# Network isolation requirement

**URL:** <https://discuss.kubernetes.io/t/network-isolation-requirement/12202>\
**Category:** General Discussions\
**Created:** [August 9, 2020, 5:34am UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202 "2020-08-09T05:34:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Febi](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Febi](https://discuss.kubernetes.io/u/Febi)\
**Post date:** [August 9, 2020, 5:34am UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202/1 "2020-08-09T05:34:57Z")

</div>

### Cluster information:

Kubernetes version: 1.18.3  
Cloud being used: bare-metal  
Installation method: Kubernetes the hard way  
Host OS: Centos 7  
CNI and version: 0.8.6  
CRI and version: docker-ce 19

Dear all I need a help, I have two networks (internal and external) network on my kubernetes worker nodes. I am using nodeport service to expose the application outside of the cluster. But i see that my node port services can be accessed from internal and external network IPs of the worker nodes as the kube-proxy expose on 0.0.0.0 . This will create a problem for me as some of my applications meant to run only on internal network alone and some are only on external network. Any idea how i can overcome this situation.

---

<div class="post-metadata">

**Author:** ![tej-singh-rana](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tej-singh-rana/32/5921_2.png) [@tej-singh-rana](https://discuss.kubernetes.io/u/tej-singh-rana)\
**Post date:** [August 10, 2020, 1:47am UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202/2 "2020-08-10T01:47:26Z")

</div>

I think you need to take a help of network policy. Kubernetes not bound to any pods to communicate to each other in any namespaces.

---

<div class="post-metadata">

**Author:** ![Febi](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Febi](https://discuss.kubernetes.io/u/Febi)\
**Post date:** [August 10, 2020, 3:47am UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202/3 "2020-08-10T03:47:12Z")

</div>

I am new to this please advise further how I can implement the network policy.

I just found this link, i am not sure this is the correct one [Network Policies | Kubernetes](https://kubernetes.io/docs/concepts/services-networking/network-policies/)

I verified further and i see this is applicable only for pod-to-pod  
Other than network policy is there any way to expose the service based on the worker node eth0 or eth1 IP address. Kindly advise.

---

<div class="post-metadata">

**Author:** ![tej-singh-rana](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tej-singh-rana/32/5921_2.png) [@tej-singh-rana](https://discuss.kubernetes.io/u/tej-singh-rana)\
**Post date:** [August 10, 2020, 10:02am UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202/4 "2020-08-10T10:02:39Z")

</div>

I haven’t tried this yet. So i can’t help it. Maybe other experts will share their thoughts on this.

---

<div class="post-metadata">

**Author:** ![Febi](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Febi](https://discuss.kubernetes.io/u/Febi)\
**Post date:** [August 13, 2020, 3:46pm UTC](https://discuss.kubernetes.io/t/network-isolation-requirement/12202/5 "2020-08-13T15:46:57Z")

</div>

Network policy helped me. I have implemented calico and denied all traffic to the cluster and then i opened the traffic one by one as required on a specific network. @tej-singh-rana Thank you so much for the advise.