<p>I've setup an ingress resource to route requests to single service.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    #kubernetes.io/ingress.class: nginx
    #ingress.kubernetes.io/rewrite-target: /

spec:
  defaultBackend:
    service:
      name: dashboard
      port:
        number: 80
</code></pre>
<pre class="lang-sh prettyprint-override"><code>$ kubectl get ing
NAME              CLASS    HOSTS   ADDRESS         PORTS   AGE
example-ingress   &lt;none&gt;   *       102.16.50.202   80      3m28s
</code></pre>
<p>The nginx-controller:</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl get pods -n ingress-nginx
NAME                                        READY   STATUS      RESTARTS      AGE
ingress-nginx-admission-create--1-gl59f     0/1     Completed   0             15h
ingress-nginx-admission-patch--1-9kbz6      0/1     Completed   0             15h
ingress-nginx-controller-54d8b558d4-2ss8f   1/1     Running     1 (13h ago)   15h

$ kubectl get svc -n ingress-nginx
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.48.242   102.16.50.202   80:31690/TCP,443:32666/TCP   15h
ingress-nginx-controller-admission   ClusterIP      10.233.17.68    &lt;none&gt;          443/TCP                      15h
</code></pre>
<p>I'm able to reach and get response from the service via the controller's cluster IP:</p>
<pre class="lang-sh prettyprint-override"><code>$ curl -i 10.233.48.242
HTTP/1.1 200 OK
Date: Tue, 08 Feb 2022 04:50:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2306
Connection: keep-alive
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 25 Jan 2022 09:35:14 GMT
ETag: W/&quot;902-17e9096e050&quot;
...
</code></pre>
<p>But not on its (nginx-controller's) external IP address:</p>
<pre class="lang-sh prettyprint-override"><code>$ curl -i 102.16.50.202
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused

$ curl -i http://102.16.50.202
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused

$ curl -i http://102.16.50.202/
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused
</code></pre>
<p>I tried creating a new path (prefix), changed service type to NodePort, disabled the firewall, with no success; same issue.</p>
<p>Any observation or input would help a lot. Thanks.</p>
<h5>Edit-1:</h5>
<p>The nginx ingress controller is installed (<code>kubectl apply</code>) without modifying the <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml" rel="nofollow noreferrer">default configuration</a>:</p>
<pre class="lang-yaml prettyprint-override"><code>#file: ingress-controller-deploy.yml
...
apiVersion: v1
kind: Service
metadata:
  annotations:
  labels:
    helm.sh/chart: ingress-nginx-4.0.15
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 1.1.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ipFamilyPolicy: SingleStack
  ipFamilies:
    - IPv4
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
      appProtocol: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
      appProtocol: https
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller
</code></pre>
<p>The <a href="https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies" rel="nofollow noreferrer">externalTrafficPolicy:Local</a> seems to be ok if I'm using a load balancer, which in my case is <a href="https://metallb.universe.tf/" rel="nofollow noreferrer">MetalLB </a>.</p>
<pre class="lang-yaml prettyprint-override"><code>#file: ingress-controller-deploy.yml
apiVersion: apps/v1
kind: Deployment
...
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            runAsUser: 101
            allowPrivilegeEscalation: true
</code></pre>
<p>The <code>securityContext</code> section seems ok too.</p>

Deepak D
<p>I was facing exactly the same issue on my bare metal setup. Only difference was that I was using <a href="http://kube-vip.chipzoller.dev" rel="nofollow noreferrer">kube-vip</a> instead of MetalLB. It was finally fixed when I changed the  <code>externalTrafficPolicy</code> on <code>ingress-nginx-controller</code> service to <code>Cluster</code>.</p>
<p>I'm unable to reason why, but the closest I could come up with is that the Loadbalancer IP was acquired by <code>node-1</code> of my bare metal setup, whereas the web frontend was scheduled on <code>node-2</code></p>
