--- title: "Calico Egress Gateway: Universal Firewall Integration for Kubernetes" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-egress-gateway-universal-firewall-integration-for-kubernetes/" description: "The Calico Egress Gateway extends the scope of firewalls to Kubernetes, enabling them to manage traffic originating from a cluster." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Calico Egress Gateway: Universal Firewall Integration for Kubernetes By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on May 27, 2020 • 3 min read New applications and workloads are constantly being added to [Kubernetes](http://kubernetes.io/) clusters. Those same apps need to securely communicate with resources outside the cluster behind a [firewall](http://en.wikipedia.org/wiki/Firewall_(computing)) or other control point. Firewalls require a consistent IP, but routable IPs are a limited resource that can be quickly depleted if applied to every service. With the Calico Egress Gateway, a new feature in [Calico Enterprise 3.0](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-enterprise-3-0-global-network-security-center-for-kubernetes/), existing firewalls and control points can now be used to securely manage access to infrastructure and services outside of the cluster. In addition, IT teams are now able to identify an application/workload in a Kubernetes namespace via the source IP. As organizations progress on their Kubernetes journey from pilot to production, they begin migrating existing applications into the cluster, which has merged with the greater IT environment. For the platform teams involved, this creates challenges because these apps will need to communicate to services outside of the cluster. - The Platform team will need to enable Kubernetes connectivity to infrastructure and services behind a firewall or to enable a [DLP solution](http://www.techradar.com/best/best-data-loss-prevention-service) or a monitoring solution like a [SIEM](http://en.wikipedia.org/wiki/Security_information_and_event_management) to associate packets to the intended applications. - The firewall will require a consistent IP to enable the service, and this becomes a significant pain-point. Why? Routable IPs are a limited resource that can be quickly depleted if applied to every service that needs one. This limitation can constrain the ability of the platform team to scale the cluster. The Calico Egress Gateway ingeniously solves these problems. First, it defines a static egress IP for SNAT on traffic leaving the cluster and applies it to a specific namespace. Then it designates one pod in a namespace as the egress pod and assigns a routable IP which is used specifically for egress traffic leaving the cluster. ![Diagram of Calico Egress Gateway routing traffic from a pod with a routable IP through a firewall to external services](/app/uploads/2020/05/Egress-Gateway-diagram-300x156.png) Instead of having all pods in a Kubernetes namespace be routable, a single pod in a namespace is designated as an egress pod.  Platform teams can continue to scale the cluster while preserving the limited number of routable IPs available by leveraging non-routable IPs for all other pod traffic within the cluster. The Calico Egress Gateway also extends the scope of firewalls to Kubernetes to manage traffic originating from a cluster.  You can now enforce egress policies for Kubernetes resources using your existing firewall infrastructure or other IP control point. A single firewall rule can be defined that allows all pods within a namespace to securely access resource(s) outside of the cluster, in effect, creating a “universal firewall”. The Calico Egress Gateway, along with other new capabilities in Calico Enterprise 3.0, is designed to streamline cluster management and enable you to more easily scale your Kubernetes environment. With the Calico Egress Gateway, you can securely connect to resources outside of the Kubernetes cluster while preserving the limited number of routable IPs. The platform team only has to manage one firewall rule instead of many, saving time and eliminating the burden of multiple firewall change requests to SecOps.  And beyond the cluster, enterprise monitoring systems can identify an application/workload in a Kubernetes namespace via its source IP. ————————————————- **[Free Online Training](https://wordpress-1075849-4005834.cloudwaysapps.com/events/)** Access Live and On-Demand Kubernetes Tutorials [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Solve Common Kubernetes Roadblocks and Advance Your Enterprise Adoption [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)