<p>I opened a Kubernetes NodePort on a machine and blocked all traffic to this port with the following rule:</p>

<pre><code>sudo ufw deny 30001
</code></pre>

<p>But I can still access that port via browser. Is it common? I can't find any information on that in the docs.</p>

<p>Finally found the issue: <code>kube-proxy</code> is writing <code>iptables</code> rules (<a href="https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/#is-kube-proxy-writing-iptables-rules" rel="noreferrer">https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/#is-kube-proxy-writing-iptables-rules</a>) which are catched before the <code>ufw</code> rules one added manually. This can be confirmed by checking the order in the output of <code>iptables -S -v</code>.</p>
