---
title: "Network policy"
description: "Calico Enterprise Network Policy and Calico Enterprise Global Network Policy are the fundamental resources to secure workloads and hosts, and to adopt a zero trust security model."
product: "Calico Enterprise"
version: "3.21"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/network-policy/"
---

# Network policy

Writing network policies is how you restrict traffic to pods in your Kubernetes cluster. Calico Enterprise extends the standard `NetworkPolicy` object to provide advanced network policy features, such as policies that apply to all namespaces.

## Getting started

##### [Policy best practices](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-best-practices.md)

[Learn policy best practices for security, scalability, and performance.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-best-practices.md)

##### [Enable a default deny policy for Kubernetes pods](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/kubernetes-default-deny.md)

[Create a default deny network policy so pods that are missing policy are not allowed traffic until appropriate network policy is defined.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/kubernetes-default-deny.md)

##### [Get started with Calico network policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/calico-network-policy.md)

[Create your first Calico network policies. Shows the rich features using sample policies that extend native Kubernetes network policy.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/calico-network-policy.md)

##### [Get started with network sets](https://docs.tigera.io/calico-enterprise/3.21/network-policy/networksets.md)

[Learn the power of network sets and why you should create them.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/networksets.md)

##### [DNS policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/domain-based-policy.md)

[Use domain names to allow traffic to destinations outside of a cluster by their DNS names instead of by their IP addresses.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/domain-based-policy.md)

##### [Enable policy recommendations](https://docs.tigera.io/calico-enterprise/3.21/network-policy/recommendations/policy-recommendations.md)

[Enable continuous policy recommendations to secure unprotected namespaces or workloads.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/recommendations/policy-recommendations.md)

## Policy rules

##### [Basic rules](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/policy-rules-overview.md)

[Define network connectivity for Calico endpoints using policy rules and label selectors.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/policy-rules-overview.md)

##### [Use namespace rules in policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/namespace-policy.md)

[Use namespaces and namespace selectors in Calico network policy to group or separate resources. Use network policies to allow or deny traffic to/from pods that belong to specific namespaces.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/namespace-policy.md)

##### [Use service rules in policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/service-policy.md)

[Use Kubernetes Service names in policy rules.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/service-policy.md)

##### [Use service accounts rules in policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/service-accounts.md)

[Use Kubernetes service accounts in policies to validate cryptographic identities and/or manage RBAC controlled high-priority rules across teams.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/service-accounts.md)

##### [Use external IPs or networks rules in policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/external-ips-policy.md)

[Limit egress and ingress traffic using IP address either directly within Calico network policy or managed as Calico network sets.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/external-ips-policy.md)

##### [Use ICMP/ping rules in policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/icmp-ping.md)

[Control where ICMP/ping is used by creating a Calico network policy to allow and deny ICMP/ping messages for workloads and host endpoints.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/policy-rules/icmp-ping.md)

## Policy for hosts and VMs

##### [Protect hosts and VMs](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/protect-hosts.md)

[Create Calico Enterprise network policies to restrict traffic to/from hosts.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/protect-hosts.md)

##### [Protect Kubernetes nodes](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/kubernetes-nodes.md)

[Protect Kubernetes nodes with host endpoints managed by Calico Enterprise.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/kubernetes-nodes.md)

##### [Protect hosts tutorial](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/protect-hosts-tutorial.md)

[Learn how to secure incoming traffic from outside the cluster using Calico host endpoints with network policy, including allowing controlled access to specific Kubernetes services.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/protect-hosts-tutorial.md)

##### [Apply policy to forwarded traffic](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/host-forwarded-traffic.md)

[Apply Calico Enterprise network policy to traffic being forward by hosts acting as routers or NAT gateways.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/hosts/host-forwarded-traffic.md)

## Policy tiers

##### [Get started with policy tiers](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/tiered-policy.md)

[Understand how tiered policy works and supports microsegmentation.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/tiered-policy.md)

##### [Change allow-tigera tier behavior](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/allow-tigera.md)

[Understand how to change the behavior of the allow-tigera tier.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/allow-tigera.md)

##### [Network policy tutorial](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/policy-tutorial-ui.md)

[Covers the basics of Calico Enterprise network policy.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/policy-tutorial-ui.md)

##### [Configure RBAC for tiered policies](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/rbac-tiered-policies.md)

[Configure RBAC to control access to policies and tiers.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/rbac-tiered-policies.md)

## Policy for services

##### [Apply Calico Enterprise policy to Kubernetes node ports](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/services/kubernetes-node-ports.md)

[Restrict access to Kubernetes node ports using Calico Enterprise global network policy. Follow the steps to secure the host, the node ports, and the cluster.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/services/kubernetes-node-ports.md)

##### [Apply Calico Enterprise policy to services exposed externally as cluster IPs](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/services/services-cluster-ips.md)

[Expose Kubernetes service cluster IPs over BGP using Calico Enterprise, and restrict who can access them using Calico Enterprise network policy.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/beginners/services/services-cluster-ips.md)

## Policy for extreme traffic

##### [Enable extreme high-connection workloads](https://docs.tigera.io/calico-enterprise/3.21/network-policy/extreme-traffic/high-connection-workloads.md)

[Create a Calico network policy rule to bypass Linux conntrack for traffic to workloads that experience extremely large number of connections.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/extreme-traffic/high-connection-workloads.md)

##### [Defend against DoS attacks](https://docs.tigera.io/calico-enterprise/3.21/network-policy/extreme-traffic/defend-dos-attack.md)

[Define DoS mitigation rules in Calico Enterprise policy to quickly drop connections when under attack. Learn how rules use eBPF and XDP, including hardware offload when available.](https://docs.tigera.io/calico-enterprise/3.21/network-policy/extreme-traffic/defend-dos-attack.md)