<p>I am trying to expose a service on 200 odd ports. Here is sample service yaml:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: multiport-server-large-port
spec:
  type: NodePort
  selector:
    app: multiport-server-large-port
  ports:
  - port: 49152
    name: tcp-49152
  - port: 49153
    name: tcp-49153
  - port: 49154
    name: tcp-49154
  - port: 49155
    name: tcp-49155
  - port: 49156
    name: tcp-49156
  - port: 49157
    name: tcp-49157
  - port: 49158
.
.
.
.... 200 more such ports
</code></pre>
<p>After I apply this yaml, service gets created but the <code>ip:port</code> combination is unreachable with connection refused error. On further investigation, I found out that there are some REJECT entries in iptables  filter chain KUBE-EXTERNAL-SERVICES for the  ports I have exposed.</p>
<p><strong>IPTABLES Reject Rules</strong>:</p>
<pre><code>Chain KUBE-EXTERNAL-SERVICES (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49316 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31
184 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49325 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31
225 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49383 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:32
620 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49385 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30
107 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49359 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31
</code></pre>
<p>I want to understand:</p>
<ol>
<li>Why these REJECT rules are appearing?</li>
<li>Is this not possible to expose large number of ports  via services?</li>
<li>Is there any limit on number of ports that can be exposed via services?</li>
</ol>

Rajeev Kumar
<p>The REJECT is inserted when a particular service has 0 endpoints. The selector in your Service.spec must be wrong or you don't have any pods running</p>
