---
title: "Network policy"
description: "Secure Kubernetes workloads and hosts with Calico Open Source network policy — Calico NetworkPolicy and GlobalNetworkPolicy resources for adopting a zero-trust model."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico/latest/network-policy/"
---

# Network policy

Writing network policies is how you restrict traffic to pods in your Kubernetes cluster. Calico extends the standard `NetworkPolicy` object to provide advanced network policy features, such as policies that apply to all namespaces.

## Getting started

##### [Adopt a zero trust network model for security](https://docs.tigera.io/calico/latest/network-policy/adopt-zero-trust.md)

[Adopt a zero-trust network model for Kubernetes workloads and hosts using Calico Open Source — five requirements for controlling network access in cloud-native environments.](https://docs.tigera.io/calico/latest/network-policy/adopt-zero-trust.md)

##### [Get started with Calico network policy](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md)

[Write your first Calico Open Source NetworkPolicy — sample policies that exercise the rich rule features that extend Kubernetes NetworkPolicy.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md)

##### [Calico policy tutorial](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial.md)

[Step-by-step tutorial for advanced Calico Open Source policy patterns — namespace scoping, allow-all, deny-all, and ingress and egress controls.](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial.md)

##### [Get started with Kubernetes network policy](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-network-policy.md)

[Reference for Kubernetes NetworkPolicy syntax, rules, and features when used with the Calico Open Source enforcement engine.](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-network-policy.md)

##### [Kubernetes policy, demo](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-demo.md)

[Interactive demo for a Calico Open Source cluster that visualizes how Kubernetes NetworkPolicy allows and denies connections between pods.](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-demo.md)

##### [Kubernetes policy, basic tutorial](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic.md)

[Apply your first Kubernetes NetworkPolicy in a Calico Open Source cluster to restrict ingress and egress traffic to and from pods.](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic.md)

##### [Kubernetes policy, advanced tutorial](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced.md)

[Write more advanced Kubernetes NetworkPolicy resources in a Calico Open Source cluster — namespace scoping, allow-all, and deny-all variants.](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced.md)

##### [Enable a default deny policy for Kubernetes pods](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-default-deny.md)

[Apply a default-deny network policy in a Calico Open Source cluster so unprotected pods are denied traffic until explicit policy is written.](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-default-deny.md)

## Policy rules

##### [Basic rules](https://docs.tigera.io/calico/latest/network-policy/policy-rules/policy-rules-overview.md)

[How to write policy rules in Calico Open Source — label selectors, source and destination match criteria, and rule actions.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/policy-rules-overview.md)

##### [Use namespace rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/namespace-policy.md)

[Group or separate workloads in Calico Open Source policy using namespaces and namespace selectors so policies apply only to specified namespaces.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/namespace-policy.md)

##### [Use service rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-policy.md)

[Match on Kubernetes Service names in Calico Open Source policy rules instead of specific pod selectors.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-policy.md)

##### [Use service accounts rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-accounts.md)

[Match on Kubernetes service accounts in Calico Open Source policy rules to validate workload identity and apply RBAC-controlled rules.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-accounts.md)

##### [Use external IPs or networks rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/external-ips-policy.md)

[Restrict egress and ingress to specific IP ranges in Calico Open Source policy, either inline or via reusable network sets.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/external-ips-policy.md)

##### [Use ICMP/ping rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/icmp-ping.md)

[Allow or deny ICMP and ping traffic for Calico Open Source workloads and host endpoints using policy rules.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/icmp-ping.md)

## Policy for hosts and VMs

##### [Protect hosts and VMs](https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts.md)

[Protect Kubernetes hosts and bare-metal nodes with Calico Open Source policy by writing rules that target host endpoints.](https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts.md)

##### [Protect Kubernetes nodes](https://docs.tigera.io/calico/latest/network-policy/hosts/kubernetes-nodes.md)

[Protect Kubernetes node interfaces with Calico Open Source host endpoints to extend network policy to the node itself.](https://docs.tigera.io/calico/latest/network-policy/hosts/kubernetes-nodes.md)

##### [Protect hosts tutorial](https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts-tutorial.md)

[Tutorial for protecting hosts in a Calico Open Source cluster — register host endpoints, write rules, and allow controlled access to specific Kubernetes services.](https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts-tutorial.md)

