OPNsense: port-forward unreachable from the same WAN subnet (reply-to)
OPNsense adds reply-to to WAN rules and sends replies to the gateway even when the client is on the same segment. Disable it and the firewall goes back to its routing table.
Firewall
Vault Agent Injector on a private GKE cluster: no sidecar and pods take 30 s (the control plane cannot reach the webhook on 8080)
gcloud compute firewall-rules create … –source-ranges= –target-tags= –rules=tcp:8080. Validate by deleting a pod and grepping the injector for ‘handler: Request received: Method=POST URL=/mutate’. Applies to any webhook not listening on 443 or 10250.