Recipe: Your corporate firewall blocks accessing remote Kubernetes NodePorts.

Scenario

Your work involves using a corporate network for Internet access, which blocks accessing anything other than port 22/80/443 on a remote server.

Example

Kubernetes services deployed with NodePorts use a high TCP port range ~ 30000 which is blocked

Solution 1 - SSH tunnel

Run the following:

ssh -L 31112:127.0.0.1:31112 [email protected]

Then access the service via http://127.0.0.1:31112/

Solution 2 - reverse proxy

Install a reverse proxy to route traffic from port 80 to your high port, use different hostnames if you have multiple services.

Let's route NodePort 31112 from OpenFaaS to port 80.

Perform all these steps on your remote cloud instance / server.

Install Nginx

apt install -qy nginx

Create config

/etc/nginx/conf.d/openfaas.conf

server {
    listen 80;
    server_name _;

    location / {
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    Host      $http_host;
        proxy_pass          http://127.0.0.1:31112;
    }
}

Here port 80 on any "Host" name will be redirected to the NodePort 31112 on the machine where you installed NGinx.

To add other entries, just specify a server_name for them and then add an entry to /etc/hosts or register a domain for ecah port.

If other ports than 80 are allowed, then you could also use these to access other NodePorts.

Reload the config

sudo systemctl daemon-reload
sudo systemctl restart nginx

Prosper

Now access the OpenFaaS UI via port 80.

Didn't work?

Check the logs

systemctl status nginx.service

Test the config

Test

nginx -t

Test and print result

nginx -T

Check for conflicting default config files

You may have another, default configuration file for NGinx which is conflicting with your new config file. Look for default.conf or similar one level down from the /etc/nginx/ folder and remove it. It may be in /etc/nginx/sites-available/ or /etc/nginx/conf.d or similar.

alexellis/README.md