#允许控制节点
iptables -A INPUT -s master-node -p tcp --dport 6443 -j ACCEPT
#允许数据节点
iptables -A INPUT -s data-node -p tcp --dport 6443 -j ACCEPT
#允许k8s内部服务网段
iptables -A INPUT -s 10.40.0.0/16 -p tcp --dport 6443 -j ACCEPT
#允许k8s内部POD网段
iptables -A INPUT -s 172.20.0.0/16 -p tcp --dport 6443 -j ACCEPT
#允许k8s内部DNS网段
iptables -A INPUT -s 169.254.0.0/16 -p tcp --dport 6443 -j ACCEPT
#允许本机IP
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 6443 -j ACCEPT
iptables -A INPUT -p tcp --dport 6443 -j DROP
#同样方式处理2379（etcd-client）、2380（etcd-server）、10250、10257、10259端口
#延迟保存，确保集群没问题后持久化
iptables-save > /etc/iptables/rules.v4
Control plane
|
Protocol | Direction | Port Range | Purpose | Used By |
|---|---|---|---|---|
| TCP | Inbound | 6443 | Kubernetes API server | All |
| TCP | Inbound | 2379-2380 | etcd server client API | kube-apiserver, etcd |
| TCP | Inbound | 10250 | Kubelet API | Self, Control plane |
| TCP | Inbound | 10259 | kube-scheduler | Self |
| TCP | Inbound | 10257 | kube-controller-manager | Self |
Worker node(s)
| Protocol | Direction | Port Range | Purpose | Used By |
|---|---|---|---|---|
| TCP | Inbound | 10250 | Kubelet API | Self, Control plane |
| TCP | Inbound | 10256 | kube-proxy | Self, Load balancers |
| TCP | Inbound | 30000-32767 | NodePort Services† | All |