect to, with literal, prefix, suffix or regex matching.

ipEgressFilter selects exchanges by the IP address of the upstream server Fluxzy is about to talk to. It is the right choice when hostnames are too noisy or too volatile, and it works for both IPv4 and IPv6 destinations. Pair it with any action below to throttle, tag or reject traffic targeting a specific subnet or origin.

When to use this filter

Reach for ipEgressFilter when the meaningful selector is the remote server's IP address rather than its hostname. This is common in environments where many hostnames resolve to the same back end, or where a DNS round robin makes hostname matching unreliable.

Typical situations:

  • Scoping a rule to a private subnet that hosts an internal API, for example 10.0.5.0/24.
  • Targeting a specific IPv6 address served by a CDN edge.
  • Isolating traffic to a single data center while letting other regions pass through untouched.

The filter evaluates on the onAuthorityReceived scope, so the destination IP is already resolved by the time it fires. Use StartsWith to emulate CIDR style prefix matching, and pair it with hostFilter when you need both layer 3 and layer 7 conditions.

Real world examples

Throttle traffic to a private subnet

Slow down every exchange whose destination IP falls inside 10.0.5.0/24 to reproduce a bandwidth issue affecting an internal API cluster.

rules:
- filter:
    typeKind: IpEgressFilter
    pattern: 10.0.5.
    operation: StartsWith
  actions:
  - typeKind: AverageThrottleAction
    bandwidthBytesPerSeconds: 65536

Tag exchanges hitting a specific IPv6 endpoint

Mark every call that lands on a known IPv6 origin so you can audit the routing path of mobile clients that prefer AAAA records.

rules:
- filter:
    typeKind: IpEgressFilter
    pattern: 2a01:cb00:7e2:5000:10d5:70df:665:c654
    operation: Exact
  actions:
  - typeKind: ApplyTagAction
    tag:
      value: ipv6-origin

Reject traffic to a forbidden IP range

Block every outbound connection whose destination IP starts with 203.0.113 (an example reserved range), useful in test environments to fail fast when stub services are misconfigured.

rules:
- filter:
    typeKind: IpEgressFilter
    pattern: 203.0.113.
    operation: StartsWith
  actions:
  - typeKind: RejectAction

Reference

ipEgressFilter

Description

Select exchanges according to upstream IP address. Full IP notation is used from IPv6.

Evaluation scope

Evaluation scope defines the timing where this filter will be applied.

onAuthorityReceived This scope denotes the moment fluxzy is aware the destination authority. In a regular proxy connection, it will occur the moment where fluxzy parsed the CONNECT request.

YAML configuration name

ipEgressFilter

Settings

The following table describes the customizable properties available for this filter:

Property Type Description DefaultValue
pattern string The string pattern to search
operation exact | contains | startsWith | endsWith | regex The search operation performed contains
caseSensitive boolean true if the Search should be case sensitive false
inverted boolean Negate the filter result false

Example of usage

The following examples apply a comment to the filtered exchange

Retains only exchanges where the destination address is 212.12.14.0/24.

rules:
- filter:
    typeKind: IpEgressFilter
    pattern: 212.12.14
    operation: StartsWith
  actions:
  - typeKind: ApplyCommentAction
    comment: filter was applied

Retains only exchanges where the destination address is 2a01:cb00:7e2:5000:10d5:70df:665:c654 (IPv6).

rules:
- filter:
    typeKind: IpEgressFilter
    pattern: 2a01:cb00:7e2:5000:10d5:70df:665:c654
    operation: Exact
  actions:
  - typeKind: ApplyCommentAction
    comment: filter was applied

.NET reference

View definition of IpEgressFilter for .NET integration.

See also

This filter has no related filter

Frequently asked questions

How do I match a CIDR block like 10.0.5.0/24?

Use the StartsWith operation with the prefix portion of the address, for example pattern: 10.0.5. for a /24. For a /16, use 10.0. as the pattern. For more complex masks use a regex.

Does ipEgressFilter work with IPv6 addresses?

Yes. Full IPv6 notation is supported. Use the Exact operation for a single address or StartsWith for a prefix such as 2a01:cb00:.

When does the filter evaluate, before or after DNS resolution?

After. The onAuthorityReceived scope fires once Fluxzy knows the destination authority and has resolved the upstream IP, so the address you match against is the one Fluxzy will actually connect to.

What is the difference with ipIngressFilter?

ipEgressFilter matches the upstream (destination) IP. ipIngressFilter matches the client (source) IP. Pick the one that corresponds to the side of the connection you want to filter.

Learn more about Fluxzy rules