Open a port on the nodes

Every Syself node runs a default-deny host firewall. A workload that binds a port on the node itself, for example a pod with hostNetwork: true, is reachable over the network only after you allow that port.

A pod that publishes its port with hostPort instead needs no rule. Cilium hands each request to the pod before the host firewall checks it. See Expose a reverse proxy without a load balancer .

Allow the port 

Apply a rule that allows the ports on the nodes that run the workload:

				apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-node-ports
spec:
  nodeSelector:
    matchLabels:
      node.example.com/ingress: "true"
  ingress:
    - fromEntities: [world]
      toPorts:
        - ports:
            - {port: "80", protocol: TCP}
            - {port: "443", protocol: TCP}
			

The ports in the rule are the ones your workload binds. world covers a client reaching the node directly.

The nodeSelector must match the nodes the workload runs on. Set that label on the worker pool rather than with kubectl label, so nodes still carry it after they are replaced. See Label nodes and assign roles .

If a Service is in front 

With a Service in front of the workload, add remote-node as well. The node that receives the request may forward it to a backend on another node. It replaces the client's address with its own, so the second node sees the request coming from a node rather than from the internet. Leave remote-node out and that traffic is dropped silently.

A Service also opens a NodePort on every node, but the rule does not use that number. Cilium rewrites the NodePort to the workload's port before the host firewall sees the packet, so the rule still lists the workload's port.

Keep the platform policies 

The policy is yours to keep. The Syself platform restores its own policies (base-rule-set, control-plane-rule-set, ssh-rule-set), so never edit those or reuse their names. See Segment with network policies .

Related 

• Ports and listeners , every port a node opens and who can reach it
• Expose a reverse proxy without a load balancer , a proxy running on the nodes
• Troubleshoot load balancers and service traffic , how to read host firewall drops