What "No Outbound Connection" Really Requires

In a state data centre review the vendor will say the platform can run with no outbound connection. The slide is usually a rectangle labelled SDC, a lock icon, and a red slash across a cloud. The demonstration that follows is a laptop on a local switch. Everyone nods. The minutes record air-gapped.

Three weeks later the same stack phones a licence server, pulls a container digest, ships a crash dump, syncs time to a public NTP pool, and opens a support tunnel because an engineer in another city cannot see the GPU. None of those hops were on the slide. All of them are outbound connections.

No outbound is a property of the running system under the department's identity, not a property of a sales laptop. It is also not the same as DPDP localisation. The Digital Personal Data Protection Act, 2023 does not impose a blanket ban on every packet leaving India. CERT-In's 28 April 2022 directions do require ICT logs to be maintained for a rolling 180 days with a copy in Indian jurisdiction. Those are different sentences. Mixing them is how a file becomes indefensible.

This article is the control list we walk with SDC owners, collectorate NIC leads and CISOs before anyone writes no outbound into a bid. It is written for Indian public institutions. It is not a security accreditation. It is the boredom that makes an air-gap claim true.

What the phrase is usually hiding

Air-gapped, on-prem, sovereign and no outbound are used as synonyms in decks. They are not. On-prem can still have a default route to the internet. Sovereign can mean Indian shareholding and a Mumbai region. Air-gapped, if you are honest, means there is no routed path from the processing VLAN to any network you do not control, including the vendor's. No outbound is the testable slice of that claim: from this host, this service account, this container, there is no successful connection to an address outside the allow-list.

Vendors hide hops in places architecture PDFs treat as plumbing. Licence daemons. Feature-flag services. Container registries. Model-weight CDNs. Crash reporters. APM SaaS. Mobile-device management. Windows or RHEL update mirrors. Certificate-revocation lists. Time sources. DNS resolvers. Support remote-access tools that only come on when you ask. If any of those must succeed for inference to keep running, they are part of the production path. A hop that is required is not optional, even if the salesperson calls it telemetry.

The honest version of the claim is therefore a sentence with nouns: inference, retrieval, identity, licence, time, logs, updates and support all complete using only named hosts inside the department or SDC perimeter. Anything else is an exception, written, time-boxed, and packet-captured. If the vendor cannot list the nouns, they cannot claim the adjective.

If a hop is required for the agent to stay up, it belongs in the no-outbound design, not in an appendix.

Hop the demo hides	Why it is outbound	What a real air-gap does instead
Licence / entitlement check	Runtime phones a vendor host every few hours	Local licence file or offline entitlement signed into the install media
Container or Helm pull	Cluster reaches a public or vendor registry on every restart	Internal registry populated from hashed media; imagePullPolicy never hits the internet
Model or tokenizer fetch	First boot downloads weights from a CDN	Weights already on local object store with checksums in the file
Crash / usage telemetry	Sentry, Segment, vendor product analytics	Disabled in build. Local syslog / SIEM only. Proof in staging pcap.
Public NTP / DNS	Hosts resolve and sync outside	Internal DNS. Time from NIC or NPL-traceable source on the government network.
Support tunnel	Vendor engineer joins via AnyDesk, TeamViewer, or a cloud bastion	Break-glass on a jump host you own, dual control, recorded, ticketed, then closed
CRL / OS update	Hosts reach public update or PKI endpoints	Internal WSUS / Satellite / update mirror fed by media

What no outbound is not

It is not the citizen portal is on the internet but the model is inside. That can be a good design. It is a screened subnet, not an air gap. The portal VLAN will have outbound and inbound paths. The model VLAN should not inherit them.

It is not we use an India region. A Mumbai hypervisor with a default route to a global APM is an outbound system that happens to have disks in India. Geography is not a deny rule.

It is not DPDP compliance by itself. DPDP regulates digital personal data. It uses a negative-list model for cross-border transfers rather than a blanket localisation command. You can be DPDP-defensible and still have outbound connections. You can also have no outbound connections and still fail purpose limitation, processor contracts, or erasure. Do not let a vendor collapse those tests.

It is not a substitute for CERT-In logging. The 28 April 2022 directions require covered entities to enable logs of ICT systems and maintain them for a rolling 180 days, with the logs available in Indian jurisdiction, and to report certain incidents on the stated clock. An air-gapped agent that writes no usable logs, or that only writes them to a vendor laptop that leaves the building, fails that direction even if it never reached the internet. FAQs issued in May 2022 discuss copies; read the current PDF rather than a blog summary before you write the note.

The evidence, not the slide

Ask for a staging packet capture with the production-like deny rule already on. The capture should cover boot, first inference, a failed tool call, a log rotation, and a simulated licence interval. If new destinations appear when the deny rule is lifted, those destinations were the real architecture.

Ask for the outbound allow-list as a numbered schedule: destination, port, protocol, purpose, data classes on the wire, owner, and review date. An empty schedule is a valid answer. A schedule that says as required for the service is not a schedule.

Ask who can add a destination. If the vendor's SRE can open a route from their own change tool, you do not have an air gap. You have a vendor-operated firewall. Put destination changes through the department CAB, with the CISO as a named veto.

Ask how updates arrive. The only honest answers in a hard air gap are physical media or a one-way transfer diode from a dedicated dirty network, both with hash verification. A nightly pull from a vendor registry is an outbound connection with a calendar.

