--- title: "Protecting the Entire Flock" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/protecting-the-entire-flock-b50ed76cb33b/" description: "Network services at the Kubernetes cluster edge need love and protection too. This blog explains how to securely access services outside the cluster." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Protecting the Entire Flock By [Christopher Liljenstolpe](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/liljenstolpe/) on Oct 11, 2017 • 4 min read ## Services at the cluster edge need love and protection too By now, you’re probably familiar with network policy as a flexible, dynamic way to enforce security on your Kubernetes workloads. Most of the discussion to date, however, has focused on intra-cluster traffic: what about access to services from outside the cluster, i.e. to external service interfaces? For access to services from within the cluster (say a pod querying a service for a piece of data), network policy will provide the same level of protection as it does for pod-to-pod traffic. However, external connectivity to a service is subtly different than intra-cluster connectivity to the same service. …external connectivity to a service is subtly different than intra-cluster connectivity to the same service. In Kubernetes, generally more than one pod will be offering the same service, either due to scaling and resilience requirements or rolling upgrades. Rather than trying to advertise all of those pods to a service’s client (either in the cluster or external to it), Kubernetes defines a single IP address for each service. That service address acts as an *anchor* for the service, which can then be advertised to both internal and external clients, using techniques such as DNS. The Kubernetes environment then needs to provide a way for traffic that is directed at one of those service IPs to be routed to one of the actual pods providing that service. While there are many options to accomplish this, including the new service mesh offerings, such as Istio, the default mechanism in Kubernetes is *kube-proxy*, and the standard mechanism that kube-proxy uses to expose services for external access is *node-port*. The node-port mechanism maps the service to the local node’s IP address and a well known port. Kube-proxy implements node-port by changing the network configuration on each host such that traffic that is destined for a specific service IP address will be *re-written*so that the new destination of the packet is one of the working pods offering that service. Kube-proxy then keeps those rules updated as services are defined or destroyed, and as the pods offering a given service are created or destroyed. Since services are the capabilities you are offering via your application, it stands to reason that those services should be just as protected, irrespective of the mechanism of access… The key mechanism that is used is something called Destination Network Address Translation, otherwise known as DNAT. Now, NAT is convenient — but there is no such thing as a free lunch. In this case, since it changes the addresses in the packet, it can conflict with Kubernetes network security policy, depending on how a given network security policy plug-in works. Specifically, many Kubernetes network security policy plugins (including the most popular, Calico) rely on the source and destination addresses on a packet to enforce network policy. However, due to the way that DNAT is implemented in the Linux kernel, the destination address is changed *before* the Kubernetes network policy plugin has a chance to evaluate the packet. This means that it is difficult, if not impossible to write a policy that filters traffic destined to a service that is externally exposed using the node-port method. Since services are the capabilities you are offering via your application, it stands to reason that those services should be just as protected, irrespective of the mechanism of access (intra-cluster or external), if not more so, than the individual pods. So, how do we do that? The upshot is that, using Calico for network policy, a rule can now apply to service access from outside the cluster, as well as a normal intra-cluster traffic.   ## The kitten to the rescue Project Calico supports the protection of externally-facing services like this by allowing you to apply policies to the node’s host interface, which all external access will come in from. In order to make sure that the DNAT processing applied by kube-proxy does not interfere with the enforcement of those policies, you’ll want to enable the *pre-DNAT* option, introduced in the Calico 2.4 release. The upshot is that, using Calico for network policy, a rule can now apply to service access from outside the cluster, as well as a normal intra-cluster traffic. Pretty cool! For further information on this, and details as to how to use this new feature, please refer to the Pre-DNAT documentation, which can be found [here](http://docs.projectcalico.org/v2.4/getting-started/bare-metal/bare-metal#pre-dnat-policy), and, as always, let us know your thoughts and questions. [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Project Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/project-calico/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/What-is-new-in-Calico-winter-2026.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 4, 2026 AI Powered Intelligence, Unified Traffic Observability and Scalable Infrastructure Management As anyone managing one or more Kubernetes clusters knows by now, scaling can introduce an exponentially growing number of problems. The sheer volume of metrics,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/)