$ iptables -t nat -L -n
Chain KUBE-PORTALS-CONTAINER (1 references)
target prot opt source destination
…
REDIRECT tcp -- 0.0.0.0/0 11.1.1.88 /* service-nginx */ tcp dpt:8001 redir ports 43318
Chain KUBE-PORTALS-HOST (1 references)
target prot opt source destination
…
DNAT tcp -- 0.0.0.0/0 11.1.1.88 /* service-nginx */ tcp dpt:8001 to:10.10.103.58:43318
[update] BTW, 10.10.103.58 is just the IP of eth0 of the local machine.
I saw the answer in Difference beetween DNAT and REDIRECT in IPTABLES, so I know that REDIRECT only work for local redirect.
[update] But my question is, in this cases, Kubernetes set both DNAT and REDIRECT at the same machine, why?
[update] My guess from the chains' name is that DNAT
will forward any request send from host to 11.1.1.88
to 10.10.103.58:43318
. But for the request send from a container running on this host the REDIRECT
chain will work instead.
Am I right?