Every Syself node runs a default-deny host firewall. A workload that binds a port on the node itself, for example a pod with `hostNetwork: true`, is reachable over the network only after you allow that port.

A pod that publishes its port with `hostPort` instead needs no rule. Cilium hands each request to the pod before the host firewall checks it. See [Expose a reverse proxy without a load balancer](/docs/hetzner/apalla/network/expose/reverse-proxy-without-a-load-balancer#run-the-proxy-with-hostport).

## Allow the port

Apply a rule that allows the ports on the nodes that run the workload:

```yaml title="allow-node-ports.yaml"
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-node-ports
spec:
  nodeSelector:
    matchLabels:
      node.example.com/ingress: "true"
  ingress:
    - fromEntities: [world]
      toPorts:
        - ports:
            - {port: "80", protocol: TCP}
            - {port: "443", protocol: TCP}
```

The ports in the rule are the ones your workload binds. `world` covers a client reaching the node directly.

The `nodeSelector` must match the nodes the workload runs on. Set that label on the worker pool rather than with `kubectl label`, so nodes still carry it after they are replaced. See [Label nodes and assign roles](/docs/hetzner/apalla/servers-and-nodes/labels/label-nodes-and-assign-roles).

## If a Service is in front

With a Service in front of the workload, add `remote-node` as well. The node that receives the request may forward it to a backend on another node. It replaces the client's address with its own, so the second node sees the request coming from a node rather than from the internet. Leave `remote-node` out and that traffic is dropped silently.

A Service also opens a NodePort on every node, but the rule does not use that number. Cilium rewrites the NodePort to the workload's port before the host firewall sees the packet, so the rule still lists the workload's port.

## Keep the platform policies

The policy is yours to keep. The Syself platform restores its own policies (`base-rule-set`, `control-plane-rule-set`, `ssh-rule-set`), so never edit those or reuse their names. See [Segment with network policies](/docs/hetzner/apalla/security/segment-with-network-policies).

## Related

- [Ports and listeners](/docs/hetzner/apalla/security/ports-and-listeners), every port a node opens and who can reach it
- [Expose a reverse proxy without a load balancer](/docs/hetzner/apalla/network/expose/reverse-proxy-without-a-load-balancer), a proxy running on the nodes
- [Troubleshoot load balancers and service traffic](/docs/hetzner/apalla/network/debug/troubleshoot-load-balancers-and-services), how to read host firewall drops