<p>I just configured a Kubernetes Cluster with this environment</p>
<p>4 VPS nodes with one public IP for each node</p>
<p>K3S Cluster with embebed etcd (k3s version v1.22.7+k3s1)</p>
<ul>
<li>3 master nodes</li>
<li>1 Worker node just for testing</li>
</ul>
<p>MetalLB for Internal Load Balancer (metallb/v0.12.1)</p>
<ul>
<li>IP Range 10.10.0.200-10.10.0.250</li>
</ul>
<p>Traefik as default Kubernetes Ingress Class (Chart v10.19.4 &amp; App v2.6.3)</p>
<p>Every thing is running as expected, I can access all services inside each node in the cluster.</p>
<p>Now, how to finally expose services to Internet Acesss?</p>
<ul>
<li>Cloud Provider Firewall already exposing ports 80 and 443</li>
<li>Internal iptables firewall accept public traffict from those ports</li>
</ul>
<p>I thought Traefik automatically expose port 80 and 443, but lsof actually is not showing as &quot;LISTEN&quot;. and pubic ips not responding anything. I am really confused at this, I am newby in kubernetes world.</p>
<p>I have tried port forwarding private ip to metallb load balancer ip but it actually not solve the route.</p>
<pre><code>iptables -t nat -I PREROUTING -p tcp -d &lt;enp0s3-local-ip&gt; --dport 80 -j DNAT --to-destination &lt;load-balancer-ip&gt;:80
iptables -I FORWARD -m state -d &lt;load-balancer-subnet&gt;/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT
</code></pre>
<p>Edit: <a href="https://i.postimg.cc/mD00Fk4L/Screen-Shot-2022-04-06-at-22-04-02.png" rel="nofollow noreferrer">The nodes and traefik already showing the public ip</a></p>
<p>But response from outside the cluster still <code>curl: (56) Recv failure: Connection reset by peer</code></p>

joepa37
<p>At the end I solved using a simple nginx proxy stream (tcp,udp) to the MetalLB Load Balancer IP. Here is an example if someone else with this case.</p>
<pre><code>stream {

    # Redirect Web Requests
    upstream traefik_http {
        server 10.10.0.200:80;
    }
    server {
    listen [::]:80;
        listen 80;
    proxy_pass traefik_http;
    }

    # Redirect Websecure Requests
    upstream traefik_https {
        server 10.10.0.200:443;
    }
    server {
    listen [::]:443;
        listen 443;
        proxy_pass traefik_https;
    }
}
</code></pre>
