From d55d7114631506f979c05c7867a45539a5a6f2f2 Mon Sep 17 00:00:00 2001 From: Karan Parashar Date: Wed, 28 Oct 2026 21:43:36 +0530 Subject: [PATCH] fix(wireguard): Allow egress to Traefik pod ports Traffic to the 192.168.2.5 external IP is DNATed to the Traefik pod before NetworkPolicy is evaluated, so the 10.0.0.0/8 exclusion blocked VPN clients from reaching services behind the gateway. --- apps/wireguard/networkpolicy.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/apps/wireguard/networkpolicy.yaml b/apps/wireguard/networkpolicy.yaml index 6525d72..9f2889a 100644 --- a/apps/wireguard/networkpolicy.yaml +++ b/apps/wireguard/networkpolicy.yaml @@ -17,6 +17,18 @@ spec: podSelector: matchLabels: k8s-app: kube-dns + - ports: + - port: 8000 + protocol: TCP + - port: 8443 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + podSelector: + matchLabels: + app.kubernetes.io/name: traefik - to: - ipBlock: cidr: 192.168.2.0/24