# Kubernetes Deployment and Node external Ips security risk **URL:** \ **Category:** Ziti Overlay\ **Created:** [January 21, 2025, 8:23pm UTC](https://openziti.discourse.group/t/kubernetes-deployment-and-node-external-ips-security-risk/3815 "2025-01-21T20:23:53Z")\ **Posts on this page:** 1\ **Showing post:** 7
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [January 23, 2025, 9:24pm UTC](https://openziti.discourse.group/t/kubernetes-deployment-and-node-external-ips-security-risk/3815/7 "2025-01-23T21:24:15Z")
I sort of just answered this on your other post I think... > [@yemaney](#): > > Is it fair to say, the nodes that ziti routers and tunnel are deployed on will need access to the internet with one of (public external IP or NATGW) in order to join the data mesh. I assume you want secure, ubiquitous connectivity from anywhere in the world. To do this you'll need to deploy the controller and one router (at least) on the internet with public IPs and with "allow" firewall rules, allowing clients to connect to the controller and to the router.... This is what is shown in the diagram. > [@yemaney](#): > > would be each router (including private routers) have public internet access.. They need outbound access to the internet - yes but outbound only. Otherwise the private routers couldn't connect to the public routers. But the private routers, are private. DENY ALL inbound traffic, no public ports open. > [@yemaney](#): > > the tunnel would also have to run in a node with internet access while also being accessible to the applicatoin server. Nearly the same answer as for routers. It needs outbound internet access to the controller, but it does not necessarily need outbound access to the router. It **COULD** access the private router in private address space and if that private router was linked to the public router, then the service could be accessed. --- _[View the full topic](https://openziti.discourse.group/t/kubernetes-deployment-and-node-external-ips-security-risk/3815)._