##### [Apply policy to forwarded traffic](https://docs.tigera.io/calico/latest/network-policy/hosts/host-forwarded-traffic.md)

[Apply Calico Open Source network policy to traffic forwarded through hosts acting as routers or NAT gateways.](https://docs.tigera.io/calico/latest/network-policy/hosts/host-forwarded-traffic.md)

## Policy for services

##### [Apply Calico policy to Kubernetes node ports](https://docs.tigera.io/calico/latest/network-policy/services/kubernetes-node-ports.md)

[Restrict access to Kubernetes NodePort services using Calico Open Source GlobalNetworkPolicy at the host endpoint.](https://docs.tigera.io/calico/latest/network-policy/services/kubernetes-node-ports.md)

##### [Apply Calico policy to services exposed externally as cluster IPs](https://docs.tigera.io/calico/latest/network-policy/services/services-cluster-ips.md)

[Expose Kubernetes Service ClusterIPs over BGP using Calico Open Source and restrict who can reach them with network policy.](https://docs.tigera.io/calico/latest/network-policy/services/services-cluster-ips.md)

## Policy for Istio

##### [Enforce Calico network policy for Istio service mesh](https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy.md)

[Apply Calico Open Source network policy to Istio service-mesh traffic, including matching on HTTP methods and paths.](https://docs.tigera.io/calico/latest/network-policy/istio/app-layer-policy.md)

##### [Use HTTP methods and paths in policy rules](https://docs.tigera.io/calico/latest/network-policy/istio/http-methods.md)

[Restrict ingress traffic to Istio-enabled apps by matching HTTP methods or paths in a Calico Open Source network policy.](https://docs.tigera.io/calico/latest/network-policy/istio/http-methods.md)

##### [Enforce Calico network policy using Istio (tutorial)](https://docs.tigera.io/calico/latest/network-policy/istio/enforce-policy-istio.md)

[Use Calico Open Source with Istio to apply fine-grained access control at both the network layer and inside the service mesh.](https://docs.tigera.io/calico/latest/network-policy/istio/enforce-policy-istio.md)

## Securing component communications

##### [Encrypt in-cluster pod traffic](https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic.md)

[Turn on WireGuard encryption between pods on a Calico Open Source cluster for state-of-the-art cryptographic protection of in-cluster traffic.](https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic.md)

##### [Configure encryption and authentication to secure Calico components](https://docs.tigera.io/calico/latest/network-policy/comms/crypto-auth.md)

[Turn on TLS authentication and encryption between Calico Open Source components using a custom certificate authority.](https://docs.tigera.io/calico/latest/network-policy/comms/crypto-auth.md)

##### [Schedule Typha for scaling to well-known nodes](https://docs.tigera.io/calico/latest/network-policy/comms/reduce-nodes.md)

[Configure the TCP port used by Typha in a Calico Open Source cluster to reduce datastore load on large clusters.](https://docs.tigera.io/calico/latest/network-policy/comms/reduce-nodes.md)

##### [Secure Calico Prometheus endpoints](https://docs.tigera.io/calico/latest/network-policy/comms/secure-metrics.md)

[Restrict access to Calico Open Source metric endpoints using network policy.](https://docs.tigera.io/calico/latest/network-policy/comms/secure-metrics.md)

##### [Secure BGP sessions](https://docs.tigera.io/calico/latest/network-policy/comms/secure-bgp.md)

[Configure BGP authentication passwords for Calico Open Source so attackers cannot inject false routing information.](https://docs.tigera.io/calico/latest/network-policy/comms/secure-bgp.md)

## Network policy options with Calico Cloud

##### [Policy recommendations](https://docs.tigera.io/calico-cloud/network-policy/recommendations/policy-recommendations.md)

[Enable continuous policy recommendations to secure unprotected namespaces or workloads.](https://docs.tigera.io/calico-cloud/network-policy/recommendations/policy-recommendations.md)

[Cloud](https://docs.tigera.io/calico-cloud/network-policy/recommendations/policy-recommendations.md)

##### [DNS policy](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md)

[Use domain names to allow traffic to destinations outside of a cluster by their DNS names instead of by their IP addresses.](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md)

[Cloud](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md)