How to fix NetworkPolicy blocking egress, connection timeout, access denied in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 165 views

Egress NetworkPolicy rules block pod outbound traffic. Fix by reviewing policy selectors, adding proper egress rules for DNS and external services.

Quick fix

Fixes EGRESS_BLOCKED

kubectl get networkpolicies -n <namespace>
kubectl describe networkpolicy -n <namespace> <policy-name>
  1. Check NetworkPolicies affecting pod
  2. Allow DNS egress
  3. Allow external traffic
  4. Test connectivity
kubernetes — error
kubectl get networkpolicies -n <namespace>
kubectl describe networkpolicy -n <namespace> <policy-name>
NetworkPolicy blocking egress, connection timeout, access denied

What this error means

NetworkPolicies can isolate pods by blocking ingress and egress traffic. When egress is blocked, pods can't reach external services, databases, or APIs.

Typical symptoms

  • Pods can't reach external services
  • DNS resolution fails
  • External API calls timeout
  • Database connections fail
  • No egress policy defined but traffic blocked

Common causes

  1. NetworkPolicy selects pod but has no egress rules
  2. Egress rules don't allow DNS (port 53)
  3. Egress rules don't cover destination
  4. Network plugin doesn't support policies

How to fix "NetworkPolicy blocking egress, connection timeout, access denied"

1Check NetworkPolicies affecting pod
bash
kubectl get networkpolicies -n <namespace>
kubectl describe networkpolicy -n <namespace> <policy-name>
2Allow DNS egress
yaml
egress:
- to:
  - namespaceSelector: {}
    podSelector:
      matchLabels:
        k8s-app: kube-dns
  ports:
  - protocol: UDP
    port: 53
  - protocol: TCP
    port: 53
3Allow external traffic
yaml
egress:
- to:
  - ipBlock:
      cidr: 0.0.0.0/0
      except:
      - 169.254.169.254/32
  ports:
  - protocol: TCP
    port: 443
4Test connectivity
bash
kubectl run test --rm -it --image=alpine -- wget https://example.com
5Debug with network tools
bash
kubectl run debug --rm -it --image=nicolaka/netshoot -- sh
# Inside: curl, wget, dig, etc.

Advanced notes

Always allow DNS in egress policies. Deny rules are easier than allow rules.

Frequently asked questions

What does "EGRESS_BLOCKED" mean?
NetworkPolicies can isolate pods by blocking ingress and egress traffic. When egress is blocked, pods can't reach external services, databases, or APIs.
How do I fix "EGRESS_BLOCKED"?
Egress NetworkPolicy rules block pod outbound traffic. Fix by reviewing policy selectors, adding proper egress rules for DNS and external services.
What causes "EGRESS_BLOCKED"?
NetworkPolicy selects pod but has no egress rules Egress rules don't allow DNS (port 53) Egress rules don't cover destination
Is the "EGRESS_BLOCKED" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading