<commit_before>---
title: External Connectivity
---
Calico creates a routed network on which your containers look like normal IP
speakers.  You can connect to them from a host in your cluster (assuming the
network policy you've assigned allows this) using their IP address.

In order to access your containers from locations other than your cluster of
hosts, you will need to configure IP routing.

A common scenario is for your container hosts to be on their own isolated layer
2 network, like a rack in your server room or an entire data center.  Access to
that network is via a router, which also is the default router for all the
container hosts.

![hosts-on-layer-2-network]({{site.baseurl}}/images/hosts-on-layer-2-network.png)

If this describes your infrastructure, you'll need to configure that router to
communicate with the Calico-enabled hosts over BGP.  If you have a small number
of hosts, you can configure BGP sessions between your router and each
Calico-enabled host.

The Calico network defaults to AS number 64511, which is in the private range,
and therefore will not conflict with anything else on the public internet.
However, if your organization is already using AS number 64511, you should
change the Calico cluster to use a different private AS number.  See the
[BGP Configuration tutorial]({{site.baseurl}}/{{page.version}}/using-calico/configuration/bgp) for how to do this.

Then, on one of your Calico-enabled hosts, configure the session to your
router.  Let's say your router's IP address is 192.168.127.12 and it is in AS
number 64567:

    $ calicoctl bgp peer add 192.168.127.12 as 64567

You only need to do this on one Calico-enabled host; you have configured a
global BGP peer and every host in your cluster will attempt to peer with it
(see the [BGP Configuration tutorial]({{site.baseurl}}/{{page.version}}/using-calico/configuration/bgp) for more detail).

Lastly, you'll need to configure your router.  Consult your router's
configuration guide for the exact steps, but generally speaking, you'll need to

 1. enable BGP if it hasn't already been enabled
 2. configure each Calico-enabled host as a BGP peer
 3. announce the range of IP addresses used by your containers to the rest of your network

If you have a L3 routed fabric or some other scenario not covered by the above,
detailed datacenter networking recommendations are given in the main
[Project Calico documentation]({{site.baseurl}}/{{page.version}}/reference/private-cloud/l3-interconnect-fabric).
We'd also encourage you to [get in touch](http://www.projectcalico.org/contact/)
to discuss your environment.<commit_msg>Rewrite and simplify external connectivity document<commit_after>---
title: External Connectivity
---
Calico creates a routed network on which your containers look like normal IP
speakers. You can connect to them from a host in your cluster (assuming the
network policy you've assigned allows this) using their IP address.

This document discusses connectivity between Calico endpoints and hosts outside
the cluster.

## Outbound connectivity

Outbound connectivity refers to connections originating from Calico endpoints
to destinations outside the cluster.

The easiest way to get outbound connectivity is to turn on NAT Outgoing on all
Calico pools you want to be able to access the internet.

```shell
calicoctl pool show
# For each pool that needs connectivity:
calicoctl pool add 192.168.0.0/16 --nat-outgoing [--ipip if needed]
```

Please note that many solutions for inbound connectivity will also provide
outbound connectivity.

## Inbound connectivity

Inbound connectivity refers to connections to Calico endpoints originating from
outside the cluster.

There are two main approaches: BGP peering into your network infrastructure, or
using orchestrator specific options.

Remember to configure your network policy to allow traffic from the internet!

### BGP peering

This requires access to BGP capable switches or routers in front of your Calico
cluster.

In general, this will involve peering the nodes in your Calico cluster with BGP
capable switches, which act as the gateway to reach Calico endpoints in the
cluster from outside.

A common scenario is for your container hosts to be on their own isolated layer
2 network, like a rack in your server room or an entire data center.  Access to
that network is via a router, which also is the default router for all the
container hosts.

![hosts-on-layer-2-network]({{site.baseurl}}/images/hosts-on-layer-2-network.png)

See the [BGP peering document]({{site.baseurl}}/{{page.version}}/using-calico/configuration/bgp)
for information on how to set up the Calico node sides of the sessions.
Consult the documentation for your BGP capable switch/router to set up the
switch sides of the sessions.

If you have a small number of hosts, you can configure BGP sessions between your router and each Calico-enabled host. With many hosts, you may wish to use a
route reflector or set up a Layer 3 topology.

There's further advice on network topologies in the [private cloud reference documentation]({{site.baseurl}}/{{page.version}}/reference/private-cloud).
We'd also encourage you to [get in touch](http://www.projectcalico.org/contact/)
to discuss your environment.

### Orchestrator specific

Calico supports a number of orchestrator specific options for inbound
connectivity, such as Kubernetes service IPs, or OpenStack floating IPs.

Consult the [documentation for your orchestrator]({{site.baseurl}}/{{page.version}}/getting-started) for more
information.
{'fraction_non_alphanumeric': 0.05842048323115759, 'fraction_numerical': 0.01153984853948792, 'mean_word_length': 4.660204081632653, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 3, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1680845', 'n_tokens_mistral': 1488, 'n_tokens_neox': 1361, 'n_words': 776}