Configuring Application-Level Egress Rules | MuleSoft Documentation
# Configuring Application-Level Egress Rules
Application-level egress rules are independent of private-space-level firewall rules. For egress traffic to go through, it must pass both private space and application-level control.
## Before You Begin
  * Set up your private space and finish provisioning your private network.
  * Verify that your account has CloudHub Network Viewer permission, which is required to view a private space’s firewall and application-level rules.
  * Verify that your account has CloudHub Network Administrator permission, which is required to modify a private space’s firewall and application-level rules.


## Configure Application-Level Rules in Your Private Space
To configure the application-level rules in a private space:
  1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**.
  2. Click the name of the private space to manage.
  3. On the **Firewall rules** tab, expand the **App-Level Rules** section.


By default, the application-level egress rules feature is disabled when you create a new private space. Toggle the feature to enable it.
Add your private DNS IP addresses to the route table if you have a transit gateway to reach your internal DNS servers and the default route is routed to the transit gateway.
Ensure that you finished provisioning your private network before enabling the toggle.   
---  
Toggling **App-Level Egress Rules** enables the **Default-Egress-Rule-Group**. The default egress rule is **Allow any protocol to any destination**.
To modify the default egress rule group:
  1. Click **Edit**.
  2. In the **Egress Rules** section of the group configuration window, select the desired protocol and destination.
  3. Click **Add Rule** to add new rules to the rule group.
You can delete rules by clicking the delete button ().
  4. Click **Update Egress Rules** to save your changes.
Your changes affect all applications in the current private space.
You cannot rename or delete the default rule group.


To create a new custom egress rule group:
  1. Click **Create Rule Group**.
  2. In the rule group configuration window, add a group name.
You can edit and rename custom rule groups. The generated rule group name (`<rule_group_name>-<private_space_name>`) can’t exceed 53 characters.
  3. In the **Egress Rules** section, click **Add Rule** and select the protocol and destination for every rule that you want to add.
You can delete rules by clicking the delete button ().
  4. Click **Create Egress Rules** to save your changes.
To use custom rule groups, select them in the application settings.


To delete an existing custom rule group:
  1. Select **More actions** () > **Delete**.
  2. When prompted, click **Delete Rule Group** to confirm the deletion.
Once you delete a custom rule group, any applications that use it immediately start using the default egress rule group instead.   
---  


You can disable the application-level egress rule feature by clicking the feature’s toggle. When prompted, click **Delete and Disable App-Level Rules** to confirm.
Once you disable the application-level egress rule feature, all custom application-level egress rule groups are deleted, and all application-level egress is allowed for all applications.   
---  
## Apply Application-Level Egress Rules When Deploying Your Applications
You can apply the application-level egress rules that you configured in your private space when you deploy an application:
  1. When deploying an application to your private space, select the **Firewall Rules** tab.
  2. In the **Egress Rule Group** section, select the ruleset to apply to your application.
  3. Click **Apply Changes**.


## Configure an Application-Level Egress Connection to Anypoint MQ
To allow HTTPS connections to Anypoint MQ, add an application-level egress rule group with the following rules:
Allow egress to the Anypoint control plane:
  * **Protocol** : `HTTPS`
  * **Destination** : `Custom Domains`
    * With value:
      * For prod: `anypoint.mulesoft.com`
      * For prod-eu: `eu1.anypoint.mulesoft.com`


Allow egress to the MQ destination:
  * **Protocol** : HTTPS
  * **Destination** : `Custom Domains`
    * With the value of the domain name configured in the MQ connector URL
For example, if the MQ connector URL is `https://mq-us-east-1.anypoint.mulesoft.com/api/v1/organizations/{{anypointOrgId}}/environments/{{anypointEnvId}}/`, use the value `mq-us-east-1.anypoint.mulesoft.com`.


## Configure an Application-Level Egress Connection to Object Store v2
To allow HTTPS connections to Object Store v2, add an application-level egress rule group with the following rules:
Allow egress to the Anypoint control plane:
  * **Protocol** : `HTTPS`
  * **Destination** : `Custom Domains`
    * With value:
      * For prod: `anypoint.mulesoft.com`
      * For prod-eu: `eu1.anypoint.mulesoft.com`


Allow egress to the Object Store v2 destination:
  * **Protocol** : `HTTPS`
  * **Destination** : `Custom Domains`
    * With value:
      * For prod: `object-store-us-east-1.anypoint.mulesoft.com`
      * For prod-eu: `eu1.anypoint.mulesoft.com`
This URL varies depending on the region. For example, to access Object Store in `ap-southeast-1`, add the URL `object-store-ap-southeast-1.anypoint.mulesoft.com` as the value.


If you enable egress for a domain that includes redirection, such as when `salesforce.com` redirects to `www.salesforce.com`, allow egress for both the original target, `salesforce.com`, and the redirected target, `www.salesforce.com`.
Wildcard records are not supported. For example, `salesforce.com` does not automatically cover `example.salesforce.com`.
You can’t enable domains with double hyphens. For example, `abc—​xyz.com`. Domains with identical IP addresses are handled together. Allowing one domain allows all identical domains.  
---  
## Configure an Application-Level Egress Connection to API Manager
To add application-level egress support to API Manager, add a custom rule group with the following rule to allow egress to the Anypoint control plane:
  * **Protocol** : `HTTPS`
  * **Destination** : `Custom Domains`
    * With value:
      * For prod:
        * `anypoint.mulesoft.com`
        * `exchange-files.anypoint.mulesoft.com`
        * `analytics-ingest.anypoint.mulesoft.com`
      * For prod-eu:
        * `eu1.anypoint.mulesoft.com`
        * `exchange-files.eu1.anypoint.mulesoft.com`
        * `analytics-ingest.eu1.anypoint.mulesoft.com`


Depending on your use case, add Anypoint Platform hostnames and ports for your application to communicate with the online Anypoint Platform APIs and services that are managed by MuleSoft. See Ports, IPs, and Hostnames to Allow.
When configuring application-level egress connections to Anypoint MQ, Object Store v2, or API Manager, you must also allow outbound access to all 443 ports at the private-space level separately. For more information about allowing outbound access to 443 ports, visit Configuring Firewall Rules to Manage Traffic to and from a Private Space. You can’t use custom domains with private space internal DNS.  
---  
## Performance Impact
Given the extra layer of validation, using the application-level egress rules can introduce three-millisecond to ten-millisecond network latency delays to your applications' connections. To balance security and performance:
  * Limit active rule groups to 20 in your private space.
  * Use a maximum of 40 rules per rule group.
  * Limit the total combination of rule groups and rules to 800.
You can customize the number of rule groups and rules in the combination based on your needs.


These measures help optimize latency while maintaining effective network security.
DNS record timing issues can sometimes lead to unexpected connectivity errors. To enhance the reliability of Mule applications, implement robust error handling and connection retry mechanisms.   
---  
## See Also
  *   * Deploying Apps to Private Spaces
  * Configuring Firewall Rules to Manage Traffic to and from a Private Space
  * Anypoint MQ Overview
  * Object Store v2 Overview
  *