Skip to content

Destination Policy

Destination policy limits which private hosts and ports a SchemaDock may reach.

Policy is configured per Dock from Administration -> SchemaDock -> Destinations.

Restricted mode

Restricted is the production-oriented deny-by-default mode.

Evaluation is:

matching Deny
    -> DENY

otherwise matching Allow
    -> ALLOW

otherwise
    -> DENY

A Deny rule always wins over a matching Allow rule.

Open for testing

Open for testing relaxes the destination host/port gate so connectivity can be tested before a restrictive rule set is complete.

Use Open for testing intentionally

Open for testing does not disable SchemaDock identity, enrollment, enabled-state, organization authorization, or online checks. It only relaxes the destination host/port policy gate. Use Restricted mode for normal production operation when practical.

Existing destination rules remain stored while Open for testing is active.

Rule types

Destination rules can match:

Match type Example
Hostname sftp.internal.example.edu
DNS suffix .internal.example.edu
CIDR 10.40.0.0/16
Single port 636
Port range 8000-8100
Any port Use only when intentionally required.

Rules may be Allow or Deny.

Examples

Allow one LDAPS server

Allow
Host: ad2.internal.example.edu
Port: 636

Allow an internal HTTPS suffix

Allow
DNS suffix: .apps.internal.example.edu
Port: 443

Deny a sensitive subnet

Deny
CIDR: 10.40.50.0/24
Any port

If a destination matches both the HTTPS Allow rule and a Deny rule, the Deny result wins.

Defense in depth

Destination authorization is enforced as part of the SchemaDock control path and independently by the agent policy state.

Conceptually:

SchemAlign allows destination
        AND
SchemaDock agent allows destination
        =
connection may be opened

Missing or invalid policy state fails closed.

  1. Start with the smallest set of required destinations.
  2. Prefer explicit hosts, suffixes, CIDRs, and ports.
  3. Use Deny rules for explicit exclusions when needed.
  4. Validate both allowed and denied behavior before production use.
  5. Return to Restricted mode after temporary Open-for-testing work.
  6. Review rules when systems, ports, or network ranges change.