title: Ufw firewall blocks kubernetes (with calico)
body: <p>I'm trying to install a kubernetes cluster on my server (Debian 10). On my server I used ufw as firewall.
  Before creating the cluster I allowed these ports on ufw:</p>
  
  <blockquote>
    <p>179/tcp, 4789/udp, 5473/tcp, 443 /tcp, 6443/tcp, 2379/tcp, 4149/tcp, 10250/tcp, 10255/tcp, 10256/tcp, 9099/tcp, 6443/tcp </p>
  </blockquote>
  
  <p>As calico doc suggests (<a href="https://docs.projectcalico.org/getting-started/kubernetes/requirements" rel="noreferrer">https://docs.projectcalico.org/getting-started/kubernetes/requirements</a>) and this git repo on kubernetes security too (<a href="https://github.com/freach/kubernetes-security-best-practice" rel="noreferrer">https://github.com/freach/kubernetes-security-best-practice</a>).</p>
  
  <p>But when I want to create the cluster, the calico/node pod can't start because Felix is not live (I allowed 9099/tcp on ufw):</p>
  
  <blockquote>
    <p>Liveness probe failed: calico/node is not ready: Felix is not live: Get <a href="http://localhost:9099/liveness" rel="noreferrer">http://localhost:9099/liveness</a>: dial tcp [::1]:9099: connect: connection refused</p>
  </blockquote>
  
  <p>If I disable ufw, the cluster is created and there is no error.</p>
  
  <p>So I would like to know how I should configure ufw in order for kubernetes to work.
  If anyone could help me, it would be very great, thanks !</p>
  
  <p><strong>Edit: My ufw status</strong></p>
  
  <pre><code>To                         Action      From
  6443/tcp                   ALLOW       Anywhere
  9099                       ALLOW       Anywhere
  179/tcp                    ALLOW       Anywhere
  4789/udp                   ALLOW       Anywhere
  5473/tcp                   ALLOW       Anywhere
  2379/tcp                   ALLOW       Anywhere
  8181                       ALLOW       Anywhere
  8080                       ALLOW       Anywhere
  ###### (v6)                LIMIT       Anywhere (v6)              # allow ssh connections in
  Postfix (v6)               ALLOW       Anywhere (v6)
  KUBE (v6)                  ALLOW       Anywhere (v6)
  6443 (v6)                  ALLOW       Anywhere (v6)
  6783/udp (v6)              ALLOW       Anywhere (v6)
  6784/udp (v6)              ALLOW       Anywhere (v6)
  6783/tcp (v6)              ALLOW       Anywhere (v6)
  443/tcp (v6)               ALLOW       Anywhere (v6)
  80/tcp (v6)                ALLOW       Anywhere (v6)
  4149/tcp (v6)              ALLOW       Anywhere (v6)
  10250/tcp (v6)             ALLOW       Anywhere (v6)
  10255/tcp (v6)             ALLOW       Anywhere (v6)
  10256/tcp (v6)             ALLOW       Anywhere (v6)
  9099/tcp (v6)              ALLOW       Anywhere (v6)
  6443/tcp (v6)              ALLOW       Anywhere (v6)
  9099 (v6)                  ALLOW       Anywhere (v6)
  179/tcp (v6)               ALLOW       Anywhere (v6)
  4789/udp (v6)              ALLOW       Anywhere (v6)
  5473/tcp (v6)              ALLOW       Anywhere (v6)
  2379/tcp (v6)              ALLOW       Anywhere (v6)
  8181 (v6)                  ALLOW       Anywhere (v6)
  8080 (v6)                  ALLOW       Anywhere (v6)
  
  53                         ALLOW OUT   Anywhere                   # allow DNS calls out
  123                        ALLOW OUT   Anywhere                   # allow NTP out
  80/tcp                     ALLOW OUT   Anywhere                   # allow HTTP traffic out
  443/tcp                    ALLOW OUT   Anywhere                   # allow HTTPS traffic out
  21/tcp                     ALLOW OUT   Anywhere                   # allow FTP traffic out
  43/tcp                     ALLOW OUT   Anywhere                   # allow whois
  SMTPTLS                    ALLOW OUT   Anywhere                   # open TLS port 465 for use with SMPT to send e-mails
  10.32.0.0/12               ALLOW OUT   Anywhere on weave
  53 (v6)                    ALLOW OUT   Anywhere (v6)              # allow DNS calls out
  123 (v6)                   ALLOW OUT   Anywhere (v6)              # allow NTP out
  80/tcp (v6)                ALLOW OUT   Anywhere (v6)              # allow HTTP traffic out
  443/tcp (v6)               ALLOW OUT   Anywhere (v6)              # allow HTTPS traffic out
  21/tcp (v6)                ALLOW OUT   Anywhere (v6)              # allow FTP traffic out
  43/tcp (v6)                ALLOW OUT   Anywhere (v6)              # allow whois
  SMTPTLS (v6)               ALLOW OUT   Anywhere (v6)              # open TLS port 465 for use with SMPT to send e-mails
  </code></pre>
  
  <p>Sorry my ufw rules are a bit messy, I tried too many things to get kubernetes working.</p>