<p>I have a tool that uses <code>nmap</code> to run a basic port scan on a host to check for open ports. It's setup in a docker container and on my local machine, works perfectly (shows the expected ports being open, etc.).</p>

<p>When I deploy this container to a Kubernetes cluster in Google Cloud and trigger the scan, I noticed the ports always show up as filtered.</p>

<p>I know that all 1,000 ports showing up as filtered generally means there's a firewall rule somewhere that's causing packets to drop, but I can't figure out where it is.</p>

<p>Our infrastructure setup is:</p>

<ul>
<li>GCP/GKE for Kubernetes on GCP</li>
<li>Dockerized containers deployed and managed by Kube</li>
<li>Istio service mesh</li>
</ul>

<p>Here's what I've tried (didn't work):</p>

<ul>
<li>Updated the <code>egress</code> firewall rule in GCP to allow everything (all ports, protocols) on all my instances</li>
<li>Added NAT gateway to the network to make sure it could access external things</li>
<li>Made sure Istio had all outbound enabled (no restrictive egress rules)</li>
</ul>

<p>Is there anything I can do to help further debug this or figure out where the firewall rules might be applied?</p>

<p>Thanks for your help.</p>

shishy
<p>Here's how I ended up solving this:</p>

<p>I made use of the <code>traffic.sidecar.istio.io/includeOutboundIPRanges</code> annotation on my pod. I set that to be the CIDR of the service mesh.</p>

<p>Doing that made it so any requests going out of that pod <em>to</em> something within my mesh was sent through Envoy. Anything else was ignored by Envoy (allowing the <code>nmap</code> requests to scan properly instead of being filtered).</p>

<p>There are probably a number of other ways to get this to work given how much customization there seems to available in Istio, but this satisfied my requirements.</p>
