--- title: Troubleshooting Kubernetes Networking Issues | daily.dev description: A practical troubleshooting guide covering common Kubernetes networking failures encountered across many deployments: kernel IP forwarding and bridge-netfilter... canonical: https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Troubleshooting Kubernetes Networking Issues | daily.dev og:description: A practical troubleshooting guide covering common Kubernetes networking failures encountered across many deployments: kernel IP forwarding and bridge-netfilter... og:url: https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9 og:image: https://api.daily.dev/og/posts/YRdZsGpK9.png og:image:alt: Troubleshooting Kubernetes Networking Issues og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshooting Kubernetes Networking Issues **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary A practical troubleshooting guide covering common Kubernetes networking failures encountered across many deployments: kernel IP forwarding and bridge-netfilter settings being disabled, firewall rules blocking VxLAN overlay traffic, AWS source/destination check breaking pod networking, and Pod CIDR conflicts with host networks. Each issue includes symptoms, diagnostic commands (sysctl, tcpdump, iperf, kubectl), and fixes. The guide also lists helpful tools: tcpdump, a custom 'netbox' debugging container, and the Satellite cluster health monitoring agent. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is pod-to-service connection timing out with SYN packets sent but no ACK received in Kubernetes? This often indicates kernel IP forwarding is disabled on the node. Check with sysctl net.ipv4.ip_forward - a value of 0 means forwarding is disabled, breaking traffic routing from containers to the outside world. Fix it with sysctl -w net.ipv4.ip_forward=1, and persist it across reboots by adding the setting to /etc/sysconf.d/10-ipv4-forwarding-on.conf on CentOS. _daily.dev surfaces practical fixes like this for engineers debugging flaky cluster networking._ ### How do I fix 100% packet loss between Kubernetes pod IPs on a VxLAN overlay network? Firewall rules blocking UDP port 8472, the port used by VxLAN encapsulation, are a common cause of complete packet loss between pod IPs. Diagnose it using iperf with the same protocol as the overlay traffic (iperf -s -p 8472 -u on the server, iperf -c -u -p 8472 -b 1K on the client), then update firewall rules to stop blocking that UDP traffic. _Teams running on-prem overlay networks track fixes like this one through daily.dev._ ### Why does turning on AWS source/destination check break Kubernetes pod networking? AWS source/destination check verifies that packets arriving at an instance target one of that instance's own IP addresses, but many Kubernetes networking backends route traffic using pod overlay IPs that differ from the instance IP, causing connections to time out with repeated SYNs and no ACKs. The fix is to turn off source/destination check on the cluster's EC2 instances. _daily.dev helps engineers keep track of AWS networking quirks that trip up Kubernetes clusters._ ## Similar posts on daily.dev - [Understanding Kubernetes Networking](https://daily.dev/posts/understanding-kubernetes-networking-oooxha7or) · cilium · 22 upvotes · 1 comments - [Inside the Packet: How Kubernetes Networking Actually Works at L3/L4](https://daily.dev/posts/inside-the-packet-how-kubernetes-networking-actually-works-at-l3-l4-mlktkkrux) · Container Journal · 1 upvotes · 0 comments - [How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand](https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj) · freeCodeCamp · 8 upvotes · 0 comments - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments - [How to Troubleshoot Common Kubernetes Errors \[2025 Guide\]](https://daily.dev/posts/how-to-troubleshoot-common-kubernetes-errors-2025-guide--lnaeoox6s) · Spacelift · 7 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Troubleshooting Kubernetes Networking Issues","url":"https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9"},"datePublished":"2026-08-23T12:22:54.210Z","dateModified":"2026-08-23T12:51:48.618Z","description":"A practical troubleshooting guide covering common Kubernetes networking failures encountered across many deployments: kernel IP forwarding and bridge-netfilter...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,kubernetes,networking","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Troubleshooting Kubernetes Networking Issues"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/troubleshooting-kubernetes-networking-issues-yrdzsgpk9#faq","mainEntity":[{"@type":"Question","name":"Why is pod-to-service connection timing out with SYN packets sent but no ACK received in Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"This often indicates kernel IP forwarding is disabled on the node. Check with sysctl net.ipv4.ip_forward - a value of 0 means forwarding is disabled, breaking traffic routing from containers to the outside world. Fix it with sysctl -w net.ipv4.ip_forward=1, and persist it across reboots by adding the setting to /etc/sysconf.d/10-ipv4-forwarding-on.conf on CentOS. daily.dev surfaces practical fixes like this for engineers debugging flaky cluster networking."}},{"@type":"Question","name":"How do I fix 100% packet loss between Kubernetes pod IPs on a VxLAN overlay network?","acceptedAnswer":{"@type":"Answer","text":"Firewall rules blocking UDP port 8472, the port used by VxLAN encapsulation, are a common cause of complete packet loss between pod IPs. Diagnose it using iperf with the same protocol as the overlay traffic (iperf -s -p 8472 -u on the server, iperf -c -u -p 8472 -b 1K on the client), then update firewall rules to stop blocking that UDP traffic. Teams running on-prem overlay networks track fixes like this one through daily.dev."}},{"@type":"Question","name":"Why does turning on AWS source/destination check break Kubernetes pod networking?","acceptedAnswer":{"@type":"Answer","text":"AWS source/destination check verifies that packets arriving at an instance target one of that instance's own IP addresses, but many Kubernetes networking backends route traffic using pod overlay IPs that differ from the instance IP, causing connections to time out with repeated SYNs and no ACKs. The fix is to turn off source/destination check on the cluster's EC2 instances. daily.dev helps engineers keep track of AWS networking quirks that trip up Kubernetes clusters."}}]} ```