<p>Good afternoon,</p>
<p>i'd like to ask.
im a &quot;little&quot; bit upset regarding ingress and its traffic flow</p>
<p>i created test nginx deployment with service and ingress. ( in titaniun cloud )</p>
<p>i have no direct connect via browser so im using tunneling to get access via browser abd sock5 proxy in firefox.</p>
<p>deployment:</p>
<pre><code>k describe  deployments.apps dpl-nginx
Name:                   dpl-nginx
Namespace:              xxx
CreationTimestamp:      Thu, 09 Jun 2022 07:20:48 +0000
Labels:                 &lt;none&gt;
Annotations:            deployment.kubernetes.io/revision: 1
                        field.cattle.io/publicEndpoints:
                          [{&quot;port&quot;:32506,&quot;protocol&quot;:&quot;TCP&quot;,&quot;serviceName&quot;:&quot;xxx:xxx-svc&quot;,&quot;allNodes&quot;:true},{&quot;addresses&quot;:[&quot;172.xx.xx.117&quot;,&quot;172.xx.xx.131&quot;,&quot;172.xx.x...
Selector:               app=xxx-nginx
Replicas:               2 desired | 2 updated | 2 total | 2 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:  app=xxx-nginx
  Containers:
   nginx:
    Image:        nginx
    Port:         80/TCP
    Host Port:    0/TCP
    Environment:  &lt;none&gt;
    Mounts:
      /usr/share/nginx/html/ from nginx-index-file (rw)
  Volumes:
   nginx-index-file:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      index-html-configmap
    Optional:  false
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Available      True    MinimumReplicasAvailable
  Progressing    True    NewReplicaSetAvailable
OldReplicaSets:  &lt;none&gt;
NewReplicaSet:   xxx-dpl-nginx-6ff8bcd665 (2/2 replicas created)
Events:          &lt;none&gt;
</code></pre>
<p>service:</p>
<pre><code>Name:                     xxx-svc
Namespace:                xxx
Labels:                   &lt;none&gt;
Annotations:              field.cattle.io/publicEndpoints: [{&quot;port&quot;:32506,&quot;protocol&quot;:&quot;TCP&quot;,&quot;serviceName&quot;:&quot;xxx:xxx-svc&quot;,&quot;allNodes&quot;:true}]
Selector:                 app=xxx-nginx
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.43.95.33
IPs:                      10.43.95.33
Port:                     http-internal  888/TCP
TargetPort:               80/TCP
NodePort:                 http-internal  32506/TCP
Endpoints:                10.42.0.178:80,10.42.0.179:80
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   &lt;none&gt;
</code></pre>
<p>ingress:</p>
<pre><code>Name:             test-ingress
Namespace:        xxx
Address:          172.xx.xx.117,172.xx.xx.131,172.xx.xx.132
Default backend:  default-http-backend:80 (&lt;error: endpoints &quot;default-http-backend&quot; not found&gt;)
Rules:
  Host                   Path  Backends
  ----                   ----  --------
  test.xxx.io
                         /   xxx-svc:888 (10.42.0.178:80,10.42.0.179:80)
Annotations:             field.cattle.io/publicEndpoints:
                           [{&quot;addresses&quot;:[&quot;172.xx.xx.117&quot;,&quot;172.xx.xx.131&quot;,&quot;172.xx.xx.132&quot;],&quot;port&quot;:80,&quot;protocol&quot;:&quot;HTTP&quot;,&quot;serviceName&quot;:&quot;xxx:xxx-svc&quot;,&quot;ingressName...
                         nginx.ingress.kubernetes.io/proxy-read-timeout: 3600
                         nginx.ingress.kubernetes.io/rewrite-target: /
                         nginx.ingress.kubernetes.io/ssl-redirect: false
Events:
  Type    Reason  Age                     From                      Message
  ----    ------  ----                    ----                      -------
  Normal  Sync    9m34s (x37 over 3d21h)  nginx-ingress-controller  Scheduled for sync
</code></pre>
<p>when i try curl/wget to host / nodeIP ,direcly from cluster , both option works, i can get my custom index</p>
<pre><code> wget test.xxx.io --no-proxy  --no-check-certificate                                                                                                   
--2022-06-13 10:35:12--  http://test.xxx.io/     
Resolving test.xxx.io (test.xxx.io)... 172.xx.xx.132, 172.xx.xx.131, 172.xx.xx.117
Connecting to test.xxx.io (test.xxx.io)|172.xx.xx.132|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 197 [text/html]
Saving to: ‘index.html.1’

index.html.1                                 100%[===========================================================================================&gt;]     197  --.-KB/s    in 0s 
</code></pre>
<p>curl:</p>
<pre><code>curl    test.xxx.io   --noproxy '*'     -I
HTTP/1.1 200 OK
Date: Mon, 13 Jun 2022 10:36:31 GMT
Content-Type: text/html
Content-Length: 197
Connection: keep-alive
Last-Modified: Thu, 09 Jun 2022 07:20:49 GMT
ETag: &quot;62a19f51-c5&quot;
Accept-Ranges: bytes
</code></pre>
<p>nslookup</p>
<pre><code>nslookup,dig,ping from cluster is working as well:
nslookup test.xxx.io
Server:         127.0.0.53   
Address:        127.0.0.53#53

Name:   test.xxx.io
Address: 172.xx.xx.131       
Name:   test.xxx.io
Address: 172.xx.xx.132       
Name:   test.xxx.io
Address: 172.xx.xx.117
</code></pre>
<p>dig</p>
<pre><code>dig test.xxx.io +noall +answer
test.xxx.io.  22      IN      A       172.xx.xx.117
test.xxx.io.  22      IN      A       172.xx.xx.132
test.xxx.io.  22      IN      A       172.xx.xx.131
</code></pre>
<p>ping</p>
<pre><code>ping test.xxx.io
PING test.xxx.io (172.xx.xx.132) 56(84) bytes of data.
64 bytes from xx-k3s-1 (172.xx.xx.132): icmp_seq=1 ttl=64 time=0.038 ms
64 bytes from xx-k3s-1 (172.xx.xx.132): icmp_seq=2 ttl=64 time=0.042 ms
</code></pre>
<p>also from ingress nginx pod curl works fine...
in firefox via <code>nodeIP:port</code>, i can get index, but via host its not possible</p>
<p>seems that ingress forwarding traffic to the pod, but is this issue only something to do with browser ?</p>
<p>Thanks for any advice</p>

ladislav
<p>so for clarification,</p>
<p>as I'm using tunneling to reach ingress from local pc via browser with SOCKS5 proxy.</p>
<pre><code>ssh  xxxx@100.xx.xx.xx -D 1090
</code></pre>
<p>solution is trivial, add</p>
<pre><code>172.xx.xx.117   test.xxx.io
</code></pre>
<p>into <em>/etc/hosts</em> on jump server.</p>
