A school-district NodePort Service works from inside the cluster but workstations on the LAN cannot reach the node’s NodePort. The Service and Endpoints are correct. What is a common external cause?
Select an answer to reveal the explanation.
Short Explanation
The Service can be picture-perfect and the node still slam the door—host firewalls love to block those high NodePorts. Check the gate on the host, not just the Kubernetes objects.
Full Explanation
NodePort publishes on the node’s IP, so host firewalls, cloud security groups, or network ACLs can block external clients even when in-cluster tests succeed. CoreDNS does not map NodePort numbers for browsers; Ingress classes and PVC accessModes are not the typical cause of this pattern.