title: How to allow external traffic and deny inter pod communication using network policy?
body: <p>I am setting up my default namespace in my kubernetes cluster to allow incoming traffic from external nodes/hosts but deny any possible inter pod communication. I have 2 nginx pods which I want to completely isolate inside the cluster. Both pods are exposed with a service of the type nodePort and they are accessible from outside.</p>
  
  <p>I first apply the following default deny network policy:</p>
  
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: default-deny
  spec:
    podSelector: {}
    policyTypes:
    - Ingress
  </code></pre>
  
  <p>Then, I try allowing external traffic with the following network policy:</p>
  
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: allow-external
  spec:
    podSelector: {}
    ingress:
      - from:
          - ipBlock:
              cidr: 192.168.0.0/16
  </code></pre>
  
  <p>But unfortunately I am not able to access the service either from outside and inside my cluster.</p>
  
  <p>Running example in:
  - macOS High Sierra v10.13.6
  - minikube v1.5.2 --> with network plugin = cilium
  - kubectl v1.16.2</p>
  
  <p>How could I face this problem?</p>