<p>I am puzzled about this behaviour of global network policies. Take the following.</p>
<pre><code>apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: allow-dns-for-all-policy
spec:
  namespaceSelector: has(projectcalico.org/name) &amp;&amp; projectcalico.org/name not in {&quot;kube-system&quot;, &quot;calico-system&quot;}
  order: 0
  egress:
  # allow all namespaces to communicate to DNS pods
  - action: Allow
    protocol: UDP
    destination:
      ports:
      - 53
  ingress:
  - action: Allow
</code></pre>
<p>When i do a wget from one pod to another in a &quot;test&quot; namespace it can apparently resolve dns but doesn't return the package:</p>
<pre><code>Resolving nginx-test (nginx-test)... 10.233.8.253
Connecting to nginx-test (nginx-test)|10.233.8.253|:80... failed: Connection timed out.
</code></pre>
<p>There is no other policy on the cluster, especially no default-deny policy. I also tested without namespaceSelector. Only when i add a second <code>Allow</code> Rule that matches *, or when i delete the whole policy i get a successful return.</p>
<p>Why is that? I would have expected that this policy has no effect on communication since there is no DENY rule present.</p>

<p>Well turns out if there is at least one ingress/egress rule matching on a ressource calico automatically adds a default deny rule to ingress/egress.</p>
<blockquote>
<p>If no network policies apply to a pod, then all traffic to/from that pod is allowed.
If one or more network policies apply to a pod containing ingress rules, then only the ingress traffic specifically allowed by those policies is allowed.
If one or more network policies apply to a pod containing egress rules, then only the egress traffic specifically allowed by those policies is allowed.</p>
</blockquote>
<p><a href="https://docs.projectcalico.org/security/calico-network-policy" rel="nofollow noreferrer">https://docs.projectcalico.org/security/calico-network-policy</a></p>
