# Networking

Each computer has a network policy that decides where it can connect. A new computer can reach nothing outside until you allow it.

## Allow destinations

A policy either denies all outbound traffic except what its rules allow, or allows all except what its rules deny. Each rule names destinations in one of these ways:

| Rule     | Matches                                                | Example                          |
| -------- | ------------------------------------------------------ | -------------------------------- |
| Domain   | An exact host, or its subdomains with one leading `*.` | `api.openai.com`, `*.github.com` |
| IP       | An address or a CIDR range                             | `10.0.4.12`, `10.0.4.0/24`       |
| Ports    | Port ranges, on a domain or IP rule                    | `443`, `5432`                    |
| Protocol | TCP, UDP, ICMP or ICMPv6, on an IP rule                | `tcp`                            |

For example, a policy that denies everything except `api.openai.com` on port 443 lets the computer call that API over HTTPS, and stops a request to `api.openai.com` on port 80 or to any other host.

Rules on an allowed HTTPS host can also set or remove request headers.

## Change a policy

Updating a computer's network policy replaces the whole policy, and the new one applies at once. Each computer has its own policy; there are no organization-wide lists.

## Next steps

* [Secrets](/computer/concepts/secrets): use credentials without putting them in the computer
* [Usage limits](/computer/concepts/usage-limits): act when a computer sends more than you expect