Egress allowlisting is a network control that permits a device to contact only approved external services, such as specific domains, IP addresses, ports, or protocols. Everything else is blocked by default. It is the outbound counterpart to inbound firewall filtering.
This matters because many attacks depend on a compromised device reaching the internet: downloading payloads, calling command-and-control servers, exfiltrating data, or joining a botnet. On consumer IoT gear such as smart TVs, egress allowlisting can sharply reduce what an attacker can do even if the device is vulnerable. Defenders often pair it with segmentation, DNS filtering, and proxy rules. It is not a complete fix, though: if an approved service is abused, or if allowlists are too broad, malicious traffic can still get out.