---
title: "Policy rules"
description: "Control traffic to and from endpoints using Calico Open Source network policy rules — selectors, actions, and egress/ingress directions."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico/latest/network-policy/policy-rules/"
---

# Policy rules

## [📄️Basic rules](https://docs.tigera.io/calico/latest/network-policy/policy-rules/policy-rules-overview.md)

[How to write policy rules in Calico Open Source — label selectors, source and destination match criteria, and rule actions.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/policy-rules-overview.md)

## [📄️Use namespace rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/namespace-policy.md)

[Group or separate workloads in Calico Open Source policy using namespaces and namespace selectors so policies apply only to specified namespaces.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/namespace-policy.md)

## [📄️Use service rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-policy.md)

[Match on Kubernetes Service names in Calico Open Source policy rules instead of specific pod selectors.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-policy.md)

## [📄️Use service accounts rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-accounts.md)

[Match on Kubernetes service accounts in Calico Open Source policy rules to validate workload identity and apply RBAC-controlled rules.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/service-accounts.md)

## [📄️Use external IPs or networks rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/external-ips-policy.md)

[Restrict egress and ingress to specific IP ranges in Calico Open Source policy, either inline or via reusable network sets.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/external-ips-policy.md)

## [📄️Use ICMP/ping rules in policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/icmp-ping.md)

[Allow or deny ICMP and ping traffic for Calico Open Source workloads and host endpoints using policy rules.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/icmp-ping.md)

## [📄️Use log rules to test network policy](https://docs.tigera.io/calico/latest/network-policy/policy-rules/log-rules.md)

[Add Log actions to Calico Open Source policy rules to debug which rules are matching traffic at runtime.](https://docs.tigera.io/calico/latest/network-policy/policy-rules/log-rules.md)