diff --git a/network_policies/default.yaml b/network_policies/default.yaml
index e69de29..f27d5fb 100644
--- a/network_policies/default.yaml
+++ b/network_policies/default.yaml
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  # TODO: this should be a default deny rule once the istio stuff works
+  name: default-allow-all
+spec:
+  endpointSelector: {}  # Empty selector matches ALL endpoints
+  ingress:
+    - fromEntities:
+        #- "host"             # Allow kubelet probes from the local node
+        - "all"
+  egress:
+    - toEntities:
+        #- "kube-apiserver"   # Allow API server access
+        - "all"
+#    - toEndpoints:
+#        - matchLabels:
+#            "k8s:io.kubernetes.pod.namespace": kube-system
+#            k8s-app: kube-dns
+#      toPorts:
+#        - ports:
+#            - port: "53"
+#              protocol: UDP
\ No newline at end of file