← Lessons

quiz vs the machine

Gold1480

System Design

Egress Gateway Control

Funneling outbound traffic through a controlled exit point for policy and auditing.

5 min read · core · beat Gold to climb

Controlling the Way Out

A mesh secures traffic between your services, but calls to external systems leave the mesh. An egress gateway is a dedicated exit node that all outbound traffic passes through, so you can govern what leaves.

Why Funnel Egress

  • Policy: allow calls only to an approved list of external hosts, blocking everything else.
  • Auditing: every external call flows through one place, giving a clear log of what your services reach.
  • Stable identity: external partners often whitelist by source IP. Routing egress through one gateway gives a predictable exit address.

Defense in Depth

The egress gateway pairs with a default deny stance. Without explicit permission, a workload cannot reach the internet at all. This limits the blast radius if a service is compromised, since exfiltration must pass the gateway and its policy.

The Cost

The gateway is an extra hop and a potential bottleneck, so it must be scaled and made highly available. In return you trade a little latency for a strong, auditable control point on everything leaving your system.

Key idea

An egress gateway funnels outbound traffic through one controlled exit so you can enforce allow lists, audit external calls, and present a stable source identity, trading a hop for control.

Check yourself

Answer to earn rating on the learn ladder.

1. What is the main purpose of an egress gateway?

2. Why does routing egress through one gateway help with partner whitelisting?

3. What stance pairs with an egress gateway for defense in depth?