A global network set resource (GlobalNetworkSet) represents an arbitrary set of IP subnetworks/CIDRs, allowing it to be matched by Calico policy. Network sets are useful for applying policy to traffic coming from (or going to) external, non-Calico, networks. The metadata for each network set includes a set of labels. Calico rules may not behave as expected if there is NAT between the Calico-enabled node and the networks listed in a network set. For example, incoming traffic via a service IP is typically SNATed by the kube-proxy before reaching the destination host.”]
Source: https://docs.projectcalico.org/reference/resources/globalnetworkset