Firewall filter for subnet to allow access from Kubernetes pod?

Question

I have an instance that is on an internal subnet 10.128.0.0/20 with IP 10.128.0.53.

I have a kubernetes service defined as:

mysql           ExternalName   <none>         10.128.0.53   3306/TCP       151d

However strangely, if I set a firewall rule to only allow 10.128.0.0/20 or 10.128.0.0/9 to the instance (at 10.128.0.53), it won't connect. It's as if the k8s service is gaining access to the subnet by some other means (NAT?)?

What firewall rule do I apply to allow access? I do not want to have 0.0.0.0/0 as the source - as it is currently.

When the firewall rule was 0.0.0.0/0, the tshark dump is:

chris@mysql8-book-1-vm:~$ sudo tshark -f "tcp port 3306" -i any
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
    1 0.000000000  10.4.12.160 → 10.128.0.53  TCP 76 51818 → 3306 [SYN] Seq=0 Win=28400 Len=0 MSS=1420 SACK_PERM=1 TSval=2402747230 TSecr=0 WS=128
    2 0.000055238  10.128.0.53 → 10.4.12.160  TCP 76 3306 → 51818 [SYN, ACK] Seq=0 Ack=1 Win=28160 Len=0 MSS=1420 SACK_PERM=1 TSval=257905306 TSecr=2402747230 WS=128
    3 0.001203683  10.4.12.160 → 10.128.0.53  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=1 Win=28416 Len=0 TSval=2402747232 TSecr=257905306
    4 0.001685970  10.128.0.53 → 10.4.12.160  MySQL 146 Server Greeting proto=10 version=8.0.16
    5 0.002183066  10.4.12.160 → 10.128.0.53  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=79 Win=28416 Len=0 TSval=2402747233 TSecr=257905307
    6 10.006731817  10.128.0.53 → 10.4.12.160  TCP 68 3306 → 51818 [FIN, ACK] Seq=79 Ack=1 Win=28160 Len=0 TSval=257907808 TSecr=2402747233
    7 10.050067244  10.4.12.160 → 10.128.0.53  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=80 Win=28416 Len=0 TSval=2402757279 TSecr=257907808
    ```

Try [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to allow/restrict the access. Alternatively maybe istio? — Crou, Jul 01 '19 at 15:32

score 0 · Answer 1 · answered Sep 04 '19 at 14:58

If I understand it correctly, you have a GKE service running, and you would like other instances within the 10.128.0.0/20 to access your service.

One way of achieving it via FW rules is to create an ingress rule with source range 10.128.0.0/20 and target tag the GKE nodes network tags or alternatively the destination service account used by GKE, specifying port and protocol (in your case, TCP 3306).

Firewall filter for subnet to allow access from Kubernetes pod?

1 Answers1