--- title: One thing I don't think enough Kubernetes engineers talk... description: Outbound pod traffic in Kubernetes is often overlooked compared to ingress. When a pod makes an external request, the IP seen by the external service depends... canonical: https://daily.dev/posts/one-thing-i-don-t-think-enough-kubernetes-engineers-talk-about-is-outbound-pod-traffic--fmehmqgqd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: One thing I don't think enough Kubernetes engineers talk about is outbound pod traffic. | daily.dev og:description: Outbound pod traffic in Kubernetes is often overlooked compared to ingress. When a pod makes an external request, the IP seen by the external service depends... og:url: https://daily.dev/posts/one-thing-i-don-t-think-enough-kubernetes-engineers-talk-about-is-outbound-pod-traffic--fmehmqgqd og:image: https://api.daily.dev/og/posts/FMEHMqGQd.png og:image:alt: One thing I don't think enough Kubernetes engineers talk about is outbound pod traffic. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # One thing I don't think enough Kubernetes engineers talk about is outbound pod traffic. **[DevOps & Platform Engineering Hub](https://daily.dev/sources/sanjay)** · [@divyansh30](https://daily.dev/divyansh30) · 1 min read · 7 upvotes · 2 comments ## Summary Outbound pod traffic in Kubernetes is often overlooked compared to ingress. When a pod makes an external request, the IP seen by the external service depends on how the cluster handles SNAT and egress. This matters for API whitelisting, firewall rules, and third-party integrations. The post references a practical article on how Civo Kubernetes handles outbound traffic and why all pods appear to share the same public IP. It opens a discussion on how different providers (EKS, GKE, AKS, Civo) handle egress, and whether teams use dedicated egress gateways or NAT Gateways in production. ## Content Most of us understand how traffic gets _into_ a Kubernetes cluster through Ingress or a LoadBalancer, but what happens when a pod makes an outbound request to an external API or database? Which IP does the external service actually see? That question becomes important when you're working with API whitelisting, third-party integrations, firewalls, or security policies. I recently came across a practical article that explains how Civo Kubernetes handles outbound pod traffic, SNAT, and why every pod in the cluster appears to use the same public IP for internet access. It also covers what you should (and shouldn't) whitelist when integrating with external services. It made me wonder how different Kubernetes providers handle egress networking. - Have you ever had issues with outbound IP whitelisting? - Do you use a dedicated egress gateway, NAT Gateway, or the default cluster behaviour? - Have you noticed differences between providers like EKS, GKE, AKS, or Civo? Here's the article if you'd like to read it: [https://www.kubeblogs.com/civo-kubernetes-where-does-your-pods-traffic-actually-go/](https://www.kubeblogs.com/civo-kubernetes-where-does-your-pods-traffic-actually-go/) I'm interested to hear how other teams solve this in production. ## Community discussion Top comments from developers on daily.dev. **@axtroz** · 1 upvotes > We had almost the inverse problem in production. > > For normal outbound traffic, our Pods would eventually be SNATed to the node IP. That is usually fine, and it is what most Kubernetes networking setups expect. > > In our case, it was wrong. > > We run a STUN server for TR-069 UDP Connection Requests behind a MetalLB BGP `LoadBalancer`. A CPE first sends a STUN binding to a specific `VIP:port`, creating a NAT mapping. When we later send the UDP Connection Request back, it must leave from that exact same `VIP:port`. > > If it leaves from the Pod IP or gets masqueraded to the node IP, the CPE’s NAT... ## Similar posts on daily.dev - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments - [Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh](https://daily.dev/posts/kubernetes-networking-explained-from-clusterip-to-cilium-service-mesh-rhwqkcwdn) · freeCodeCamp · 5 upvotes · 1 comments - [Understanding Kubernetes Networking](https://daily.dev/posts/understanding-kubernetes-networking-oooxha7or) · cilium · 22 upvotes · 1 comments - [AWS Stretches Elastic Kubernetes Service to Full Private Networking](https://daily.dev/posts/aws-stretches-elastic-kubernetes-service-to-full-private-networking-ejtb3vk9q) · Cloud Native Now · 0 upvotes · 0 comments - [What Is Kubernetes Networking?](https://daily.dev/posts/what-is-kubernetes-networking--1qghzles9) · Isovalent · 15 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/one-thing-i-don-t-think-enough-kubernetes-engineers-talk-about-is-outbound-pod-traffic--fmehmqgqd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/one-thing-i-don-t-think-enough-kubernetes-engineers-talk-about-is-outbound-pod-traffic--fmehmqgqd","headline":"One thing I don't think enough Kubernetes engineers talk about is outbound pod traffic.","text":"Outbound pod traffic in Kubernetes is often overlooked compared to ingress. When a pod makes an external request, the IP seen by the external service depends on how the cluster handles SNAT and egress. This matters for API whitelisting, firewall rules, and third-party integrations. The post references a practical article on how Civo Kubernetes handles outbound traffic and why all pods appear to share the same public IP. It opens a discussion on how different providers (EKS, GKE, AKS, Civo) handle egress, and whether teams use dedicated egress gateways or NAT Gateways in production.","url":"https://daily.dev/posts/one-thing-i-don-t-think-enough-kubernetes-engineers-talk-about-is-outbound-pod-traffic--fmehmqgqd","datePublished":"2026-07-30T03:47:18.202Z","dateModified":"2026-09-13T21:02:47.912Z","author":{"@type":"Person","name":"Divyansh","url":"https://daily.dev/divyansh30","image":"https://media.daily.dev/image/upload/s--f9lbkpFv--/f_auto/v1744873189/avatars/avatar_JMQ4qarKTe7zPurSPRrzM","description":"Aspiring engineer with an interest in AI, tech and DevOps :)","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":1050}},"image":"https://media.daily.dev/image/upload/s--axVcv10L--/f_auto/v1785383238/posts/FMEHMqGQd?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"comment":[{"@type":"Comment","text":"We had almost the inverse problem in production.\nFor normal outbound traffic, our Pods would eventually be SNATed to the node IP. That is usually fine, and it is what most Kubernetes networking setups expect.\nIn our case, it was wrong.\nWe run a STUN server for TR-069 UDP Connection Requests behind a MetalLB BGP LoadBalancer. A CPE first sends a STUN binding to a specific VIP:port, creating a NAT mapping. When we later send the UDP Connection Request back, it must leave from that exact same VIP:port.\nIf it leaves from the Pod IP or gets masqueraded to the node IP, the CPE’s NAT simply drops it.\nWe looked at the usual egress gateway approaches, but they were much broader than what we needed and often involved pinning workloads, routing through dedicated gateway nodes, or changing the deployment model.\nSo we built a small controller called Atlas.\nIt watches selected Pods and their LoadBalancer Service, then installs a narrow nftables SNAT rule on every node running one of those Pods, just before kube-proxy. The rule matches only the Pod IP and the STUN UDP source port, rewrites the source address to the LoadBalancer VIP, and preserves the port.\nThat lets us keep the STUN server as a normal horizontally scalable Deployment behind MetalLB ECMP, without a dedicated egress gateway or forced Pod placement.\nVery specific problem, very specific solution. We deliberately did not try to build a universal Kubernetes egress platform around it.","datePublished":"2026-07-30T08:26:34.903Z","url":"https://daily.dev/posts/FMEHMqGQd#c-2OFEAf7U8","author":{"@type":"Person","name":"Iskren Hadzhinedev","url":"https://daily.dev/axtroz","image":"https://media.daily.dev/image/upload/s--C19l3DZF--/f_auto/v1751873071/avatars/avatar_lO9k8VXJCvNZH1yCv4kj6?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/sanjay","name":"DevOps & Platform Engineering Hub"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps & Platform Engineering Hub","item":"https://daily.dev/squads/sanjay"},{"@type":"ListItem","position":3,"name":"One thing I don't think enough Kubernetes engineers talk about is outbound pod traffic."}]} ```