--- title: "Calico Egress Gateway: Universal Firewall Integration for Kubernetes" source: "https://www.tigera.io/blog/calico-egress-gateway-universal-firewall-integration-for-kubernetes/" description: "The Calico Egress Gateway extends the scope of firewalls to Kubernetes, enabling them to manage traffic originating from a cluster." --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Calico Egress Gateway: Universal Firewall Integration for Kubernetes By [John Armstrong](https://www.tigera.io/blog/author/john-armstrong/) on May 27, 2020 • 3 min read New applications and workloads are constantly being added to [Kubernetes](http://kubernetes.io/) clusters. Those same apps need to securely communicate with resources outside the cluster behind a [firewall](http://en.wikipedia.org/wiki/Firewall_(computing)) or other control point. Firewalls require a consistent IP, but routable IPs are a limited resource that can be quickly depleted if applied to every service. With the Calico Egress Gateway, a new feature in [Calico Enterprise 3.0](https://www.tigera.io/blog/calico-enterprise-3-0-global-network-security-center-for-kubernetes/), existing firewalls and control points can now be used to securely manage access to infrastructure and services outside of the cluster. In addition, IT teams are now able to identify an application/workload in a Kubernetes namespace via the source IP. As organizations progress on their Kubernetes journey from pilot to production, they begin migrating existing applications into the cluster, which has merged with the greater IT environment. For the platform teams involved, this creates challenges because these apps will need to communicate to services outside of the cluster. - The Platform team will need to enable Kubernetes connectivity to infrastructure and services behind a firewall or to enable a [DLP solution](http://www.techradar.com/best/best-data-loss-prevention-service) or a monitoring solution like a [SIEM](http://en.wikipedia.org/wiki/Security_information_and_event_management) to associate packets to the intended applications. - The firewall will require a consistent IP to enable the service, and this becomes a significant pain-point. Why? Routable IPs are a limited resource that can be quickly depleted if applied to every service that needs one. This limitation can constrain the ability of the platform team to scale the cluster. The Calico Egress Gateway ingeniously solves these problems. First, it defines a static egress IP for SNAT on traffic leaving the cluster and applies it to a specific namespace. Then it designates one pod in a namespace as the egress pod and assigns a routable IP which is used specifically for egress traffic leaving the cluster. ![Diagram of Calico Egress Gateway routing traffic from a pod with a routable IP through a firewall to external services](/app/uploads/2020/05/Egress-Gateway-diagram-300x156.png) Instead of having all pods in a Kubernetes namespace be routable, a single pod in a namespace is designated as an egress pod.  Platform teams can continue to scale the cluster while preserving the limited number of routable IPs available by leveraging non-routable IPs for all other pod traffic within the cluster. The Calico Egress Gateway also extends the scope of firewalls to Kubernetes to manage traffic originating from a cluster.  You can now enforce egress policies for Kubernetes resources using your existing firewall infrastructure or other IP control point. A single firewall rule can be defined that allows all pods within a namespace to securely access resource(s) outside of the cluster, in effect, creating a “universal firewall”. The Calico Egress Gateway, along with other new capabilities in Calico Enterprise 3.0, is designed to streamline cluster management and enable you to more easily scale your Kubernetes environment. With the Calico Egress Gateway, you can securely connect to resources outside of the Kubernetes cluster while preserving the limited number of routable IPs. The platform team only has to manage one firewall rule instead of many, saving time and eliminating the burden of multiple firewall change requests to SecOps.  And beyond the cluster, enterprise monitoring systems can identify an application/workload in a Kubernetes namespace via its source IP. ————————————————- **[Free Online Training](https://www.tigera.io/events/)** Access Live and On-Demand Kubernetes Tutorials [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Solve Common Kubernetes Roadblocks and Advance Your Enterprise Adoption [Products](https://www.tigera.io/tags/products/) ## Related posts [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) [![AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/app/uploads/2026/08/AI-Red-Team-Agents-Automate-Attacks-on-your-AI-Agents.-Runtime-Policies-Automate-their-Defense.png)](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) #### [AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 24, 2026 The AI red teaming market grew up fast this year. OpenAI bought Promptfoo, Cisco and Microsoft shipped automated attack suites, and a seed-stage startup publicly compromised 50 of 55 live customer service bots. These platforms... [Read more](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/)