<p>I have a kubernetes cluster that exposes Postgresql on port 5432 via <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/exposing-tcp-udp-services.md" rel="nofollow noreferrer">this information</a>, this works like a charm. I'm currently testing this on my machine, and it works on <code>db.x.io</code> (<code>x</code> being my domain). But it also works on <code>localhost</code>. This seems fair, as it only creates a binding upon port 5432 to my service. </p>

<p>How can i also filter on subdomain? So its only accessible via <code>db.x.io</code></p>

WiseStrawberry
<p>There is not much that <code>TCP</code> protocol has in terms of filtering. This is because <code>TCP</code> protocol uses only <code>IP:Port</code> combination, no headers like in HTTP. Your subdomain is resolved by <code>DNS</code> to <code>IP</code> address before connection is made.</p>

<p>According to <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/" rel="nofollow noreferrer">Nginx</a> documentation you can do the following:</p>

<blockquote>
  <ul>
  <li><a href="https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/#restrict" rel="nofollow noreferrer">Restricting Access by IP Address</a></li>
  <li><a href="https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/#limit_conn" rel="nofollow noreferrer">Limiting the Number of TCP Connections</a></li>
  <li><a href="https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/#limit_bandwidth" rel="nofollow noreferrer">Limiting the Bandwidth</a></li>
  </ul>
</blockquote>

<hr>

<p>You can try to limit access from localhost by adding <code>deny 127.0.0.1</code> to nginx configuration, however it will most likely break the Postgresql instead. So it is a risky suggestion.</p>

<p>For kubernetes ingress object it would be:</p>

<pre><code>metadata:
  annotations:
    nginx.org/server-snippets: |
      deny 127.0.0.1;
</code></pre>

<p>Based on <a href="https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/custom-annotations/" rel="nofollow noreferrer">Nginx</a> documentation.</p>
