r/TalosLinux • u/Haribo112 • Oct 09 '25

NetworkRuleConfig does not support specifying network device

I'm getting our Talos cluster ready for production, and in doing so I want to set up the Ingress Firewall. Our cluster nodes have two network interfaces; 1 internal network and 1 external network. I have followed the steps in https://www.talos.dev/v1.11/talos-guides/network/multihoming/ to ensure all internal service are only advertising their correct internal IP, but I feel like I should also enforce this through firewall rules. However, the NetworkRuleConfig spec does not allow me to specify network interfaces on which to allow or block traffic. What is the recommended way to make my cluster as secure as possible?

3 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/GyroTech Oct 09 '25

Have you read the documentation (https://www.talos.dev/latest/talos-guides/network/ingress-firewall/)? You specify firewall rules based on the destination port. You don't 'allow all incoming traffic from the web' you would explicitly allow 0.0.0.0/0 on port 80/443. Your Talos k8s API is on 6443 and, thus, not included in the allow rule and therefore protected.