diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh
index db3ba89187f..3a9d17ae9e2 100755
--- a/cluster/gce/util.sh
+++ b/cluster/gce/util.sh
@@ -923,6 +923,15 @@ function test-setup {
     --allow tcp:80 tcp:8080 \
     --network "${NETWORK}" \
     "${MINION_TAG}-${INSTANCE_PREFIX}-http-alt"
+
+  # Open up the NodePort range
+  # TODO(justinsb): Move to main setup, if we decide whether we want to do this by default.
+  gcloud compute firewall-rules create \
+    --project "${PROJECT}" \
+    --target-tags "${MINION_TAG}" \
+    --allow tcp:30000-32767,udp:30000-32767 \
+    --network "${NETWORK}" \
+    "${MINION_TAG}-${INSTANCE_PREFIX}-nodeports"
 }
 
 # Execute after running tests to perform any required clean-up. This is called
@@ -934,6 +943,10 @@ function test-teardown {
     --project "${PROJECT}" \
     --quiet \
     "${MINION_TAG}-${INSTANCE_PREFIX}-http-alt" || true
+  gcloud compute firewall-rules delete  \
+    --project "${PROJECT}" \
+    --quiet \
+    "${MINION_TAG}-${INSTANCE_PREFIX}-nodeports" || true
   "${KUBE_ROOT}/cluster/kube-down.sh"
 }
 
diff --git a/cluster/gke/util.sh b/cluster/gke/util.sh
index b7dac06f39b..51352b6908c 100755
--- a/cluster/gke/util.sh
+++ b/cluster/gke/util.sh
@@ -171,6 +171,13 @@ function test-setup() {
     --project "${PROJECT}" \
     --target-tags "${MINION_TAG}" \
     --network="${NETWORK}"
+
+  "${GCLOUD}" compute firewall-rules create \
+    "${MINION_TAG}-${USER}-nodeports" \
+    --allow tcp:30000-32767,udp:30000-32767 \
+    --project "${PROJECT}" \
+    --target-tags "${MINION_TAG}" \
+    --network="${NETWORK}"
 }
 
 # Ensure that we have a password created for validating to the master.
@@ -285,9 +292,11 @@ function test-teardown() {
   MINION_TAG="k8s-${CLUSTER_NAME}-node"
 
   # First, remove anything we did with test-setup (currently, the firewall).
-  # NOTE: Keep in sync with name above in test-setup.
+  # NOTE: Keep in sync with names above in test-setup.
   "${GCLOUD}" compute firewall-rules delete "${MINION_TAG}-${USER}-http-alt" \
     --project="${PROJECT}" || true
+  "${GCLOUD}" compute firewall-rules delete "${MINION_TAG}-${USER}-nodeports" \
+    --project="${PROJECT}" || true
 
   # Then actually turn down the cluster.
   "${KUBE_ROOT}/cluster/kube-down.sh"
diff --git a/test/e2e/service.go b/test/e2e/service.go
index b21f5b696e6..3cf15f2789f 100644
--- a/test/e2e/service.go
+++ b/test/e2e/service.go
@@ -488,6 +488,7 @@ var _ = Describe("Services", func() {
 
 		By("changing service " + serviceName + " back to type=ClusterIP")
 		service.Spec.Type = api.ServiceTypeClusterIP
+		service.Spec.Ports[0].NodePort = 0
 		service, err = c.Services(ns).Update(service)
 		Expect(err).NotTo(HaveOccurred())