Yrurtj

After deploying all kubernetes ressources I wanna open port 443. I added it to my whitelist table but it is still closed. Same already happened to me for port 80. After flushing all tables, deleting all kubernetes ressources and setup the firewall from scratch (including whitelisted port 80) before deploying kubernetes again port 80 was finally open.

Now I prefer understanding why I can not open port 443 instead of doing all that again. I found out that there is the table KUBE-FIREWALL (see below), which blocks everything by default.

And this is my main question:

Does the rules of KUBE-FIREWALL have a higher priority than my table TCP? And if, how I can change the priority?

INPUT

Chain INPUT (policy DROP)

target     prot opt source               destination         

cali-INPUT  all  --  anywhere             anywhere             /* cali:Cz_u1IQiXIMmKD4c */

f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh

KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */

KUBE-FIREWALL  all  --  anywhere             anywhere            

ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

ACCEPT     all  --  anywhere             anywhere            

DROP       all  --  anywhere             anywhere             ctstate INVALID

ACCEPT     icmp --  anywhere             anywhere             icmp echo-request ctstate NEW

UDP        udp  --  anywhere             anywhere             ctstate NEW

TCP        tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW

REJECT     udp  --  anywhere             anywhere             reject-with icmp-port-unreachable

REJECT     tcp  --  anywhere             anywhere             reject-with tcp-reset

REJECT     all  --  anywhere             anywhere             reject-with icmp-proto-unreachable

cali-INPUT

Chain cali-INPUT (1 references)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000

cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */

MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff

cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */

ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000

KUBE-FIREWALL

Chain cali-INPUT (1 references)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000

cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */

MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff

cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */

ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000

claus@vmd33301:~$ sudo iptables -L KUBE-FIREWALL

Chain KUBE-FIREWALL (2 references)

target     prot opt source               destination         

DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

TCP

Chain TCP (1 references)

target     prot opt source               destination         

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https