Require a per-sandbox traffic access token on public sandbox URLs, protect the Code Interpreter port, and run your own firewall rules inside a sandbox safely.
A sandbox’s public URL is either public (anyone with the URL can reach it) or private (every request needs the sandbox’s traffic access token).
We recommend upgrading to e2b 2.60.0 or later to reliably inherit the project’s public traffic default. Older Python SDKs send allow_public_traffic=True when you pass other network options without specifying it, which overrides a private project default. Explicit per-sandbox values still override the project default.
New projects: since October 30, 2026, newly created projects default to private sandbox traffic. Owners can change this default, and explicit per-sandbox options override it.
Existing projects: projects created before this rollout keep their existing default. If no project setting has been saved, sandbox traffic stays public by default.
Running, resumed, and forked sandboxes keep the setting they were created with.
Set allowPublicTraffic / allow_public_traffic at creation. An explicit true or false always overrides the project default; leave it out to use the default.
The Code Interpreter server listens on port 49999 and runs any code sent to it. On a sandbox with public access, anyone who has the port 49999 URL can run code in the sandbox and read its files. If you only call the sandbox through the SDK, nothing else needs that URL, so restrict public access. The Code Interpreter SDK sends the traffic access token for you, so runCode / run_code keeps working:
import { Sandbox } from '@e2b/code-interpreter'const sandbox = await Sandbox.create({ network: { allowPublicTraffic: false }})// The SDK sends the traffic access token automaticallyconst execution = await sandbox.runCode('print(6 * 7)')console.log(execution.logs.stdout) // [ '42\n' ]// A request to the Code Interpreter port without the token fails with 403const response = await fetch(`https://${sandbox.getHost(49999)}/execute`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code: 'print(6 * 7)' })})console.log(response.status) // 403
import requestsfrom e2b_code_interpreter import Sandboxsandbox = Sandbox.create( network={ "allow_public_traffic": False })# The SDK sends the traffic access token automaticallyexecution = sandbox.run_code("print(6 * 7)")print(execution.logs.stdout) # ['42\n']# A request to the Code Interpreter port without the token fails with 403response = requests.post( f"https://{sandbox.get_host(49999)}/execute", json={"code": "print(6 * 7)"},)print(response.status_code) # 403
E2B already blocks every sandbox from sending outbound traffic to private and link-local address ranges. This is enforced outside the guest, applies to every sandbox, and cannot be disabled, so you do not need your own in-sandbox rules to block these ranges:
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.168.0.0/16
E2B’s own control channel to the sandbox runs over an internal address in this space, and its return traffic is accepted before the deny rule is applied, which is why the platform’s own connectivity keeps working. If you add your own blanket outbound drop for one of these ranges (for example iptables -A OUTPUT -d 10.0.0.0/8 -j DROP) without allowing established and related connections ahead of it, you will cut that control channel and the sandbox will lose contact with the SDK. During a template build this surfaces as the start command failing its readiness check.
If you are using custom iptables or firewall rules inside a sandbox, keep E2B’s own connectivity open or the sandbox will lose contact with the SDK:
All loopback (lo) traffic.
Inbound TCP to port 49983 (the envd control channel).
Inbound TCP to port 49999, if you use the Code Interpreter template.
Established and related connections, if you filter outbound traffic.
To restrict which public destinations a sandbox can reach, use the built-in network configuration (allowInternetAccess, denyOut, allowOut) rather than in-sandbox firewall rules.