NGINX Gateway Fabric: AccessPolicy filters traffic by IP on Kubernetes

NGINX Gateway Fabric 2.8.0 introduces AccessPolicy, a Kubernetes resource that lets you block or allow clients based on their IP address or CIDR range, directly on a Gateway or individual route. For those already using this controller to route traffic to a cluster, it means managing IP filtering in the same place where you manage Gateways and routes, without writing NGINX snippets by hand.

The feature is new in version 2.8.0 of the project, which adds AccessPolicy to configure allow and deny lists that control incoming traffic to the Gateway based on client IP address or CIDR range. The API is in v1alpha1, so fields may change in future releases.

How it works

Each AccessPolicy is a list of rules, each with an IP or CIDR. The action field determines whether the list is a blocklist (Deny) or an allowlist (Allow). The policy attaches to a Gateway, HTTPRoute or GRPCRoute in the same namespace: a policy on the Gateway applies to all connected routes, a policy on the route applies only to that one.

The engine translates everything to native NGINX directives: NGINX Gateway Fabric converts them into allow and deny directives, and a blocked request receives a 403 Forbidden response. An allow rule rejects any request that does not match one of the listed addresses.

When both the Gateway and the route have a policy, the rules combine according to this logic:

Gateway	Route	Result on route
Deny	Deny	Both sets of Deny rules
Deny	Allow	Gateway Deny takes precedence, then route allowlist applies
Allow	Deny	Route Deny takes precedence, then Gateway allowlist applies
Allow	none	Gateway allowlist applies
none	Allow	Route allowlist applies
Allow	Allow	Only addresses present in both lists

A route cannot override a blocked address from the Gateway, even with an Allow rule that includes it. This way a platform team can set the outer limit on the Gateway and let each application team restrict it further for their own routes.

Requirements and versions

NGINX Gateway Fabric 2.8.0 was released on 14 October 2026 on the project's GitHub repository and includes over 35 fixes and stability improvements in addition to AccessPolicy. The version requires Kubernetes 1.32 or later, Gateway API 1.6.3 and NGINX OSS 1.31.7; for those using NGINX Plus, the reference version is R37.2.

For those with traffic behind a load balancer or proxy, AccessPolicy compares rules against the client IP received by NGINX: to match the original IP instead of the proxy's, configure rewriteClientIP on the NginxProxy resource.

Complete documentation and example manifests are in the official AccessPolicy guide at docs.nginx.com.