Firewall blocks all traffic

[runningman84]

I have configured a firewall for my 3 node test setup in Virtualbox. All vms are running in bridge mode.

My own machine is using some ip from 10.0.30.x network and I cannot access the nodes anymore after apply-config/bootstrap. All nodes are health and seem to talk to each other and the internet.

The firewall config is from the defaults and I do not see why it is blocking my access with talosctl.

It would also be great to have a switch on the dashboard to enable or disable the firewall in the network settings (at least for debug purpose).

version: v1alpha1
debug: false
persist: true
machine:
  type: controlplane
  token: xxx
  ca:
    crt: xxx
    key: zzz
  certSANs:
    - 10.0.30.81
    - 10.0.30.82
    - 10.0.30.83
  kubelet:
    extraArgs:
      feature-gates: GracefulNodeShutdown=true
      rotate-server-certificates: "true"
    extraMounts:
      - destination: /var/lib/longhorn
        type: bind
        source: /var/lib/longhorn
        options:
          - bind
          - rshared
          - rw
      - destination: /var/lib/local-path-provisioner
        type: bind
        source: /var/lib/local-path-provisioner
        options:
          - bind
          - rshared
          - rw
    defaultRuntimeSeccompProfileEnabled: true
    disableManifestsDirectory: true
  network:
    hostname: master1
    interfaces:
      - interface: eth0
        addresses:
          - 10.0.30.81
        routes:
          - network: 0.0.0.0/0
            gateway: 10.0.30.1
        mtu: 1500
        dhcp: false
        vip:
          ip: 10.0.30.80
    nameservers:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    disableSearchDomain: true
  install:
    disk: /dev/nvme0n1
    extraKernelArgs:
      - net.ifnames=0
    image: factory.talos.dev/installer/7ee1da4e8888372f40530698af9ca959093eb9bc54e9366922e02e70681477d4:v1.6.7
    wipe: false
  features:
    rbac: true
    stableHostname: true
    apidCheckExtKeyUsage: true
    diskQuotaSupport: true
    kubePrism:
      enabled: true
      port: 7445
  kernel:
    modules:
      - name: zfs
cluster:
  id: zzz
  secret: xxx
  controlPlane:
    endpoint: https://10.0.30.80:6443
  clusterName: k8s-dev
  network:
    dnsDomain: cluster.local
    podSubnets:
      - 10.244.0.0/16
    serviceSubnets:
      - 10.96.0.0/12
  token: zzz
  secretboxEncryptionSecret:xxx
  ca:
    crt: zzz
    key: xxx
  aggregatorCA:
    crt: xxx
    key: zzz
  serviceAccount:
    key: ccc
  apiServer:
    certSANs:
      - 10.0.30.80
      - home-cluster-dev.local
      - k8s-dev.home.hellmi.de
    disablePodSecurityPolicy: true
    admissionControl:
      - name: PodSecurity
        configuration:
          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
          defaults:
            audit: restricted
            audit-version: latest
            enforce: baseline
            enforce-version: latest
            warn: restricted
            warn-version: latest
          exemptions:
            namespaces:
              - kube-system
            runtimeClasses: []
            usernames: []
          kind: PodSecurityConfiguration
    auditPolicy:
      apiVersion: audit.k8s.io/v1
      kind: Policy
      rules:
        - level: Metadata
  controllerManager: {}
  proxy:
    extraArgs:
      metrics-bind-address: 0.0.0.0:10249
  scheduler: {}
  discovery:
    enabled: true
    registries:
      kubernetes:
        disabled: true
      service: {}
  etcd:
    ca:
      crt: xxx
      key: zzz
  extraManifests:
    - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
  allowSchedulingOnControlPlanes: true
---
apiVersion: v1alpha1
kind: NetworkDefaultActionConfig
ingress: block
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: kubelet-ingress
portSelector:
  ports:
    - 10250
  protocol: tcp
ingress:
  - subnet: 10.0.30.0/24
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: apid-ingress
portSelector:
  ports:
    - 50000
  protocol: tcp
ingress:
  - subnet: 0.0.0.0/0
  - subnet: ::/0
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: trustd-ingress
portSelector:
  ports:
    - 50001
  protocol: tcp
ingress:
  - subnet: 10.0.30.0/24
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: kubernetes-api-ingress
portSelector:
  ports:
    - 6443
  protocol: tcp
ingress:
  - subnet: 0.0.0.0/0
  - subnet: ::/0
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: etcd-ingress
portSelector:
  ports:
    - 2379-2380
  protocol: tcp
ingress:
  - subnet: 10.0.30.81/32
  - subnet: 10.0.30.82/32
  - subnet: 10.0.30.83/32
---
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: cni-vxlan
portSelector:
  ports:
    - 4789
  protocol: udp
ingress:
  - subnet: 10.0.30.0/24

[smira]

What is the error you're getting trying to access the node?

[runningman84]

I got a timeout but I think that probably was caused by some network issue in virtualbox