<p>I am trying to install and use the nginx-ingress to expose services running under kubernetes cluster and I am following this <a href="https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/installation.md" rel="nofollow noreferrer">instructions</a>. </p>

<p>In <strong>step 4</strong> it's noted that : </p>

<blockquote>
  <p>If you created a daemonset, ports 80 and 443 of the Ingress controller container are mapped to the same ports of the node where the container is running. To access the Ingress controller, use those ports and an IP address of any node of the cluster where the Ingress controller is running.</p>
</blockquote>

<p>That mean that the daemonset will be listening on ports 80 and 443 to forward the incoming traffic to the service mapped by an ingress.yaml config file.</p>

<p>But after running the instruction <strong>3.2</strong> <code>kubectl apply -f daemon-set/nginx-ingress.yaml</code> the daemon-set was created but nothing was listening on 80 or 443 in all the cluster's nodes.</p>

<p>Is there a problem with the install instruction or am I missing something there.</p>

<p>It is not the typical Listen which you can get from the output of netstat. It is "listened" by iptables. The following is the iptables rules for the ingress controller on my cluster node.</p>

<pre><code>-A CNI-DN-0320b4db24e84e16999fd -s 10.233.88.110/32 -p tcp -m tcp --dport 80 -j CNI-HOSTPORT-SETMARK
-A CNI-DN-0320b4db24e84e16999fd -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.233.88.110:80
-A CNI-DN-0320b4db24e84e16999fd -s 10.233.88.110/32 -p tcp -m tcp --dport 443 -j CNI-HOSTPORT-SETMARK
-A CNI-DN-0320b4db24e84e16999fd -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.233.88.110:443
</code></pre>

<p>10.233.88.110 is the ip address of the ingress controller running on that node.</p>

<pre><code>$ kubectl get pod -n ingress-nginx -o wide
NAME                             READY   STATUS    RESTARTS   AGE   IP              NODE          NOMINATED NODE   READINESS GATES
ingress-nginx-controller-5rh26   1/1     Running   1          77d   10.233.83.110   k8s-master3   &lt;none&gt;           &lt;none&gt;
ingress-nginx-controller-9nnwl   1/1     Running   1          77d   10.233.88.110   k8s-master2   &lt;none&gt;           &lt;none&gt;
ingress-nginx-controller-ckkb2   1/1     Running   1          77d   10.233.68.111   k8s-master1   &lt;none&gt;           &lt;none&gt;
</code></pre>

<p><strong>Edit</strong>
When a request comes to port 80/443, the iptables will apply DNAT rule to this request which modify the destination IP to the ip address of the ingress controller. The actual listen is inside the ingress controller container.</p>
