UFW Blocking Kubernetes Traffic on Ubuntu 24.04 LTS

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Pods cannot reach services and cluster nodes show connection errors.

Environment & Reproduction

Seen on Ubuntu 24.04 nodes where UFW defaults deny forwarding.

Root Cause Analysis

Firewall policy blocks CNI bridge traffic and Kubernetes control-plane ports.

Quick Triage

Check sudo ufw status verbose and sudo iptables -S FORWARD.

Step-by-Step Diagnosis

Validate required ports and inspect dropped packets with sudo journalctl -u ufw -n 80.

Solution – Primary Fix

Set DEFAULT_FORWARD_POLICY=”ACCEPT” in /etc/default/ufw, allow Kubernetes ports, then run sudo ufw reload.

Solution – Alternative Approaches

Temporarily disable UFW for isolation testing using sudo ufw disable.

Verification & Acceptance Criteria

kubectl get nodes is Ready and pod-to-service communication succeeds.

Rollback Plan

Restore prior /etc/default/ufw and rule set from backup.

Prevention & Hardening

Document required cluster ports and codify firewall rules in provisioning.

Related Errors & Cross-Refs

Related: CoreDNS timeouts and failed CNI setup.

Related tutorial: View the step-by-step tutorial for Ubuntu 24.04 LTS.

View all Ubuntu 24.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Kubernetes networking prerequisites and UFW documentation.