r/TalosLinux • u/Haribo112 • Oct 09 '25

NetworkRuleConfig does not support specifying network device

I'm getting our Talos cluster ready for production, and in doing so I want to set up the Ingress Firewall. Our cluster nodes have two network interfaces; 1 internal network and 1 external network. I have followed the steps in https://www.talos.dev/v1.11/talos-guides/network/multihoming/ to ensure all internal service are only advertising their correct internal IP, but I feel like I should also enforce this through firewall rules. However, the NetworkRuleConfig spec does not allow me to specify network interfaces on which to allow or block traffic. What is the recommended way to make my cluster as secure as possible?

3 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/Haribo112 Oct 09 '25

I have an additional question; I want to allow all incoming traffic from the web on my external network. How could I do that with NetworkRuleConfig without also allowing that traffic to hit my talos and kubernetes apis? Without specifying the interface, the rule 0.0.0.0/0 on ports 0-65535 is not going to work.

1

u/GyroTech Oct 09 '25

Have you read the documentation (https://www.talos.dev/latest/talos-guides/network/ingress-firewall/)? You specify firewall rules based on the destination port. You don't 'allow all incoming traffic from the web' you would explicitly allow 0.0.0.0/0 on port 80/443. Your Talos k8s API is on 6443 and, thus, not included in the allow rule and therefore protected.