A gateway device disposed within a managed network may be communicatively coupled to a computational instance of a remote network management platform. The gateway device may also be configured with a list of network addresses assigned to the managed network, and configured to: receive network traffic from computing devices on the managed network, compare source addresses of the network traffic to the network addresses in the list, discard a first unit of the network traffic that has source addresses that are specified in the list, and for a second unit of the network traffic with source addresses that are not specified by the list, (i) encrypt, as a whole, payloads of each packet of the second unit of the network traffic, and (ii) transmit the encrypted packets from the gateway device to the computational instance. Network addresses in the list may be provided by a gateway controller device.