# Customizing or disabling the firewall for GitHub Copilot
Learn how to control the domains and URLs that Agent cloud Copilot and révision du code Copilot can access.
> \[!NOTE]
> Firewall configuration is managed from the "Internet access" settings tab, which covers both Agent cloud Copilot and révision du code Copilot. Previous configurations saved as Actions variables will be maintained on that page.
## Overview
By default, Copilot's access to the internet is limited by a firewall.
> \[!NOTE]
> révision du code Copilot also supports firewall configuration, at both the organization and repository level, under its own section of the "Internet access" tab described below. This allows you to configure firewall rules for révision du code Copilot independently of Agent cloud Copilot. See [Utilisation de GitHub Copilot pour la révision de code](/fr/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review#customizing-copilot-code-reviews-environment).
Limiting internet access helps manage data exfiltration risks. Unexpected behavior from Copilot, or malicious instructions, could lead to code or other sensitive information being leaked to remote locations.
The firewall always allows access to a number of hosts that Copilot uses to interact with GitHub. By default, a recommended allowlist is also enabled to allow the agent to download dependencies.
If Copilot tries to make a request which is blocked by the firewall, a warning is added to the pull request body (for new pull requests) or to a comment (for existing pull requests). The warning shows the blocked address and the command that tried to make the request.
## Limitations
The agent firewall has important limitations that affect its security coverage.
* **Only applies to processes started by the agent**: The firewall only applies to processes started by the agent via its Bash tool. It does not apply to Model Context Protocol (MCP) servers or processes started in configured Copilot setup steps.
* **Only applies within the GitHub Actions appliance**: The firewall only operates within the GitHub Actions appliance environment. It does not apply to processes running outside of this environment.
* **Bypass potential**: Sophisticated attacks may bypass the firewall, potentially allowing unauthorized network access and data exfiltration.
These limitations mean that the firewall provides protection for common scenarios, but should not be considered a comprehensive security solution.
## Understanding the recommended firewall allowlist
The recommended allowlist, enabled by default, allows access to:
* Common operating system package repositories (for example, Debian, Ubuntu, Red Hat).
* Common container registries (for example, Docker Hub, Azure Container Registry, AWS Elastic Container Registry).
* Packages registries used by popular programming languages (C#, Dart, Go, Haskell, Java, JavaScript, Perl, PHP, Python, Ruby, Rust, Swift).
* Common certificate authorities (to allow SSL certificates to be validated).
* Hosts used to download web browsers for the Playwright MCP server.
For the complete list of hosts included in the recommended allowlist, see [Référentiel de la liste d'autorisation de Copilot](/fr/copilot/reference/copilot-allowlist-reference#copilot-cloud-agent-recommended-allowlist).
## Configuring the firewall at the organization level
Organization owners can configure all firewall settings at the organization level, for both Agent cloud Copilot and révision du code Copilot. To access the firewall settings:
1. Dans le coin supérieur droit de GitHub, cliquez sur votre photo de profil, puis sur ** Vos organisations**.
2. Sélectionnez une organisation en cliquant dessus.
3. Sous le nom de votre organisation, cliquez sur ** Settings**. Si vous ne voyez pas l’onglet « Paramètres », sélectionnez le menu déroulant **** , puis cliquez sur **Paramètres**.
In the sidebar, under "Code, planning, and automation", click ** Copilot**, and then click **Internet access**.
The "Internet access" page has separate sections for Agent cloud Copilot and révision du code Copilot, so you can configure the following settings independently for each.
### Enabling or disabling the firewall
> \[!WARNING]
> Disabling the firewall will allow Copilot to connect to any host, increasing risks of exfiltration of code or other sensitive information.
1. Under "Internet access", set the **Enable firewall** setting to **Enabled**, **Disabled**, or **Let repositories decide** (default).
### Enabling or disabling the recommended allowlist
1. Under "Internet access", set the **Recommended allowlist** setting to **Enabled**, **Disabled**, or **Let repositories decide** (default).
### Controlling whether repositories can add custom allowlist rules
By default, repository administrators can add their own entries to the firewall allowlist. Organization owners can disable this to prevent repositories from adding custom rules.
1. Under "Internet access", set the **Allow repository custom rules** setting to **Enabled** (default) or **Disabled**.
### Managing the organization custom allowlist
Items added to the organization custom allowlist apply to all repositories in the organization. These items cannot be deleted at the repository level. Organization-level and repository-level rules are combined.
1. Under "Internet access", click **Organization custom allowlist**.
2. Ajoutez les adresses que vous souhaitez inclure dans la liste d’autorisation. Vous pouvez inclure :
* **Domaines** (par exemple, `packages.contoso.corp`). Le trafic est autorisé vers le domaine spécifié et tous les sous-domaines.
**Exemple** : `packages.contoso.corp` autorisera le trafic vers `packages.contoso.corp` et `prod.packages.contoso.corp`, mais pas vers `artifacts.contoso.corp`.
* **URLs** (par exemple, `https://packages.contoso.corp/project-1/`). Le trafic ne sera autorisé que sur le schéma spécifié (`https`) et l'hôte (`packages.contoso.corp`), et sera limité au chemin spécifié et aux chemins descendants.
**Example** : `https://packages.contoso.corp/project-1/` autorise le trafic vers `https://packages.contoso.corp/project-1/` et `https://packages.contoso.corp/project-1/tags/latest`, mais pas `https://packages.contoso.corp/project-2`, `ftp://packages.contoso.corp` ou `https://artifacts.contoso.corp`.
1. Cliquez sur **Ajouter une règle**.
2. Après avoir validé votre liste, cliquez sur **Enregistrer les modifications**.
## Configuring the firewall at the repository level
Repository administrators can configure firewall settings at the repository level, including enabling or disabling the firewall, enabling or disabling the recommended allowlist, and managing a custom allowlist. Depending on the organization-level configuration, some of these settings may be locked. The repository settings page also has separate sections for Agent cloud Copilot and révision du code Copilot, so you can configure these settings independently for each.
To access the firewall settings:
1. Sur GitHub, accédez à la page principale du référentiel.
2. Sous le nom de votre référentiel, cliquez sur ** Paramètres**. Si vous ne voyez pas l’onglet « Paramètres », sélectionnez le menu déroulant **** , puis cliquez sur **Paramètres**.
3. In the "Code & automation" section of the sidebar, click **Copilot** then **Internet access**.
### Enabling or disabling the firewall
> \[!NOTE]
> You can only change this setting at the repository level if the organization-level **Enable firewall** setting is set to **Let repositories decide**. If the organization-level setting is **Enabled** or **Disabled**, you can't change this setting for individual repositories.
1. Toggle the **Enable firewall** setting on or off.
### Enabling or disabling the recommended allowlist
> \[!NOTE]
> You can only change this setting at the repository level if the organization-level **Recommended allowlist** setting is set to **Let repositories decide**. If the organization-level setting is **Enabled** or **Disabled**, you can't change this setting for individual repositories.
1. Toggle the **Recommended allowlist** setting on or off.
### Managing the custom allowlist
> \[!NOTE]
> You can only add custom allowlist rules at the repository level if the organization-level **Allow repository custom rules** setting is set to **Enabled**. For more information, see [Controlling whether repositories can add custom allowlist rules](#controlling-whether-repositories-can-add-custom-allowlist-rules).
1. Click **Custom allowlist**.
2. Ajoutez les adresses que vous souhaitez inclure dans la liste d’autorisation. Vous pouvez inclure :
* **Domaines** (par exemple, `packages.contoso.corp`). Le trafic est autorisé vers le domaine spécifié et tous les sous-domaines.
**Exemple** : `packages.contoso.corp` autorisera le trafic vers `packages.contoso.corp` et `prod.packages.contoso.corp`, mais pas vers `artifacts.contoso.corp`.
* **URLs** (par exemple, `https://packages.contoso.corp/project-1/`). Le trafic ne sera autorisé que sur le schéma spécifié (`https`) et l'hôte (`packages.contoso.corp`), et sera limité au chemin spécifié et aux chemins descendants.
**Example** : `https://packages.contoso.corp/project-1/` autorise le trafic vers `https://packages.contoso.corp/project-1/` et `https://packages.contoso.corp/project-1/tags/latest`, mais pas `https://packages.contoso.corp/project-2`, `ftp://packages.contoso.corp` ou `https://artifacts.contoso.corp`.
1. Cliquez sur **Ajouter une règle**.
2. Après avoir validé votre liste, cliquez sur **Enregistrer les modifications**.
## Further reading
* [Stocker des informations dans des variables](/fr/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#creating-configuration-variables-for-a-repository)
* [Configurer l’environnement de développement](/fr/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment)