<p>In my <a href="https://docs.ovh.com/gb/en/kubernetes/" rel="nofollow noreferrer">OVH Managed Kubernetes</a> cluster I'm trying to expose a NodePort service, but it looks like the port is not reachable via <code>&lt;node-ip&gt;:&lt;node-port&gt;</code>.</p>
<p>I followed this tutorial: <a href="https://kubernetes.io/docs/tasks/access-application-cluster/service-access-application-cluster/#creating-a-service-for-an-application-running-in-two-pods" rel="nofollow noreferrer">Creating a service for an application running in two pods</a>. I can successfully access the service on <code>localhost:&lt;target-port&gt;</code> along with <code>kubectl port-forward</code>, but it doesn't work on <code>&lt;node-ip&gt;:&lt;node-port&gt;</code> (request timeout) (though it works from inside the cluster).</p>
<p>The tutorial says that I may have to &quot;create a firewall rule that allows TCP traffic on your node port&quot; but I can't figure out how to do that.</p>
<p>The security group seems to allow any traffic:</p>
<p><a href="https://i.stack.imgur.com/1AbNG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1AbNG.png" alt="enter image description here" /></a></p>

sdabet
<p>The solution is to NOT enable &quot;Private network attached&quot; (&quot;réseau privé attaché&quot;) when you create the managed Kubernetes cluster.</p>
<p>If you already paid your nodes or configured DNS or anything, you can select your current Kubernetes cluster, and select &quot;Reset your cluster&quot; (&quot;réinitialiser votre cluster&quot;), and then &quot;Keep and reinstall nodes&quot; (&quot;conserver et réinstaller les noeuds&quot;) and at the &quot;Private network attached&quot; (&quot;Réseau privé attaché&quot;) option, choose &quot;None (public IPs)&quot; (&quot;Aucun (IPs publiques)&quot;)</p>
<p>I faced the same use case and problem, and after some research and experimentation, got the hint from the small comment on this dialog box:</p>
<blockquote>
<p>By default, your worker nodes have a public IPv4. If you choose a private network, the public IPs of these nodes will be used exclusively for administration/linking to the Kubernetes control plane, and your nodes will be assigned an IP on the vLAN of the private network you have chosen</p>
</blockquote>
<p>Now i got my Traefik ingress as a DaemonSet using <code>hostNetwork</code> and every node is reachable directly even on low ports (as you saw yourself, the default security group is open)</p>
