OpenClaw

Why

The sandbox default is no network. The first package install turns it to bridge, and the sandbox has the internet. With the daemon default set to a policy, that same change gives the sandbox only its approved scope, with every new destination held for review.

Requirements

Two policies, openclaw-gateway and openclaw-sandbox, each bound to a site. The resolver pair and block page address of each. Root on the host.

1. Assign the gateway host

[Resolve]
DNS=<primary resolver IP> <secondary resolver IP>
FallbackDNS=
DNSOverTLS=no
Domains=~.

2. Restrict DNS egress

table inet securd {
  chain output {
    type filter hook output priority 0; policy accept;
    ip daddr { <primary resolver IP>, <secondary resolver IP> } udp dport 53 accept
    ip daddr { <primary resolver IP>, <secondary resolver IP> } tcp dport 53 accept
    udp dport 53 counter drop
    tcp dport 53 counter drop
    tcp dport 853 counter drop
  }
}

3. Set the daemon default for sandboxes

OpenClaw creates sandbox containers itself and does not pass a resolver. Every sandbox and the sandboxed browser take this default.

{
  "dns": ["<sandbox primary resolver IP>", "<sandbox secondary resolver IP>"],
  "dns-search": []
}

4. Enable sandbox networking on a dedicated bridge

Keep read-only root and dropped capabilities. Use a custom bridge network; host mode is blocked by OpenClaw.

{
  agents: {
    defaults: {
      sandbox: {
        mode: "all",
        backend: "docker",
        scope: "agent",
        workspaceAccess: "ro",
        docker: { network: "openclaw-sandbox", readOnlyRoot: true, capDrop: ["ALL"] }
      }
    }
  }
}

5. Learn, then enforce

Import the model provider template on openclaw-gateway and add the messaging platform hosts in use. Run both policies in Learn Only for seven days, review New Query events, approve, then set Default Action to Deny and Greywall Mode to Enforce.

Verify

Run on the gateway host and inside a sandbox exec. Confirm the test name in Traffic Logs on the policy that answered it.

getent hosts first-seen-$(date +%s).example      # expected: <block page address>
dig +time=2 +tries=1 @8.8.8.8 example.com        # expected: connection timed out
getent hosts api.openai.com                      # expected: a public address

Limits

The Daytona backend runs in a vendor-managed sandbox with no resolver control and is not covered. If the gateway itself runs in Docker, give that container an explicit dns entry for openclaw-gateway so it does not inherit the sandbox default.