discrimiNAT firewall for egress filtering by FQDNs on Google Cloud. Architecture with Network Tags in VPCs for fine-grained, opt-in control over routing.