Restrict ingress traffic with IP allow-lists

The Quick Start Guide opens the NodePort range (30000-32767) to 0.0.0.0/0 so you can start exposing services right away. That rule is convenient, but it also means any host on the internet can reach any NodePort on your cluster, including services you may not have intended to publish.

This guide replaces that single open rule with two narrower ones, so traffic is only allowed from a restricted set of sources:

Source	Why it needs access
Your known IP address(es)	Lets you and your team reach NodePort services directly, e.g. for testing.
Exoscale’s NLB health-check sources	Required if you front your NodePort services with a Network Load Balancer, so it can perform health checks.

Everything else on the internet is denied by default, which significantly reduces the attack surface of your cluster.

Replace the open NodePort rule

You need to change this rule:

exo compute security-group rule add sks-security-group \
    --description "NodePort services" \
    --protocol tcp \
    --network 0.0.0.0/0 \
    --port 30000-32767

and replace it by the two rules below.

1. Allow NodePort traffic from your own IP

exo compute security-group rule add sks-security-group \
    --description "NodePort TCP services from Internet" \
    --protocol tcp \
    --network x.x.x.x/32 \
    --port 30000-32767

Note

Replace x.x.x.x/32 with an IP range that should be allowed to reach your service (your workstation, office egress IP, a monitoring probe, etc). Add as many rules as you have ranges to allow.

2. Allow NodePort traffic from the NLB health checks

exo compute security-group rule add sks-security-group \
    --description "Nodeport TCP services from NLB" \
    --protocol tcp \
    --port 30000-32767 \
    --public-security-group "public-nlb-healthcheck-sources"

Terraform

If you manage your infrastructure as code, the same two rules translate to:

resource "exoscale_security_group_rule" "nodeport_tcp_nlb" {
  security_group_id     = exoscale_security_group.my_sks_security_group.id
  description            = "Nodeport TCP service from NLB"
  type                   = "INGRESS"
  protocol               = "TCP"
  start_port             = 30000
  end_port               = 32767
  public_security_group  = "public-nlb-healthcheck-sources"
}

resource "exoscale_security_group_rule" "nodeport_service_mylaptop" {
  security_group_id = exoscale_security_group.my_sks_security_group.id
  description        = "NodePort services from a known IP"
  type               = "INGRESS"
  protocol           = "TCP"
  start_port         = 30000
  end_port           = 32767
  cidr               = "x.x.x.x/32"
}