Airgap Your Server

sudo ufw enable --force

# Enable logging to monitor blocked/allowed traffic
sudo ufw logging low
sudo ufw enable --force

# Allow SSH (inbound & outbound), otherwise you may lock yourself out!
sudo ufw allow ssh
sudo ufw allow out ssh

# Set default policies, allow incoming traffic, deny outgoing
# Required so the workspace remains functional while blocking
# internet access
sudo ufw default allow incoming
sudo ufw default deny outgoing

# Allow loopback traffic, for k8s and local services
sudo ufw allow in on lo
sudo ufw allow out on lo

# k8s internal communication
sudo ufw allow in from 10.0.0.0/8
sudo ufw allow out to 10.0.0.0/8

for ns in $(awk '/^nameserver/ {print $2}' /etc/resolv.conf); do
    sudo ufw allow out to $ns port 53
done

google_rules=$(
curl -s https://www.gstatic.com/ipranges/goog.json \
| jq -r '.prefixes[]
         | select(.ipv4Prefix)
         | "sudo ufw allow out to \(.ipv4Prefix) port 443"'
)
# And apply them
eval "$google_rules"

# Replace ServiceTags_Public_YYYYMMDD.json with the actual filename
microsoft_rules=$(
jq -r '[.values
| map(select(.id=="AzureActiveDirectory"
or .id=="AzureActiveDirectory.ServiceEndpoint"
or .id=="AzureActiveDirectoryDomainServices"))
| .[].properties.addressPrefixes]
| flatten[]
| "sudo ufw allow out to \(.) port 443"' ServiceTags_Public_20260119.json
)
# And apply them
eval "$microsoft_rules"

nslookup mcp.your-mcp-server.com
# or
dig mcp.your-mcp-server.com +short