doesn't it already via ingress/egress?