<p>I have a kubernetes cluster where control planes are working in HA through keepalived's VIP configured among them(installed only on control nodes). Everything works as expected when firewall is disabled.
all internal communications and nodePorts behave inconsistently when firewall is enabled. As a basic startup i have enabled certain mandatory ports which are required for kubernetes but this doesn't help for applications to communicate.
Is there any way or add any firewall rules that helps me to access the nodePorts/application services?</p>

<p>Incase if i'm unclear, this is a small summary</p>

<p>Control Plane 1: 172.16.23.110</p>

<p>Control Plane 2: 172.16.23.111</p>

<p>Control Plane 3: 172.16.23.112</p>

<p>Keepalived VIP: 172.16.23.116</p>

<p>Worker Nodes : 172.16.23.120-23.125</p>

<p>I'm trying to access service through nodePort like <a href="https://172.16.23.116:30443" rel="nofollow noreferrer">https://172.16.23.116:30443</a></p>

<p>i have added below firewall case across all nodes(all nodes are centos7.6)</p>

<pre><code>cat /etc/firewalld/zones/internal.xml

&lt;rule&gt;
    &lt;protocol value="vrrp" /&gt;
    &lt;accept /&gt;
&lt;/rule&gt;
</code></pre>

<p>Kindly help</p>

user2039152
<p>I am not sure, that I understood question correctly.</p>

<p>But according to the official <a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports" rel="nofollow noreferrer">documentation</a> you need to have the following ports be opened:</p>

<p>Control-plane node(s):</p>

<ul>
<li>TCP  Inbound 6443*</li>
<li>TCP  Inbound 2379-2380</li>
<li>TCP  Inbound 10250</li>
<li>TCP  Inbound 10251</li>
<li>TCP  Inbound 10252</li>
</ul>

<p>Worker node(s):</p>

<ul>
<li>TCP  Inbound 10250</li>
<li>TCP  Inbound 30000-32767</li>
</ul>

<p>Here are the examples of commands for Firewalld, taken from <a href="https://medium.com/platformer-blog/kubernetes-on-centos-7-with-firewalld-e7b53c1316af" rel="nofollow noreferrer">here</a>:</p>

<p>Control-plane node(s):</p>

<pre><code>firewall-cmd --permanent --add-port=6443/tcp
firewall-cmd --permanent --add-port=2379-2380/tcp
firewall-cmd --permanent --add-port=10250/tcp
firewall-cmd --permanent --add-port=10251/tcp
firewall-cmd --permanent --add-port=10252/tcp
firewall-cmd --permanent --add-port=10255/tcp
firewall-cmd --add-masquerade --permanent
# only if you want NodePorts exposed on control plane IP as well
firewall-cmd --permanent --add-port=30000-32767/tcp
systemctl restart firewalld
</code></pre>

<p>Worker node(s):</p>

<pre><code>firewall-cmd --permanent --add-port=10250/tcp
firewall-cmd --permanent --add-port=10255/tcp
firewall-cmd --permanent --add-port=8472/udp
firewall-cmd --permanent --add-port=30000-32767/tcp
firewall-cmd --add-masquerade --permanent
systemctl restart firewalld
</code></pre>
