<p>I have a network policy which will allow connection only from my IP address to the NGINX ingress controller. The network policy is given below. The ingress is using a load balancer and app is in different namespace (default).</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-access
  namespace: ingress-nginx
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-ingress
  policyTypes:
    - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 11.11.11.11/32
    ports:
      - protocol: TCP
        port: http
      - protocol: TCP
        port: https
</code></pre>
<p>But after deploying the network policy I can't establish a connection to my application. So I have changed the CIDR range from 11.11.11.11/32 to 0.0.0.0/0 and checked the logs to see from which IP address I am receiving the connection.</p>
<blockquote>
<p>22.22.22.22 - - [10/Nov/2022:05:14:35 +0000] &quot;GET / HTTP/1.1&quot; 200 7250 &quot;-&quot; &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36&quot;
462 0.006 [default-hello-one-80] [] 10.2.0.6:80 7243 0.004 200
4d3fd980e5d07a084b162c1f9305f2d9</p>
</blockquote>
<p>It means I am getting hit by one of my kubernetes worker node. (22.22.22.22)</p>
<p>I tried adding all worker node IP address and load balancer IP address under ipBlock, but still my application is not accessible.can somebody help me?</p>

<p>You need to set <code>externalTrafficPolicy: Local</code> on the Ingress controller service.</p>
<p>Documentation <a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip" rel="nofollow noreferrer">here</a></p>
<p>Setting this allows the original client IP (which would be outside the cluster) to be preserved, so things like allow/deny list sand networkpolicies would work properly.</p>
