# New Smokescreen Example **URL:** \ **Category:** General\ **Tags:** example-app\ **Created:** [December 17, 2020, 6:57pm UTC](https://community.fly.io/t/new-smokescreen-example/466 "2020-12-17T18:57:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Codepope](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/codepope/32/4_2.png) [@Codepope](https://community.fly.io/u/Codepope)\ **Post date:** [December 17, 2020, 6:57pm UTC](https://community.fly.io/t/new-smokescreen-example/466/1 "2020-12-17T18:57:40Z")
Do you want to take control and manage your outgoing connections? A tool like Smokescreen could help as it can block some of the trickier destinations for your GET requests. We’ve got an example of how you can deploy it on Fly. Read more on [fly-examples/smokescreen-example](https://github.com/fly-examples/smokescreen-example). ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [December 17, 2020, 10:33pm UTC](https://community.fly.io/t/new-smokescreen-example/466/2 "2020-12-17T22:33:47Z")
Smokescreen is _fantastic_. Silly easy to use and protects apps from some [really tough problems](https://www.google.com/search?q=aws+metadata+service+vulnerability&oq=aws+&aqs=chrome.0.69i59l2j69i57j69i59j0i67i457j69i60l3.1277j0j7&sourceid=chrome&ie=UTF-8). ---
**Author:** ![Codepope](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/codepope/32/4_2.png) [@Codepope](https://community.fly.io/u/Codepope)\ **Post date:** [January 14, 2021, 3:28pm UTC](https://community.fly.io/t/new-smokescreen-example/466/3 "2021-01-14T15:28:45Z")
And now this example has had a revamp, with added basic authentication and proxy passwords. We’ll have a fuller write up on it in the blog, but for now head over to [fly-examples/smokescreen-example](https://github.com/fly-examples/smokescreen-example) and check out the updated README for details. ---
**Author:** ![PJUllrich](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/pjullrich/32/5431_2.png) [@PJUllrich](https://community.fly.io/u/PJUllrich)\ **Post date:** [September 9, 2022, 7:45am UTC](https://community.fly.io/t/new-smokescreen-example/466/4 "2022-09-09T07:45:17Z")
Hey folks, quick question about this: could I use this to block ANY outbound traffic from an application? My use-case is that I want to run a “worker” application that only processes some files and will be called through an `.internal ` URL from another application. However, the files are user-provided, so potentially malicious. We want to prevent that any malicious code “phones home”, so would it be possible to restrict all traffic from and to an application to only allow inbound traffic and also that only on the specific port for HTTP calls through the ‘.internal’ URL? Thanks in advance for your advice 🙏 ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [September 9, 2022, 2:47pm UTC](https://community.fly.io/t/new-smokescreen-example/466/5 "2022-09-09T14:47:42Z")
Fly, I don’t think, has a [built-in firewall](https://community.fly.io/t/does-fly-have-any-sort-of-firewall-ip-blocking/1932). One could setup firewall rules with `iptable`s / `nftable`s? You can also go nuclear and delete the `default` routes when VM starts up (do not recommend unless you know what you’re doing): ```auto ip route del default ip -6 route del default ``` @thomas / @wjordan can confirm if `6pn` would continue to work in that case? I am not so sure… but I know for sure that you’d lose all connectivity to that VM! Short of mucking with the routing table, if you’re ambitious enough, you could process potentially malicious payloads in a [capability-restricted](https://deno.land/manual@v1.25.2/getting_started/permissions#permissions-list) [programmable](https://github.com/losfair/blueboat) [wasm](https://github.com/fermyon/spin) [runtime](https://community.fly.io/t/wasm-runtime-platform/3478/5). You may also spin up [one VM per request using Machines](https://community.fly.io/t/how-to-spin-up-one-fly-machine-per-request/6596/2) (let us know if it works!). Btw, not really what you want, but if the app needn’t be reachable over the public Internet ([see also](https://community.fly.io/t/feature-request-public-private-app-switch/5317)), consider [removing `[[services]]` section from `fly.toml`](https://community.fly.io/t/long-running-background-tasks/1153/2) (nb, you can also [_release_ assigned public IPs](https://fly.io/docs/flyctl/ips-release/) _after the fact_, too)… in doing so, [that (public ip-less) app should be exempt](https://community.fly.io/t/high-internal-bandwidth-usage/3577/8) from egress / ingress charges, altogether. ---
**Author:** ![PJUllrich](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/pjullrich/32/5431_2.png) [@PJUllrich](https://community.fly.io/u/PJUllrich)\ **Post date:** [September 9, 2022, 8:55pm UTC](https://community.fly.io/t/new-smokescreen-example/466/6 "2022-09-09T20:55:52Z")
Ah thank you! I will try removing the ‘[[services]]’ section and will do some testing. I’ll let you know if that worked. Thank you!