Connection refused from pods to internet 80 / 443 - no problem on DNS resolution and ICMP ping #4006
Description
What happened:
I was using kind for a while + example nginx configuration without any problem. But, I now have a problem when I install ingress-nginx as explained in the documentation.
And actually, all pods have the same problem. I cannot use output ports 80/443. But, ICMP works.
What you expected to happen:
To be able to contact internet with HTTP(s) protocol.
How to reproduce it (as minimally and precisely as possible):
This is my script:
#!/bin/bash
VERSION=${1-1.34.0}
function yesno() {
question=$1
default=${2:-y}
read -p "$question (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
return 0
else
return 1
fi
}
# Check helm, kubectl and kind
NEEDED=""
for cmd in helm kubectl kind; do
if ! command -v $cmd >/dev/null 2>&1; then
NEEDED="$NEEDED $cmd"
fi
done
if [ -n "$NEEDED" ]; then
echo "Please install $NEEDED"
exit 1
fi
# check if a kind cluster is present
if kind get clusters | grep -q kind; then
yesno "A kind cluster is present, do you want to delete it?"
if [ $? -ne 0 ]; then
exit 1
fi
fi
# check if the user can open 80 and 443 ports
if [ $(sysctl -n net.ipv4.ip_unprivileged_port_start) -gt 80 ]; then
yesno "Ports 80 and 443 are not open for unprivileged users, you need to run this as root or whith sudo privileges:\n\nsysctl -w net.ipv4.ip_unprivileged_port_start=80\n\nWould you like to apply this? (It will ask for your sudo password)"
if [ $? -ne 0 ]; then
exit 1
fi
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80
if [ $? -ne 0 ]; then
exit 1
fi
fi
# start ${DIALOG} progress pulstation in background and wait message from fifo
echo "Droping Kind Cluster"
kind delete cluster >/dev/null 2>&1
# using podman, at this time, there is a problem with the kind network create
# with ipv6
command -v docker || (
echo "Dropping Podman Network and recreate it"
podman network rm kind
)
echo "Creating Kind Cluster"
cat <<EOF | kind create cluster --config=- || exit 1
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
image: kindest/node:v${VERSION}
extraPortMappings:
- containerPort: 80
hostPort: 80
protocol: TCP
- containerPort: 443
hostPort: 443
protocol: TCP
EOF
echo "Waiting for cluster to be ready"
kubectl wait --for=condition=Ready nodes --all --timeout=60s >/dev/null 2>&1
echo "Installing Ingress Controller"
kubectl apply -f https://kind.sigs.k8s.io/examples/ingress/deploy-ingress-nginx.yaml
echo "Done"I tried to create kind network with "--ipv6" and set "dual" ipFamily in the configuration, the error is still the same.
kubectl create ns test
kubectl run --rm -it foo --image=alpine -- sh
#
#
# This is OK
ping 8.8.8.8
#
wget https://www.google.com
# or
curl https://www.google.com
# connection refused
# with IP, same problem, it's not a DNS resolution problem
nc -vz www.metal3d.org 443
# error, connection refused to <the ip of my website>Anything else we need to know?:
It worked great at least 1 month ago. I tried to downgrade the node image without success...
Environment:
- kind version: (use
kind version): kind v0.30.0 go1.25.0 linux/amd64 - Runtime info: (use
docker info,podman infoornerdctl info):
host:
arch: amd64
buildahVersion: 1.41.3
cgroupControllers:
- cpu
- io
- memory
- pids
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon-2.1.13-1.fc42.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.1.13, commit: '
cpuUtilization:
idlePercent: 90.28
systemPercent: 4.4
userPercent: 5.32
cpus: 12
databaseBackend: sqlite
distribution:
distribution: fedora
variant: workstation
version: "42"
emulatedArchitectures:
- linux/arm
- linux/arm64
- linux/arm64be
- linux/loong64
- linux/mips
- linux/mips64
- linux/ppc
- linux/ppc64
- linux/ppc64le
- linux/riscv32
- linux/riscv64
- linux/s390x
eventLogger: journald
freeLocks: 2032
hostname: patrice-laptop
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
kernel: 6.16.4-200.fc42.x86_64
linkmode: dynamic
logDriver: journald
memFree: 1065701376
memTotal: 29256400896
networkBackend: netavark
networkBackendInfo:
backend: netavark
dns:
package: aardvark-dns-1.16.0-1.fc42.x86_64
path: /usr/libexec/podman/aardvark-dns
version: aardvark-dns 1.16.0
package: netavark-1.16.1-1.fc42.x86_64
path: /usr/libexec/podman/netavark
version: netavark 1.16.1
ociRuntime:
name: crun
package: crun-1.23.1-1.fc42.x86_64
path: /usr/bin/crun
version: |-
crun version 1.23.1
commit: d20b23dba05e822b93b82f2f34fd5dada433e0c2
rundir: /run/user/1000/crun
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
os: linux
pasta:
executable: /usr/bin/pasta
package: passt-0^20250805.g309eefd-2.fc42.x86_64
version: |
pasta 0^20250805.g309eefd-2.fc42.x86_64
Copyright Red Hat
GNU General Public License, version 2 or later
<https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
remoteSocket:
exists: true
path: /run/user/1000/podman/podman.sock
rootlessNetworkCmd: pasta
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: true
serviceIsRemote: false
slirp4netns:
executable: ""
package: ""
version: ""
swapFree: 4915986432
swapTotal: 8589930496
uptime: 144h 16m 37.00s (Approximately 6.00 days)
variant: ""
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries:
search:
- registry.fedoraproject.org
- registry.access.redhat.com
- docker.io
store:
configFile: /home/metal3d/.config/containers/storage.conf
containerStore:
number: 7
paused: 0
running: 5
stopped: 2
graphDriverName: overlay
graphOptions: {}
graphRoot: /home/metal3d/.local/share/containers/storage
graphRootAllocated: 510405902336
graphRootUsed: 360688762880
graphStatus:
Backing Filesystem: btrfs
Native Overlay Diff: "true"
Supports d_type: "true"
Supports shifting: "false"
Supports volatile: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 520
runRoot: /run/user/1000/containers
transientStore: false
volumePath: /home/metal3d/.local/share/containers/storage/volumes
version:
APIVersion: 5.6.0
BuildOrigin: Fedora Project
Built: 1755216000
BuiltTime: Fri Aug 15 02:00:00 2025
GitCommit: da671ef6cfa3fc9ac6225c18f1dd0a70a951e43f
GoVersion: go1.24.6
Os: linux
OsArch: linux/amd64
Version: 5.6.0
- OS (e.g. from
/etc/os-release): Fedora 42 - Kubernetes version: (use
kubectl version):
Client Version: v1.34.0
Kustomize Version: v5.7.1
Server Version: v1.34.0
- Any proxies or other special environment settings?: no