Verify Egress Compliance

Verify Egress Compliance

Status as of 2026-11-05: Egress compliance is required. Only verify safe, approved checks.

What to verify

Check	How	Expected
UID routing	ip rule show and ip route show table 51820	UID 988 uses table 51820 to controlled gateway
IPv6 block	ip6tables -L OUTPUT -n -v	IPv6 egress rejected for UID 988
DNS	/etc/massprox/resolv.conf	Uses only 1.1.1.1 and 9.9.9.9
Egress guard	sudo -u massprox massprox-ops egress-test	Status passed
Service guard	Check unit ExecCondition	Runs egress test before start

Quick checks

id massprox
sudo ip rule show | grep 988
sudo ip route show table 51820
sudo ip6tables -L OUTPUT -n -v | grep 988
cat /etc/massprox/resolv.conf
sudo -u massprox massprox-ops egress-test

Rules

• Never test direct IPv6 egress.
• Never probe restricted addresses.
• Use only table 51820 for UID 988.
• Do not disable the egress guard without approval.

If checks fail

1. Stop affected services.
2. Check routing, iptables, and DNS.
3. Fix and retest.
4. Only start services after a passing test.
5. Escalate if the issue persists.

Related pages

• Massprox Architecture
• Massprox Operator Runbook
• Search Architecture
• Search Restoration Runbook