A NodePort BPF service cannot be reached when:
- and L7 allow all policy is applied,
- and a request to the service is sent to a host which runs the service endpoint pod.
Sending the request to a host which SNATs the request and forwards it to the destination host works as expected.
The request (TCP SYN) enters the relevant TPROXY rule at the receiving host, and then disappears:
IN=cilium_net OUT= MAC=16:6a:8a:0b:7c:e0:36:d7:19:cb:ee:ec:08:00 SRC=192.168.34.11 DST=10.217.1.215 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=15285 DF PROTO=TCP SPT
=56576 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 MARK=0x1927020
A NodePort BPF service cannot be reached when:
Sending the request to a host which SNATs the request and forwards it to the destination host works as expected.
The request (TCP SYN) enters the relevant TPROXY rule at the receiving host, and then disappears: