All traffic is routed through a deny all squid proxy with a whitelist of domains only required to run the software.