About

Transparent egress routing for Envoy. Applications make normal DNS lookups and TCP connections — this extension set intercepts both so Envoy can control which upstream cluster handles each domain, attach metadata (auth tokens, policy IDs), and enforce routing policy, all without any application changes.

Use cases

  • Route outbound traffic through different upstream proxies based on destination domain
  • Attach per-domain credentials or policy metadata to proxied connections
  • Enforce egress access control by selectively intercepting DNS for specific domains

img

Extensions

The DNS Gateway is a pair of filters that work together, both provided by the same dns-gateway dynamic module and sharing a process-wide virtual-IP cache:

  • resolver — a UDP listener filter that intercepts DNS queries for configured domain patterns, allocates a virtual IP from a dedicated CIDR range, and responds with an A record (IPv4 base_ip) or AAAA record (IPv6 base_ip).
  • lookup — a network filter that, when the application opens a TCP connection to a virtual IP, looks up the original domain and its configured metadata from the shared cache and exposes them as Envoy filter state.

Backward compatibility

The combined dns-gateway extension is preserved: the legacy invocation --extension dns-gateway --filter-type udp_listener (and --filter-type network) still works and resolves to the same filters as the split extensions above.

Prerequisites

Requires iptables/nftables rules to redirect application traffic to Envoy:

  • DNS: UDP port 53 redirected to Envoy's DNS listener
  • TCP: Outbound connections to virtual IP ranges redirected to Envoy's TCP listener