Traffic to the 192.168.2.5 external IP is DNATed to the Traefik pod before NetworkPolicy is evaluated, so the 10.0.0.0/8 exclusion blocked VPN clients from reaching services behind the gateway.
Traffic to the 192.168.2.5 external IP is DNATed to the Traefik pod before NetworkPolicy is evaluated, so the 10.0.0.0/8 exclusion blocked VPN clients from reaching services behind the gateway.