I'm looking into how iptables work in Kubernetes for packets from a pod to a service. For the outbound, it goes through OUTPUT chain first(nat then filter in my case). Part of the iptables-save
result is like:
# Generated by iptables-save v1.4.21 on
*nat
-A KUBE-SERVICES ...
# other rules in nat table
*filter
:OUTPUT ACCEPT [9:1136]
:KUBE-FIREWALL - [0:0] # it seems there's no failures
:KUBE-SERVICES - [0:0]
-A OUTPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
-A OUTPUT -j KUBE-FIREWALL
-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
# no KUBE-SERVICES chain in filter table
# no rules in other tables
We can see from -A OUTPUT -m conntrack
, it jumps to KUBE-SERVICES
, but I can't find a KUBE-SERVICES
chain in filter
table. What happens when it doesn't exist?
There's a KUBE-SERVICES
chain in nat
table, but I guess it won't go to nat
table from filter
table?