egress[] is an ordered, first-match list evaluated against every resolved destination address before dialing.

{ "uuid": "docs-private-service", "egress": [ { "cidr": "10.20.0.0/16", "port": "443", "proto": "http", "action": "allow" }, { "cidr": "10.0.0.0/8", "action": "deny" }, { "cidr": "0.0.0.0/0", "action": "allow" }, { "cidr": "::/0", "action": "allow" } ], "http": [] }

Field Required Meaning
cidr yes destination prefix
port no number, inclusive range, *, or omitted
proto no selected L7 handler (http in v1)
action yes allow or deny

Fall-through denies. DNS is resolved once, all answers are checked, and an answer set containing any denied address is refused. A hard guard denies mitmania's own listeners regardless of this list.