<p><strong><em>In short, the pod can only access the host it is on.</em></strong></p>

<p>I have a k8s-1.15 cluster with 3 nodes and Calico plugin:</p>

<ul>
<li>master.test.local (192.168.1.137)</li>
<li>node1.test.local (192.168.1.138)</li>
<li>node2.test.local (192.168.1.139)</li>
</ul>

<p>There are 2 pods, pod-1 running on master(1.137), and pod-2 running on node1(1.138), when I ping 192.168.1.138 from pod-1(running on 1.137), I got:</p>

<pre class="lang-sh prettyprint-override"><code>[~pod-1] # ping 192.168.1.138
PING 192.168.1.138 (192.168.1.138): 56 data bytes
</code></pre>

<p>but if I ping the 1.137 from pod-1(running on 1.137), it succeeded:</p>

<pre class="lang-sh prettyprint-override"><code>[~pod-1] # ping 192.168.1.137
PING 192.168.1.137 (192.168.1.137): 56 data bytes
64 bytes from 192.168.1.137: seq=0 ttl=64 time=0.089 ms
64 bytes from 192.168.1.137: seq=1 ttl=64 time=0.094 ms
</code></pre>

<p>How should I solve it?</p>

RYAN14
<p>Your question is answered in <a href="https://github.com/projectcalico/calico/issues/2543#issuecomment-484274834" rel="nofollow noreferrer">Issue #2543</a></p>

<blockquote>
  <p>this looks to be working as expected, since your network policy doesn't have any egress rules.</p>
  
  <p>If you want to deny egress from pod A, you can add the following section to the NetworkPolicy:</p>
  
  <pre><code>types:
- Ingress
- Egress
</code></pre>
  
  <p>This will tell the policy to apply to both ingress and egress traffic, and all egress from pod A will be denied unless you specify egress rules.</p>
  
  <p>Alternatively, you can create an ingress policy which selects pod B in order to prevent pod A from accessing it.</p>
</blockquote>

<p>You can use <code>calicoctl profile</code> to edit the default policy that forbids inbound traffic</p>

<pre class="lang-sh prettyprint-override"><code>calico profile {{ profile_name }} rule add inbound allow from &lt;ip&gt;
</code></pre>
