0

After deploying all kubernetes ressources I wanna open port 443. I added it to my whitelist table but it is still closed. Same already happened to me for port 80. After flushing all tables, deleting all kubernetes ressources and setup the firewall from scratch (including whitelisted port 80) before deploying kubernetes again port 80 was finally open.

Now I prefer understanding why I can not open port 443 instead of doing all that again. I found out that there is the table KUBE-FIREWALL (see below), which blocks everything by default.

And this is my main question:

Does the rules of KUBE-FIREWALL have a higher priority than my table TCP? And if, how I can change the priority?


INPUT

Chain INPUT (policy DROP)
target     prot opt source               destination         
cali-INPUT  all  --  anywhere             anywhere             /* cali:Cz_u1IQiXIMmKD4c */
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request ctstate NEW
UDP        udp  --  anywhere             anywhere             ctstate NEW
TCP        tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
REJECT     udp  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             reject-with tcp-reset
REJECT     all  --  anywhere             anywhere             reject-with icmp-proto-unreachable

cali-INPUT

Chain cali-INPUT (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000
cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */
MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff
cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */
ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000

KUBE-FIREWALL

Chain cali-INPUT (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             /* cali:msRIDfJRWnYwzW4g */ mark match 0x10000/0x10000
cali-wl-to-host  all  --  anywhere             anywhere            [goto]  /* cali:y4fKWmWkTnYGshVX */
MARK       all  --  anywhere             anywhere             /* cali:JnMb-hdLugWL4jEZ */ MARK and 0xfff0ffff
cali-from-host-endpoint  all  --  anywhere             anywhere             /* cali:NPKZwKxJ-5imzORj */
ACCEPT     all  --  anywhere             anywhere             /* cali:aes7S4xZI-7Jyw63 */ /* Host endpoint policy accepted packet. */ mark match 0x10000/0x10000
claus@vmd33301:~$ sudo iptables -L KUBE-FIREWALL
Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

TCP

Chain TCP (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
1

Edit 2

The port was closed because nothing was listening to it :)

Edit 1

The list order is important, but the KUBE-FIREWALL only drops marked packages. I missed the mark match 0x8000/0x8000 at the end of the rule. Therefore it should work. My guess is that one of the cali rules (or fail2ban?) claims port 443. There is no way to know without the full iptables output.

--- Original answer below ---

Yes, TCP has a lower priority because it is lower in the list. Not only is the KUBE-FIREWALL chain evaluated before your TCP chain, it ends in a rule that DROPs all remaining traffic. Your TCP rule is therefore never evaluated.

You can insert your TCP chain entrypoint above the KUBE-FIREWALL chain using iptables -I INPUT ... or insert it in above a specific line number using iptables -I INPUT 2 ... (to insert above line 2). You can see the line numbers by adding --line-numbers to your iptables command. (iptables -nvL --line-numbers)

  • This does not work somehow. Btw, port 80 and port 22 still work, so either kubernetes take care about them somewhere else or priority is not for the full table. – elp Jan 7 '19 at 20:14
  • Some chains do seem to be missing in the output. Is this the compete output of sudo iptables -nvL? And are you using ipv6? If so, could you also add the output of sudo ipt6ables -nvL? – Johan Jan 7 '19 at 21:11
  • No, there are missing like 50 tables :D this is such a mess.... I am using ipv6 I am especially testing ipv4 right now. – elp Jan 8 '19 at 8:03
  • 1
    Ah, so any port where no listener is running is closed, I understand. Well, I used nmap from an external system which is working. So probably it was working all the time? :facepalm: – elp Jan 8 '19 at 11:19
  • 1
    Okay, the root of the problem was that my nginx proxy was not listening on port 443... So this is solved, I am able to open ports afterwards. Thanks for your help, you saved my day :D – elp Jan 8 '19 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.