diff --git a/samples/proxy/main.js b/samples/proxy/main.js
index 31ff5086..c23f09c8 100755
--- a/samples/proxy/main.js
+++ b/samples/proxy/main.js
@@ -98,9 +98,13 @@ if (config.proxy.http) {
               return 'tunnel'
             } else {
               var url = new URL(head.path)
-              $host = `${url.hostname}:${url.port}`
-              log('HTTP', head.method, head.path)
-              return 'forward'
+              if (isTargetAllowed(url.hostname)) {
+                $host = `${url.hostname}:${url.port}`
+                log('HTTP', head.method, head.path)
+                return 'forward'
+              } else {
+                return 'forbidden'
+              }
             }
           }
         }, {
@@ -109,7 +113,10 @@ if (config.proxy.http) {
           ),
           'forward': ($=>$
             .muxHTTP(() => $host).to($=>$.connect(() => $host))
-          )
+          ),
+          'forbidden': ($=>$
+            .replaceMessage(new Message({ status: 403 }))
+          ),
         }
       )
     )