• Boot-to-inference pcap on the processing VLAN, stored with the file.
• Egress deny rule as code, not as a screenshot of a GUI.
• Internal registry, internal DNS, internal time, internal log store.
• Licence and feature flags that survive 90 days with the WAN dead.
• Support path that is off by default and recorded when on.

How to write it in the RFP so it can be marked

Do not write must support air-gapped / no-outbound deployment as a single yes/no. Every bidder will tick yes. Write rows that an evaluator can fail.

Row one: list every external destination the runtime will attempt in the first 24 hours of isolated operation. Empty is acceptable. Will confirm after award is a fail. Row two: describe the licence mechanism with the WAN unreachable. Attach a sample entitlement file or offline activation sequence. Row three: name the internal registry and the media format for images and weights. Name the hash algorithm. Row four: name the time source and the DNS resolver. If they say customer provides NTP, make the SDC confirm it has one that is not a public pool. Row five: attach a 90-day isolation drill. If inference dies on day four because a token expired, the claim is false.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We can disable telemetry in config after go-live.

Then disable it in the build you ship, and prove it in the staging pcap before go-live. A config flag the next engineer can flip is not a control. A binary that cannot reach the endpoint is a control.

Support will be impossible without a tunnel.

Support without a tunnel is slower. That is the price of the claim. Design a jump host, a recorded session, dual control, and a media path for logs. If the vendor's only operations model is a standing tunnel, they are not selling an air-gapped product. They are selling a hosted product you happen to rack.

Time and DNS have to reach the internet or the cluster drifts.

Then the SDC must provide internal DNS and a time source traceable to NIC or NPL practice, which is also what CERT-In expects of ICT clocks. Borrowing 0.pool.ntp.org is an outbound connection and a fragile one. Do not make a public pool part of a collectorate agent.

DPDP already requires this, so the legal team can own it.

DPDP does not say no outbound. It regulates personal data, roles, purpose and transfers. CERT-In speaks to logs, clocks and incidents. The air-gap is an architecture and procurement choice. Give it to the CISO and the SDC owner, with counsel on the transfer sentences only.

A four-week no-outbound proof you can file

Run this before the commercial comparison, not after. A cheap bid that cannot survive isolation is not cheap. It is a second project.

1. Week 1: inventory every process that starts with the platform — licence, DNS, NTP, registry, model fetch, APM, crash, update, support. Name owners. Demand the vendor mark each as local or external.
2. Week 2: stand up a staging VLAN with a default deny outbound. Install from media only. Capture packets from power-on through twenty inference calls and one failure path.
3. Week 3: leave the VLAN isolated for fourteen days. Watch licence intervals, certificate expiry, log rotation and a simulated node restart. Record what dies.
4. Week 4: write the allow-list (even if empty), the media SOP, the jump-host SOP and the 90-day drill. Put them behind the note. Fail any bidder who will not run the same isolation on their dime.

How this shows up in the file

The note should contain four sentences a later CISO can audit. One: the processing VLAN has no default route. Two: the only destinations ever allowed are listed in schedule A, currently empty or named. Three: licence, images, weights, time, DNS and logs complete locally, with the staging pcap filed. Four: support access is off by default, dual-controlled, and recorded.

If those sentences cannot be written, do not write no outbound in the minutes. Write what is actually true: on-prem with named outbound exceptions. Honesty is cheaper than an incident review.

Clocks, DNS and the quiet exits

Two outbound classes survive even careful reviews because they look like hygiene. Hosts that cannot resolve names will be fixed by pointing at 8.8.8.8. Hosts whose clocks drift will be fixed by a public NTP pool. Both fixes are outbound connections. Both also fight the CERT-In expectation that ICT clocks are synchronised to a disciplined source. Borrow NIC or an SDC-provided resolver and time service. Write their names in Schedule A if they sit outside the VLAN, or write that they sit inside and need no schedule line.

Certificate revocation is the third quiet exit. A runtime that must fetch a CRL or OCSP on every TLS handshake will fail closed or fail open when isolated. Decide which. Failing open is a security choice. Failing closed is an availability choice. Failing by secretly reaching the public internet is a third, worse choice. Cache what you must on media. Test a revoked test cert during the isolation drill so you know which failure you bought.

Container health checks that hit an external status URL are a fourth. Engineers add them because a Helm chart defaulted that way. Read the chart. Delete the URL. A probe that must see the vendor's status page is a standing dependency dressed as care.

What a packet capture should show the committee

The pcap is not a trophy. It is a conversation piece. Walk the committee through boot, first token, a tool failure, and a simulated licence interval. Show that the only addresses are yours. If someone asks whether a later patch could add a hop, show the CAB rule that destination changes need the CISO. The capture without the rule is a snapshot. The rule is the control.

How to brief the secretary in four lines

Line one: the agent VLAN has no default route. Line two: licence, images, weights, time, DNS and logs complete inside. Line three: we have a fourteen-day isolation capture on file. Line four: support is a recorded jump host with a start and end, not a standing tunnel. If you need a fifth line, you do not understand the deployment yet. Secretaries do not need a lecture on sockets. They need to know what they are signing.

If you cannot honestly speak those four lines, change the minutes. On-prem with named egress is a respectable sentence. No outbound that is false is not.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, CERT-In direction, GFR, GeM term, SDC policy and your counsel before you file it.