WORKERS
OWN SUBNET
NO ROUTE INSIDE
EGRESS PROXY
RESOLVES DNS
DROPS PRIVATE IPS
CUSTOMER
api.example.com
PUBLIC, DELIVERED
INTERNAL
10.0.0.5
PRIVATE, BLOCKED
WORKERS CAN ONLY TALK TO THE PROXY