> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Disable SNAT for Kubernetes Workloads

> Aviatrix DCF requires SNAT to be disabled on Kubernetes worker nodes so pod source IP addresses are preserved across the Aviatrix data plane. This page covers EKS, AKS, and GKE.

Aviatrix DCF enforces firewall policies on Kubernetes workloads by their pod
source IP. When worker nodes apply Source NAT (SNAT) to pod traffic, the pod IP
is replaced with the node IP before the packet leaves the cluster — DCF then
sees only the node, not the pod, and the policy targeting individual workloads
breaks.

You must disable SNAT on worker nodes regardless of cloud provider. Use the
cloud-specific instructions below.

<Tabs>
  <Tab title="AWS (EKS)">
    EKS uses the AWS VPC CNI plugin (`aws-node` DaemonSet). Set the
    `AWS_VPC_K8S_CNI_EXTERNALSNAT` environment variable to `true`.

    **Terraform — using `terraform-aws-modules/eks/aws`:**

    ```hcl theme={null}
    module "eks" {
      source  = "terraform-aws-modules/eks/aws"
      version = "~> 20.0"

      cluster_addons = {
        vpc-cni = {
          configuration_values = jsonencode({
            env = {
              AWS_VPC_K8S_CNI_EXTERNALSNAT = "true"
            }
          })
          before_compute = true
        }
      }
    }
    ```

    **Or imperatively via kubectl:**

    ```bash theme={null}
    kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=true
    ```

    For background, see
    [Enable outbound internet access for Pods](https://docs.aws.amazon.com/eks/latest/userguide/external-snat.html)
    in the AWS documentation.
  </Tab>

  <Tab title="Azure (AKS)">
    AKS uses the `ip-masq-agent` DaemonSet, which reads its configuration from a
    ConfigMap named `azure-ip-masq-agent-config` in `kube-system`. Apply a ConfigMap
    that lists `0.0.0.0/0` as a non-masquerade CIDR.

    **Terraform:**

    ```hcl theme={null}
    resource "azurerm_kubernetes_cluster" "cluster" {
      network_profile {
        network_plugin    = "azure"
        network_policy    = "azure"
        load_balancer_sku = "standard"
      }
    }

    resource "kubernetes_config_map_v1" "azure_ip_masq_agent_config" {
      metadata {
        name      = "azure-ip-masq-agent-config"
        namespace = "kube-system"
        labels = {
          component                         = "ip-masq-agent"
          "kubernetes.io/cluster-service"   = "true"
          "addonmanager.kubernetes.io/mode" = "EnsureExists"
        }
      }

      data = {
        "ip-masq-agent" = <<-EOT
          nonMasqueradeCIDRs:
            - "0.0.0.0/0"
        EOT
      }
    }
    ```

    The `ip-masq-agent` reload happens automatically when the ConfigMap changes.
  </Tab>

  <Tab title="Google Cloud (GKE)">
    GKE has a built-in default-SNAT toggle on the cluster resource. Disable it on a
    VPC-native cluster.

    **Terraform:**

    ```hcl theme={null}
    resource "google_container_cluster" "cluster" {
      networking_mode = "VPC_NATIVE"

      default_snat_status {
        disabled = true
      }
    }
    ```

    VPC-native networking is required because the default-SNAT toggle is only
    meaningful when pods have unique IP addresses across the VPC. VPC-native is also
    the GKE default for new clusters.
  </Tab>
</Tabs>

## Verification

Verifying SNAT-disabled directly from inside the cluster is awkward. With SNAT
off, the pod's source IP is private; an outbound `curl` from the pod will not
reach an external echo service through the Aviatrix data plane the way a
node-source-IP packet would.

The cleanest verification is to route traffic from a pod through an Aviatrix
Spoke Gateway with DCF and flow logging enabled, then check the source IP
recorded in the DCF flow logs. The IP should match the pod IP, not the node IP.

If pod IPs and node IPs are showing the same address in flow logs, SNAT is still
active.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/kubernetes-prerequisites"}>Kubernetes Onboarding Prerequisites</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/kubernetes-onboard"}>Onboarding Kubernetes Clusters</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-kubernetes"}>Distributed Cloud Firewall for Kubernetes</a>