Sandbox egress IP addresses

AgentBox does not publish a dedicated egress CIDR and does not assign a static source address to a sandbox. Managed sandboxes run in one Selectel location, and their egress addresses can change.

Allow Selectel addresses

For a coarse allowlist, you can allow the current Selectel public ranges used by the AgentBox infrastructure. These ranges belong to the provider as a whole: they do not distinguish AgentBox traffic from other Selectel customers. AgentBox does not publish this list as a stable contract. Ask the AgentBox team for the current ranges and expect them to change.

Use a stable address

When the destination requires one stable source address, route sandbox traffic through a proxy you control. The destination then sees the proxy address, which you can place in an exact allowlist.

This controls the source address only. Configure the sandbox network policy separately when you need to restrict which external destinations it can reach.