title: how do i add firewall rules to allow nodeports accessed over virtual ip in kubernetes
body: <p>I have a kubernetes cluster where control planes are working in HA through keepalived's VIP configured among them(installed only on control nodes). Everything works as expected when firewall is disabled.
  all internal communications and nodePorts behave inconsistently when firewall is enabled. As a basic startup i have enabled certain mandatory ports which are required for kubernetes but this doesn't help for applications to communicate.
  Is there any way or add any firewall rules that helps me to access the nodePorts/application services?</p>
  
  <p>Incase if i'm unclear, this is a small summary</p>
  
  <p>Control Plane 1: 172.16.23.110</p>
  
  <p>Control Plane 2: 172.16.23.111</p>
  
  <p>Control Plane 3: 172.16.23.112</p>
  
  <p>Keepalived VIP: 172.16.23.116</p>
  
  <p>Worker Nodes : 172.16.23.120-23.125</p>
  
  <p>I'm trying to access service through nodePort like <a href="https://172.16.23.116:30443" rel="nofollow noreferrer">https://172.16.23.116:30443</a></p>
  
  <p>i have added below firewall case across all nodes(all nodes are centos7.6)</p>
  
  <pre><code>cat /etc/firewalld/zones/internal.xml
  
  &lt;rule&gt;
      &lt;protocol value="vrrp" /&gt;
      &lt;accept /&gt;
  &lt;/rule&gt;
  </code></pre>
  
  <p>Kindly help</p>