<p>We have a lot of services set up by Nodeport and available from external via <code>&lt;node_ip&gt;:&lt;node_port&gt;</code>.</p>

<p>It should be a common requirement that I would like to control the access to certain services, which means the requests from some of IPs may access to it, while others not.</p>

<p>We'd like to use <code>iptables</code> to meet this requirement, which gets a lot of <strong>confusion</strong> since kubernetes use it to set up communication as well. 
Do we have any high-level <code>guidance</code> to design/create iptable rule to control k8s service?</p>

<p>Specifically, I am confused in below areas:</p>

<ol>
<li>Which table should I append rules into?  I find that lots of rules in <code>nat and filter</code> are created by K8s</li>
<li>If I what to disable the access of service from one external IP to certain node, such as 
<code>telnet &lt;node_ip&gt;:&lt;node_port&gt;</code>
should I REJECT on <code>FORWARD</code> or <code>INPUT</code>, or <code>PREROUTING</code> directly?</li>
<li>Do these rules depend on specific network plugins (eg flannel or weave)? Whether different plugins have a different way to config rule or not?</li>
</ol>

<p>For my scenarios, I have below rules to be set up:</p>

<ol>
<li>all nodes in the cluster should have <code>full access</code>to each other</li>
<li>some core services (API) should only be <strong>ACCEPT</strong> by <code>certain</code> IPs</li>
<li>certain services in a port range can be <strong>ACCEPT</strong> by <code>all</code> IPs</li>
<li><strong>REJECT</strong> the access to <code>any other</code> services from all IPs (outside of cluster)</li>
</ol>

<p>k8s version: 1.9.5
network plugin: weave</p>

<p>Best Regards!</p>



<p>/triage support</p>

cherishty
<p>Although you can change iptables on your K8s nodes, I wouldn't recommend making any changes since K8s (kube-proxy) is constantly changing the rules dynamically.  In other words, Kubernetes manages (combined with the overlay) manages iptables for you.</p>

<p>To block traffic I would strongly suggest using <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">NetworkPolicies</a>. And/Or if you are using an overlay, you can use what that overlay provides. For example, Calico has its own <a href="https://docs.projectcalico.org/v3.3/reference/calicoctl/resources/networkpolicy" rel="nofollow noreferrer">Network Policy</a></p>

<p>Another way of controlling traffic in/out is to use a service-mesh like <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a>.</p>
