1

I opened a Kubernetes NodePort on a machine and blocked all traffic to this port with the following rule:

sudo ufw deny 30001

But I can still access that port via browser. Is it common? I can't find any information on that in the docs.

4
  • 1
    deny in what direction? ingress , or egress?
    – Ijaz Ahmad
    Nov 3, 2018 at 12:13
  • try ufw deny proto tcp to any port 30001
    – Ijaz Ahmad
    Nov 3, 2018 at 12:15
  • also make sure you are running that deny command on the node which u are accessing from browser
    – Ijaz Ahmad
    Nov 3, 2018 at 12:16
  • its ingress. I tried your command above but no changes either. Also I checked to deny on the correct host, no change.
    – Techradar
    Nov 3, 2018 at 15:33

1 Answer 1

5

Finally found the issue: kube-proxy is writing iptables rules (https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/#is-kube-proxy-writing-iptables-rules) which are catched before the ufw rules one added manually. This can be confirmed by checking the order in the output of iptables -S -v.

1
  • I believe that the nodeport is available but since the service acceses the pods through iptable rules you shouldn't be able to reach the pods themselves Nov 5, 2018 at 5:04

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.