# Using NetworkPolicy To Block Certain Egress Target

**URL:** <https://discuss.kubernetes.io/t/using-networkpolicy-to-block-certain-egress-target/19288>\
**Category:** General Discussions\
**Tags:** network\
**Created:** [March 9, 2022, 1:09am UTC](https://discuss.kubernetes.io/t/using-networkpolicy-to-block-certain-egress-target/19288 "2022-03-09T01:09:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![linixtest](https://avatars.discourse-cdn.com/v4/letter/l/ebca7d/32.png) [@linixtest](https://discuss.kubernetes.io/u/linixtest)\
**Post date:** [March 9, 2022, 1:09am UTC](https://discuss.kubernetes.io/t/using-networkpolicy-to-block-certain-egress-target/19288/1 "2022-03-09T01:09:47Z")

</div>

Can I use Egress type NetworkPolicy to block certain CIDR ranges but allow all other egress traffic? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![archyufa](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/archyufa/32/5060_2.png) [@archyufa](https://discuss.kubernetes.io/u/archyufa)\
**Post date:** [March 16, 2022, 4:07pm UTC](https://discuss.kubernetes.io/t/using-networkpolicy-to-block-certain-egress-target/19288/2 "2022-03-16T16:07:13Z")

</div>

Short Answer: K8s Network Policy `Deny` policy is not available today on Kubernetes, however there alternatives (Cilium or Calico APIs)

Detailed answer:  
**Reference in K8s Net Policy Docs:** Limitations: The ability to explicitly deny policies (currently the model for NetworkPolicies are deny by default, with only the ability to add allow rules). **Alternatives to K8s Network policy could be:**

a). Using `Deny` with Calico Network Policy - [Use external IPs or networks rules in policy](https://projectcalico.docs.tigera.io/security/external-ips-policy) (Cons: Proprietary APIs, may require license)

b). Using `Deny` with Cilium Networking Policy - [Layer 3 Examples — Cilium 1.11.2 documentation](https://docs.cilium.io/en/v1.11/policy/language/#deny-policies) (require Installation of Cilium CNI)

NB: If you running on Managed K8s Clusters like GKE you can use Dataplane v2 which us based on Cilium. For EKS or AKS follow Cilium docs, however in this case CNI will not be managed

---

<div class="post-metadata">

**Author:** ![tej-singh-rana](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tej-singh-rana/32/5921_2.png) [@tej-singh-rana](https://discuss.kubernetes.io/u/tej-singh-rana)\
**Post date:** [April 8, 2022, 1:16pm UTC](https://discuss.kubernetes.io/t/using-networkpolicy-to-block-certain-egress-target/19288/3 "2022-04-08T13:16:13Z")

</div>

Hi, @linixtest  
You can explore network policies from the link below: -

> **[Network Policy Editor for Kubernetes](https://editor.cilium.io/)**
>
> editor.cilium.io makes it easy to build, visualize, and make sense of Network Policies, which can then be downloaded as YAML and run in any Kubernetes cluster with a Network Policy-aware CNI.