Altihex Forward Proxy Appliance - AWS Egress Filtering

The Altihex Forward Proxy Appliance is a transparent forward proxy that automatically controls outbound internet access from your EC2 instances, ECS containers, and EKS Pods. When a workload is compromised, the appliance ensures attackers cannot reach unauthorized external destinations - reducing your blast radius without manual intervention.

Pricing is usage-based and metered - see the Pricing tab for full details on dimensions and rates.

• Zero-touch automated configuration - Instances, containers, and pods are tagged with metadata to select host profiles. When a workload starts, a simple notification API configures the proxy automatically.
• Security isolation - Proxy configuration lives in a separate security account behind a service endpoint and Gateway Load Balancer, unreachable from application accounts.
• No VPC peering limits - Supports overlapping CIDR blocks across VPCs with no peering constraints.
• Protocol support - Handles HTTP, HTTPS (TLS 1.2 and 1.3), multiple ports, and different transports.
• Horizontal scalability - Clustered appliances gather configuration across all your accounts from a single management node, reducing AWS API requests while scaling horizontally.

1. Deploy the appliance cluster in a dedicated security account behind an AWS Gateway Load Balancer and VPC service endpoint.
2. Define host profiles with curated domain allowlists in the security account.
3. Tag your workloads - Apply metadata tags to EC2 instances and ECS containers, or annotations to EKS Pods, mapping each to a host profile.
4. Route egress traffic - Each application account routes private outbound traffic through the service endpoint for filtering.
5. Automatic registration - When a new instance, container, or pod starts, the notification API registers it with the proxy cluster, enabling profile-based outbound access immediately.

The appliance sits between your application VPCs and the internet. Traffic from tagged workloads is routed through a Gateway Load Balancer endpoint to the proxy cluster in your security account. The cluster evaluates each connection against the assigned host profile's domain allowlist and permits or denies the request transparently. Configuration is centrally managed from an S3 bucket.

A team running dozens of microservices across multiple AWS accounts needs to enforce outbound traffic restrictions to meet compliance requirements. Rather than maintaining per-service security group rules or NAT gateway configurations, they deploy the Altihex Forward Proxy Appliance in a central security account. Each microservice container is tagged with a host profile that permits only the specific external APIs it needs. When new services launch, they are automatically registered and filtered - no manual firewall rule changes required.

• AWS Gateway Load Balancer and VPC endpoint service must be provisioned in the security account
• Application accounts require route table entries directing outbound traffic to the Gateway Load Balancer endpoint
• Workloads must be tagged with the appropriate host profile metadata (EC2 tags, ECS tags, or EKS annotations)
• S3 bucket in the security account for centralised configuration storage
• Notification API integration for automatic workload registration

To request a guided deployment walkthrough or schedule a discovery call, contact fpa-support@altihex.com . Visit the GitHub repository for documentation and community support.