<p>I need to create a <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer"><code>NetwrokPolicy</code></a> for my pod which from the network aspects needs
to access to <strong>only one specific endpoint</strong> outside the cluster, only this endpoint.</p>
<p>The endpoint looks like following.
<a href="https://140.224.232.236:8088" rel="nofollow noreferrer">https://140.224.232.236:8088</a></p>
<p>Before apply the following network policy I've exec to the pod (the image is based on alpine) and run <code>ping www.google.com</code> and it works as expected,</p>
<p>However when I apply the network policy I and I try to <code>ping google.com</code> I got <code> ping: bad address 'www.google.com'</code> but when I ping to the ip like</p>
<ol>
<li><code>ping 140.224.232.236</code></li>
<li><code>ping 140.224.232.236:8080</code></li>
</ol>
<p>it get stuck and before I was able to see something like this</p>
<pre><code>64 bytes from 140.224.232.236: seq=518 ttl=245 time=137.603 ms
64 bytes from 140.224.232.236: seq=519 ttl=245 time=137.411 ms
64 bytes from 140.224.232.236: seq=520 ttl=245 time=137.279 ms
64 bytes from 140.224.232.236: seq=521 ttl=245 time=137.138 ms
....
</code></pre>
<p>Now its just stuck on this, any idea?</p>
<pre><code>ping 140.224.232.236
PING 140.224.232.236 (140.224.232.236): 56 data bytes
</code></pre>
<p>and nothing more, what does  it mean?</p>
<p>What I did is the following</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: test-network-policy
    namespace: dev
spec:
    podSelector:
      matchLabels:
        app.kubernetes.io/name: foo
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 140.224.232.236/32
    ports:
    - protocol: TCP
      port: 8088 
</code></pre>
<ol>
<li>I've applied it on the same ns of the pod.</li>
<li>the name of the pod selector label has taken from the pod which I want to apply the network policy and have the following.
<code>app.kubernetes.io/name: foo</code></li>
</ol>

<p>As you defined egress with ports:</p>
<pre><code>ports:
- protocol: TCP
  port: 8080
</code></pre>
<p>which means allowing connections to ip 140.224.232.236 on <strong>TCP port</strong> 8080.</p>
<p>However, <code>ping</code>(ICMP) doesnot know the port. Ping will fail every time.</p>
<p><a href="https://i.stack.imgur.com/1xH4D.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1xH4D.png" alt="enter image description here" /></a></p>
<ol>
<li><p><code>ping</code> is a networking utility used to test the reachability of a remote host over <strong>Internet Protocol (IP)</strong>. The <code>ping</code> utility does so by sending out a series of <strong>Internet Control Message Protocol (ICMP)</strong> echo request packets to a remote host.</p>
</li>
<li><p><em><strong>You cannot probe a specific port with ping command</strong></em> because ICMP belongs to <strong>layer-3 IP layer</strong>, not layer-4 transport layer (e.g., TCP/UDP).</p>
</li>
<li><p>In order to ping a specific port of a remote host, you need to use <strong>layer-4 transport protocols</strong> which have a notion of port numbers, with many command-line tools like:</p>
</li>
</ol>
<ul>
<li><code>paping</code> 140.224.232.236 -p 8080 -c 3</li>
<li><code>nmap</code> -p 80 -sT <a href="http://www.google.com" rel="nofollow noreferrer">www.google.com</a></li>
<li><code>tcpping</code> <a href="http://www.google.com" rel="nofollow noreferrer">www.google.com</a></li>
</ul>
