# Outbound access

Choose which private addresses workflow steps may reach.

Every connection a step makes is checked where it is made: after the name is looked up, and again at each redirect. That holds for every app, a step’s own proxy and a [company proxy](https://docs.gorunner.io/self-host/company-proxy).

| Addresses | Steps may reach them |
| --- | --- |
| The public internet | Always |
| Private networks and this server: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`, `127.0.0.0/8`, `fc00::/7` | Only when you allow them |
| The cloud metadata service, other link-local, multicast and reserved addresses, the provider’s name server, a socket on this server | Never |

## Allow a private network

1. In `.env`, list the ranges and addresses steps may reach, separated by commas.
2. Apply it with `./deploy.sh "$(cat VERSION)"`.

`.env`

```
WORKFLOW_PRIVATE_NETWORKS=10.0.4.0/24,192.168.1.20
```

Empty, the default, allows none. `all` allows every private range, GoRunner’s own database and Redis included. On Kubernetes it is `workflows.privateNetworks`.

> **Warning** Where your customers build workflows, through Embed or their own organizations, anyone who builds can call any address this allows. Leave it empty, or list only what their workflows should reach. Never `all`.

## Check it

The [preflight check](https://docs.gorunner.io/self-host/preflight-check) prints the rule in force:

```text
✓ Workflow steps: private networks blocked
```

With a list, it reads `private networks blocked except 10.0.4.0/24, 192.168.1.20/32`. Cloud metadata addresses are always blocked.

## When a step is refused

The step fails with one sentence that names only the host, because the people who build may be your customers:

```text
This address can’t be reached from workflows: intranet.example.com.
```

A connection test says “This connection can’t reach this address: …”. The worker’s log has the rest: one `WARN` line with the `host`, the `address` it resolved to, the `range`, the `setting` that would allow it, and the `run_id` and `step`.

```bash
docker compose logs worker | grep "refused by the address rule"
```

**What about notification and OAuth addresses?**

They follow another setting, `OUTBOUND_ALLOW_PRIVATE`. Off, notification endpoints and your own OAuth apps’ token addresses must be https on the public internet. `true` also allows plain http, this server and your private network. It never applies to workflow steps.

## Related

- [A company proxy](https://docs.gorunner.io/self-host/company-proxy): Send outbound calls through your proxy · 5 min
- [Settings (.env)](https://docs.gorunner.io/self-host/settings): Every setting
- [HTTP Request](https://docs.gorunner.io/apps/http-request): The app most steps call out with

Source: https://docs.gorunner.io/self-host/outbound-access