diff --git a/web/CHANGELOG.md b/web/CHANGELOG.md
index 587650a..3523043 100644
--- a/web/CHANGELOG.md
+++ b/web/CHANGELOG.md
@@ -3,3 +3,6 @@
 
 # v1.1.0 -- 20210915
   - enable use of ingress_networks and egress_networks for pre-defined port list
+
+# v1.1.1 -- 20210929
+  - fix default egress to be 0/0 for web submodule
diff --git a/web/ports.tf b/web/ports.tf
index ab8a40e..38aea85 100644
--- a/web/ports.tf
+++ b/web/ports.tf
@@ -20,8 +20,10 @@ locals {
     [8443, 8443, "tcp", "Tomcat-https", local.n_census, ["external"]],
   ]
 
-  ingress_networks = var.ingress_networks
-  egress_networks  = var.egress_networks
+  #  ingress_networks = var.ingress_networks
+  ingress_networks = []
+  #  egress_networks  = var.egress_networks
+  egress_networks = local.n_all
 
   # these are ignored
   ingress_sg = var.ingress_security_groups
diff --git a/web/version.tf b/web/version.tf
index 9c489cd..a6a90ee 100644
--- a/web/version.tf
+++ b/web/version.tf
@@ -1,3 +1,3 @@
 locals {
-  _module_version = "1.1.0"
+  _module_version = "1.1.1"
 }