A method comprising: receiving, by a packet security gateway, via a communication interface (208, 210), and from a first network, a plurality of outbound packets, wherein the packet security gateway protects the first network from exfiltration of data; determining, based on a destination address of each of a first portion of the plurality of outbound packets indicating that the first portion of the plurality of outbound packets are destined for a second network outside the first network, that the first portion of the plurality of outbound packets comprise one or more packet header field values that correspond to a first packet-filtering rule, wherein the first packet-filtering rule belongs to a set of packet-filtering rules configured to prevent exfiltration of data from the first network to a second network; responsive to the determining that the first portion of the plurality of outbound packets comprise one or more packet header field values that correspond to the first packet-filtering rule: determining that at least one packet of the first portion of the plurality of outbound packets comprises application header field values associated with the exfiltration of data from the first network; applying, based on a determination that the at least one packet of the first portion of the plurality of outbound packets comprises application header field values that are associated with the exfiltration of data, at least one first packet transformation function, specified by an operator specified by the first packet-filtering rule, to block the at least one packet of the first portion of the plurality of outbound packets from continuing toward the second network; and applying, based on a determination that at least one other packet of the first portion of the plurality of outbound packets comprises application header field values that are not associated with the exfiltration of data, at least one second packet transformation function, specified by the operator specified by the first packet-filtering rule, to allow the at least one other packet of the first portion of the plurality of outbound packets to be forwarded to the second network. receiving, by a packet security gateway, via a communication interface (208, 210), and from a first network, a plurality of outbound packets, wherein the packet security gateway protects the first network from exfiltration of data; determining, based on a destination address of each of a first portion of the plurality of outbound packets indicating that the first portion of the plurality of outbound packets are destined for a second network outside the first network, that the first portion of the plurality of outbound packets comprise one or more packet header field values that correspond to a first packet-filtering rule, wherein the first packet-filtering rule belongs to a set of packet-filtering rules configured to prevent exfiltration of data from the first network to a second network; responsive to the determining that the first portion of the plurality of outbound packets comprise one or more packet header field values that correspond to the first packet-filtering rule: determining that at least one packet of the first portion of the plurality of outbound packets comprises application header field values associated with the exfiltration of data from the first network; applying, based on a determination that the at least one packet of the first portion of the plurality of outbound packets comprises application header field values that are associated with the exfiltration of data, at least one first packet transformation function, specified by an operator specified by the first packet-filtering rule, to block the at least one packet of the first portion of the plurality of outbound packets from continuing toward the second network; and applying, based on a determination that at least one other packet of the first portion of the plurality of outbound packets comprises application header field values that are not associated with the exfiltration of data, at least one second packet transformation function, specified by the operator specified by the first packet-filtering rule, to allow the at least one other packet of the first portion of the plurality of outbound packets to be forwarded to the second network. determining that at least one packet of the first portion of the plurality of outbound packets comprises application header field values associated with the exfiltration of data from the first network; applying, based on a determination that the at least one packet of the first portion of the plurality of outbound packets comprises application header field values that are associated with the exfiltration of data, at least one first packet transformation function, specified by an operator specified by the first packet-filtering rule, to block the at least one packet of the first portion of the plurality of outbound packets from continuing toward the second network; and applying, based on a determination that at least one other packet of the first portion of the plurality of outbound packets comprises application header field values that are not associated with the exfiltration of data, at least one second packet transformation function, specified by the operator specified by the first packet-filtering rule, to allow the at least one other packet of the first portion of the plurality of outbound packets to be forwarded to the second network.