# Networking

Guest `fetch`, `node:http`, `node:net`, and DNS all run through a virtual
network stack inside the VM. No guest code ever holds a real host socket.

- Guest listeners and loopback connections work by default, but are never
  published as host ports.
- External network access is **denied by default**. Grant it, or specific hosts,
  with [permissions](/secure-exec/docs/permissions).
- To call a server running in the guest, use `vm.network.httpRequest`. See
  [Long-Running Processes](/secure-exec/docs/long-running-code).

Read the [agentOS networking docs](/agentos/docs/networking) for how the stack
works and what it supports.