Back to writing

February 5, 2026 · 7 mins

Reverse Tunneling in Envoy Proxy

How reverse tunnels in Envoy reduce exposed network attack surfaces for secure cross-cluster and hybrid-cloud communication.

EnvoyNetwork SecurityZero TrustOpen Source

Overview

Reverse tunneling in Envoy Proxy solves a common problem in hybrid-cloud and cross-cluster systems: services often need to communicate across network boundaries, but opening inbound ports expands the attack surface.

The reverse tunnel design inverts the traditional client-server socket model. A protected service behind a firewall or NAT initiates a secure outbound tunnel, allowing cloud-side systems to communicate without requiring direct inbound exposure.

Contribution

Basundhara led the design and implementation of reverse tunnel support while at Nutanix and contributed the feature upstream to Envoy Proxy. The feature was introduced in Envoy 1.36 and is now part of the open-source Envoy project. She remains active in Envoy as a contributor and code owner.

The work combined datapath engineering, security architecture, and production constraints:

  • secure inbound connectivity from cloud to on-prem workloads
  • cross-cluster service communication without exposing inbound ports
  • integration with Envoy's proxy architecture
  • production use in enterprise hybrid-cloud environments
  • upstream contribution to a widely adopted open-source networking proxy

Why It Matters

Envoy sits in the critical path for modern cloud-native networking. Features that reduce exposed attack surfaces in Envoy can improve the security posture of systems far beyond a single company.

Reverse tunnels align with zero-trust networking principles because protected workloads do not need to accept unsolicited inbound traffic. Instead, they can establish outbound connectivity and maintain more controlled communication paths.

Public References

Writing Direction

The strongest public writing angle is technical and architectural:

1. Start with the hybrid-cloud security problem.

2. Explain why opening inbound ports is risky.

3. Show how reverse tunnels change the connectivity model.

4. Explain the Envoy integration at a systems level.

5. Close with the broader zero-trust and open-source infrastructure impact.