diff --git a/test/helpers/utils.go b/test/helpers/utils.go
index 6884c744258d..571d465460b8 100644
--- a/test/helpers/utils.go
+++ b/test/helpers/utils.go
@@ -558,6 +558,24 @@ func DoesNotSupportMetalLB() bool {
 	return true
 }
 
+func (kub *Kubectl) HasHostReachableServices(pod string, checkTCP, checkUDP bool) bool {
+	status := kub.CiliumExecContext(context.TODO(), pod,
+		"cilium status -o jsonpath='{.kube-proxy-replacement.features.hostReachableServices}'")
+	status.ExpectSuccess("Failed to get status: %s", status.OutputPrettyPrint())
+	lines := status.ByLines()
+	Expect(len(lines)).ShouldNot(Equal(0), "Failed to get hostReachableServices status")
+
+	// One-line result is e.g. "{true [TCP UDP]}" if host-reachable
+	// services are activated for both protocols.
+	if checkUDP && !strings.Contains(lines[0], "UDP") {
+		return false
+	}
+	if checkTCP && !strings.Contains(lines[0], "TCP") {
+		return false
+	}
+	return true
+}
+
 // GetNodeWithoutCilium returns a name of a node which does not run cilium.
 func GetNodeWithoutCilium() string {
 	return os.Getenv("NO_CILIUM_ON_NODE")
diff --git a/test/k8sT/Services.go b/test/k8sT/Services.go
index 80cf5334acb5..8ac348456e8c 100644
--- a/test/k8sT/Services.go
+++ b/test/k8sT/Services.go
@@ -1061,22 +1061,12 @@ var _ = Describe("K8sServicesTest", func() {
 				srcPort = 12345
 				hasDNAT = true
 			)
-
 			// Destination address and port for fragmented datagram
 			// are not DNAT-ed with kube-proxy but without bpf_sock.
 			if helpers.RunsWithKubeProxy() {
 				ciliumPodK8s1, err := kubectl.GetCiliumPodOnNode(helpers.CiliumNamespace, helpers.K8s1)
 				ExpectWithOffset(1, err).Should(BeNil(), "Cannot get cilium pod on k8s1")
-				status := kubectl.CiliumExecContext(context.TODO(), ciliumPodK8s1,
-					"cilium status -o jsonpath='{.kube-proxy-replacement.features.hostReachableServices}'")
-				status.ExpectSuccess("Failed to get status: %s", status.OutputPrettyPrint())
-				// One-line result is "{true [TCP UDP]}" if
-				// host-reachable services are activated for
-				// both protocols. Consider we do not have DNAT
-				// only if UDP is missing.
-				if len(status.ByLines()) != 0 && !strings.Contains(status.ByLines()[0], "UDP") {
-					hasDNAT = false
-				}
+				hasDNAT = kubectl.HasHostReachableServices(ciliumPodK8s1, false, true)
 			}
 
 			// Get testDSClient and testDS pods running on k8s1.