diff --git a/submariner/templates/engine-deploy.yaml b/submariner/templates/engine-deploy.yaml
index 85e44ff..dd18f80 100644
--- a/submariner/templates/engine-deploy.yaml
+++ b/submariner/templates/engine-deploy.yaml
@@ -60,6 +60,8 @@ spec:
           value: "{{ .Values.submariner.clusterCidr }}"
         - name: SUBMARINER_SERVICECIDR
           value: "{{ .Values.submariner.serviceCidr }}"
+        - name: SUBMARINER_GLOBALCIDR
+          value: "{{ .Values.submariner.globalCidr }}"
         - name: SUBMARINER_TOKEN
           value: "{{ .Values.submariner.apiToken }}"
         - name: SUBMARINER_CLUSTERID
@@ -124,4 +126,4 @@ spec:
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 0
-      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
\ No newline at end of file
+      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
diff --git a/submariner/templates/globalnet.yaml b/submariner/templates/globalnet.yaml
new file mode 100644
index 0000000..6efd7aa
--- /dev/null
+++ b/submariner/templates/globalnet.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "submariner.fullname" . }}-globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-globalnet
+    component: globalnet
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-globalnet
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-globalnet
+    spec:
+      hostNetwork: true
+      serviceAccountName: submariner-globalnet
+      serviceAccount: submariner-globalnet
+      nodeSelector:
+{{- if eq .Values.submariner.globalCidr "" }}
+        nowhere: 'noplace'
+{{- else }}
+        submariner.io/gateway: 'true'
+{{- end }}
+      containers:
+        - name: {{ template "submariner.fullname" . }}-globalnet
+          image: submariner-globalnet:local
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: SUBMARINER_CLUSTERID
+              value: '{{ .Values.submariner.clusterId }}'
+            - name: SUBMARINER_GLOBALCIDR
+              value: '{{ .Values.submariner.globalCidr }}'
+            - name: SUBMARINER_EXCLUDENS
+              value: 'submariner,kube-system,operators'
+            - name: SUBMARINER_NAMESPACE
+              value: '{{ .Release.Namespace }}'
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: false
+            runAsNonRoot: false
+          volumeMounts:
+            # Because we don't actually run iptables locally, but chroot in to the host
+            - mountPath: /host
+              name: host-slash
+              readOnly: true
+      volumes:
+        - name: host-slash
+          hostPath:
+            path: /
+
diff --git a/submariner/values.yaml b/submariner/values.yaml
index c674e94..e0ba61e 100644
--- a/submariner/values.yaml
+++ b/submariner/values.yaml
@@ -4,6 +4,7 @@ submariner:
   token: ""
   clusterCidr: "10.42.0.0/16"
   serviceCidr: "10.43.0.0/16"
+  globalCidr: ""
   natEnabled: false
   colorCodes: blue
   debug: false