<p>which ingress rule is blocking the request coming in.
app : based on drupal.
any suggestions would help.</p>
<p>ingress log :</p>
<pre><code>2022/08/11 10:00:59 [error] 20516#20516: *159406145 access forbidden by rule, client: 2a02:9b0:3d:54a2:40bf:a951:e203:79a5, server: example.com, request: &quot;GET / HTTP/1.1&quot;, host: &quot;example.com&quot;
{&quot;time&quot;: &quot;2022-08-11T10:00:59+00:00&quot;, &quot;remote_addr&quot;: &quot;-&quot;, &quot;x_forward_for&quot;: &quot;2a02:9b0:3d:54a2:40bf:a951:e203:79a5, 172.70.156.137, 2a02:9b0:3d:54a2:40bf:a951:e203:79a5&quot;, &quot;request_id&quot;: &quot;d8d07bd09c84b802af91a60adbf46a73&quot;, &quot;remote_user&quot;: &quot;-&quot;, &quot;bytes_sent&quot;: 583, &quot;request_time&quot;: 0.000, &quot;status&quot;: 403, &quot;vhost&quot;: &quot;example.com&quot;, &quot;request_proto&quot;: &quot;HTTP/1.1&quot;, &quot;path&quot;: &quot;/&quot;, &quot;request_query&quot;: &quot;-&quot;, &quot;request_length&quot;: 647, &quot;duration&quot;: 0.000,&quot;method&quot;: &quot;GET&quot;, &quot;http_referrer&quot;: &quot;-&quot;, &quot;http_user_agent&quot;: &quot;Mozilla/5.0 (iPhone; CPU iPhone OS 15_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Mobile/15E148 Safari/604.1&quot;, &quot;auth_apikey&quot;: &quot;-&quot;, &quot;auth_authorization&quot;: &quot;-&quot;, &quot;auth_X-Api-caps&quot;: &quot;-&quot;, &quot;auth_uid&quot;: &quot;-&quot;}
</code></pre>
<p>ingress.yaml</p>
<p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-html lang-html prettyprint-override"><code>apiVersion: v1
items:
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      meta.helm.sh/release-name: example-production
      meta.helm.sh/release-namespace: example
      nginx.ingress.kubernetes.io/configuration-snippet: |
        more_clear_headers "Server";
        more_set_headers "X-Content-Type-Options: nosniff";
        more_set_headers "X-XSS-Protection: 1";
        more_set_headers "X-Request-Id: $request_id";
        more_set_headers "X-Router-Id: example-portal-anonymous";
        more_set_headers "Strict-Transport-Security: max-age=15768000";
        more_set_headers "Content-Security-Policy: frame-ancestors 'self'";
      nginx.ingress.kubernetes.io/cors-allow-headers: X-Forwarded-For, Authorization
      nginx.ingress.kubernetes.io/cors-allow-methods: GET, POST, PUT, PATCH, DELETE,
        OPTIONS
      nginx.ingress.kubernetes.io/cors-allow-origin: example.com
      nginx.ingress.kubernetes.io/enable-cors: "true"
      nginx.ingress.kubernetes.io/enable-modsecurity: "true"
      nginx.ingress.kubernetes.io/enable-owasp-core-rules: "false"
      nginx.ingress.kubernetes.io/limit-rpm: "0"
      nginx.ingress.kubernetes.io/modsecurity-transaction-id: $request_id
      nginx.ingress.kubernetes.io/proxy-buffer-size: 20k
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    creationTimestamp: "2022-08-10T11:19:21Z"
    generation: 1
    labels:
      app.kubernetes.io/managed-by: example
    name: portal-anonymous
    namespace: example
    resourceVersion: "523173759"
    selfLink: /apis/extensions/v1beta1/namespaces/example/ingresses/portal-anonymous
    uid: 9cdb29b2-a463-4851-b4c4-b5a58be28580
  spec:
    rules:
    - host: example.com
      http:
        paths:
        - backend:
            serviceName: portal
            servicePort: 80
          path: /
          pathType: Prefix
  status:
    loadBalancer: {}
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""</code></pre>
</div>
</div>
</p>

manoj
<p>I suspect the problem is actually revealed in your config:</p>
<pre><code>nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
</code></pre>
<p>You are allowing all IPv4 IPs with this range, but in your log, you have this:</p>
<pre><code>&quot;x_forward_for&quot;: &quot;2a02:9b0:3d:54a2:40bf:a951:e203:79a5, 172.70.156.137, 2a02:9b0:3d:54a2:40bf:a951:e203:79a5&quot;
</code></pre>
<p>So this means you're using IPv6 as well, so you might want to add <code>::/0</code> to the whitelist-source-range to allow all IPv6 as well as all IPv4 ranges. OR just omit the annotation entirely if you want to allow anything in.</p>
