<p>I have a 3-nodes bare metal cluster installed with KUBEADM (buildt with intel NUC running CentOS 7).</p>

<p>The master node is provided with 2 different network interfaces, one for external access and the second is configured to be the DHCP server of the cluster local network. 
IP forwarding and masquerading between the two netowrks is enabled through the following iptables rules </p>

<p><code>iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i {{lan_interface_name}} -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o {{wan_interface_name}} -j MASQUERADE
iptables -A FORWARD -i {{wan_interface_name}} -o {{lan_interface_name}} -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -i {{lan_interface_name}} -o {{wan_interface_name}} -j ACCEPT
</code></p>

<p>In addition I also enabled forwarding between docker interface and lan interface for every node in the cluster</p>

<p><code>iptables -I INPUT -i docker0 -j ACCEPT
iptables -t nat -A POSTROUTING -o {{lan_interface_name}} -j MASQUERADE
iptables -I FORWARD -i {{lan_interface_name}} -o docker0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -i docker0 -o {{lan_interface_name}} -j ACCEPT
</code></p>

<p>In order to be sure to have no iptables problems I enabled all the traffic by default</p>

<p><code>iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
</code></p>

<p>While this is the /etc/sysctl.conf file</p>

<p><code>net.ipv4.ip_forward=1
net.bridge.bridge-nf-call-iptables=1
</code></p>

<p>I followed the kubeadm instructions to launch a cluster with CALICO (<a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="nofollow noreferrer">https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/</a>) and everything seems to work properly except (even kube-dns is reachable from every POD in every node) for the exposed services.</p>

<p>Just for testing I created a nginx deployment and exposed it through nodeport:
<code>
kubectl get svc
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.96.0.1      &lt;none&gt;        443/TCP        30m
nginx        NodePort    10.96.227.49   &lt;none&gt;        80:31242/TCP   22m
</code></p>

<p>If I try to curl the cluster IP within the same node of the POD everything is fine, while if I try to curl it in another node curl request timeout. </p>

<p>Any help would be really appreciated. </p>

<p>Kubernetes and Calico do convoluted things with <code>iptables</code>, so I believe you have a conflict or blocking rule somewhere. I recommend disabling all the rules to start then install docker and then your k8s with <code>kubeadm</code>.</p>
