I tried to install CiviCRM on a server with a firewall that blocks outgoing traffic. But the dashboard wouldn't load. Looking at the logs, it appears CiviCRM tries to connect to civicrm.org. Probably to check for updates. Is there a way to disable all outgoing connections in CiviCRM and run CiviCRM without the server having access to the internet?
Edit: If I add 127.0.0.1 civicrm.org" to the host file, everything works. It looks like it's fine if a server returns 403 it just crashes when it can't connect to civicrm.org.
I have a client that stores a lot of sensitive information in CiviCRM. Because of all the security issues that come with all the popular CMS, I lobbied hard to separate CiviCRM from the webpage and to put in onto a separate server and to enforce strict rules for incoming and outgoing traffic.
So, I moved the CiviCRM to a fresh WordPress installation and put the whole thing behind a nginx reverse proxy that I configured as an authentication proxy with 2FA. The only exception I made is for /civi. We need public access to that path so that links in mailings will work. This works fine and should greatly reduce the attack surface.
To further improve security, I also want to block all outgoing traffic except for a few whitelisted ip addresses. The goal of this measure is to reduce the risk of malicious code trying to download further code or uploading any data away from the server.