# Generated by iptables-save v1.8.8 on Fri Aug  1 19:23:38 2025
*raw
:PREROUTING ACCEPT [743346:279902352]
:OUTPUT ACCEPT [478697:255400697]
:CILIUM_OUTPUT_raw - [0:0]
:CILIUM_PRE_raw - [0:0]
[743378:279928194] -A PREROUTING -m comment --comment "cilium-feeder: CILIUM_PRE_raw" -j CILIUM_PRE_raw
[478721:255404622] -A OUTPUT -m comment --comment "cilium-feeder: CILIUM_OUTPUT_raw" -j CILIUM_OUTPUT_raw
[0:0] -A CILIUM_OUTPUT_raw -o lxc+ -m mark --mark 0xa00/0xfffffeff -m comment --comment "cilium: NOTRACK for proxy return traffic" -j CT --notrack
[423:553131] -A CILIUM_OUTPUT_raw -o cilium_host -m mark --mark 0xa00/0xfffffeff -m comment --comment "cilium: NOTRACK for proxy return traffic" -j CT --notrack
[578:496643] -A CILIUM_OUTPUT_raw -o cilium_host -m mark --mark 0xb00/0xf00 -m comment --comment "cilium: NOTRACK for proxy forward traffic" -j CT --notrack
[0:0] -A CILIUM_OUTPUT_raw -o lxc+ -m mark --mark 0x800/0xe00 -m comment --comment "cilium: NOTRACK for L7 proxy upstream traffic" -j CT --notrack
[0:0] -A CILIUM_OUTPUT_raw -o cilium_host -m mark --mark 0x800/0xe00 -m comment --comment "cilium: NOTRACK for L7 proxy upstream traffic" -j CT --notrack
[19129:2453036] -A CILIUM_PRE_raw -m mark --mark 0xd00/0xf00 -m comment --comment "cilium-xfrm-notrack:" -j CT --notrack
[19143:1384983] -A CILIUM_PRE_raw -m mark --mark 0xe00/0xf00 -m comment --comment "cilium-xfrm-notrack:" -j CT --notrack
[492:46077] -A CILIUM_PRE_raw -m mark --mark 0x200/0xf00 -m comment --comment "cilium: NOTRACK for proxy traffic" -j CT --notrack
COMMIT
# Completed on Fri Aug  1 19:23:38 2025
# Generated by iptables-save v1.8.8 on Fri Aug  1 19:23:38 2025
*filter
:INPUT ACCEPT [7384:2719746]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7226:3266297]
:CILIUM_FORWARD - [0:0]
:CILIUM_INPUT - [0:0]
:CILIUM_OUTPUT - [0:0]
:KUBE-EXTERNAL-SERVICES - [0:0]
:KUBE-FIREWALL - [0:0]
:KUBE-FORWARD - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:KUBE-NODEPORTS - [0:0]
:KUBE-PROXY-CANARY - [0:0]
:KUBE-PROXY-FIREWALL - [0:0]
:KUBE-SERVICES - [0:0]
[484539:260721204] -A INPUT -m comment --comment "cilium-feeder: CILIUM_INPUT" -j CILIUM_INPUT
[2476:149220] -A INPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes load balancer firewall" -j KUBE-PROXY-FIREWALL
[722720:638188201] -A INPUT -m comment --comment "kubernetes health check service ports" -j KUBE-NODEPORTS
[2476:149220] -A INPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes externally-visible service portals" -j KUBE-EXTERNAL-SERVICES
[722892:638277273] -A INPUT -j KUBE-FIREWALL
[258808:19203738] -A FORWARD -m comment --comment "cilium-feeder: CILIUM_FORWARD" -j CILIUM_FORWARD
[11:660] -A FORWARD -m conntrack --ctstate NEW -m comment --comment "kubernetes load balancer firewall" -j KUBE-PROXY-FIREWALL
[111:23620] -A FORWARD -m comment --comment "kubernetes forwarding rules" -j KUBE-FORWARD
[0:0] -A FORWARD -m conntrack --ctstate NEW -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
[0:0] -A FORWARD -m conntrack --ctstate NEW -m comment --comment "kubernetes externally-visible service portals" -j KUBE-EXTERNAL-SERVICES
[478699:255402686] -A OUTPUT -m comment --comment "cilium-feeder: CILIUM_OUTPUT" -j CILIUM_OUTPUT
[9120:547652] -A OUTPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes load balancer firewall" -j KUBE-PROXY-FIREWALL
[9120:547652] -A OUTPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
[493553:254508677] -A OUTPUT -j KUBE-FIREWALL
[0:0] -A CILIUM_FORWARD -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_FORWARD chain" -j ACCEPT
[19112:1381731] -A CILIUM_FORWARD -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_FORWARD chain" -j ACCEPT
[0:0] -A CILIUM_FORWARD -o cilium_host -m comment --comment "cilium: any->cluster on cilium_host forward accept" -j ACCEPT
[0:0] -A CILIUM_FORWARD -i cilium_host -m comment --comment "cilium: cluster->any on cilium_host forward accept (nodeport)" -j ACCEPT
[133656:9240374] -A CILIUM_FORWARD -i lxc+ -m comment --comment "cilium: cluster->any on lxc+ forward accept" -j ACCEPT
[19495:2497529] -A CILIUM_FORWARD -i cilium_net -m comment --comment "cilium: cluster->any on cilium_net forward accept (nodeport)" -j ACCEPT
[86434:6060484] -A CILIUM_FORWARD -o lxc+ -m comment --comment "cilium: any->cluster on lxc+ forward accept" -j ACCEPT
[0:0] -A CILIUM_FORWARD -i lxc+ -m comment --comment "cilium: cluster->any on lxc+ forward accept (nodeport)" -j ACCEPT
[1176:618890] -A CILIUM_INPUT -m mark --mark 0x200/0xf00 -m comment --comment "cilium: ACCEPT for proxy traffic" -j ACCEPT
[19129:2453036] -A CILIUM_INPUT -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_INPUT chain" -j ACCEPT
[0:0] -A CILIUM_INPUT -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_INPUT chain" -j ACCEPT
[871:591875] -A CILIUM_OUTPUT -m mark --mark 0xa00/0xe00 -m comment --comment "cilium: ACCEPT for proxy traffic" -j ACCEPT
[0:0] -A CILIUM_OUTPUT -m mark --mark 0x800/0xe00 -m comment --comment "cilium: ACCEPT for l7 proxy upstream traffic" -j ACCEPT
[0:0] -A CILIUM_OUTPUT -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_OUTPUT chain" -j ACCEPT
[19142:2455184] -A CILIUM_OUTPUT -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from filter CILIUM_OUTPUT chain" -j ACCEPT
[458686:252355627] -A CILIUM_OUTPUT -m mark ! --mark 0xe00/0xf00 -m mark ! --mark 0xd00/0xf00 -m mark ! --mark 0x400/0xf00 -m mark ! --mark 0xa00/0xe00 -m mark ! --mark 0x800/0xe00 -m mark ! --mark 0xf00/0xf00 -m comment --comment "cilium: host->any mark as from host" -j MARK --set-xmark 0xc00/0xf00
[0:0] -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
[0:0] -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
[0:0] -A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
[0:0] -A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Aug  1 19:23:38 2025
# Generated by iptables-save v1.8.8 on Fri Aug  1 19:23:38 2025
*mangle
:PREROUTING ACCEPT [568320:156631159]
:INPUT ACCEPT [312615:138140011]
:FORWARD ACCEPT [255742:18492399]
:OUTPUT ACCEPT [372335:243685086]
:POSTROUTING ACCEPT [628075:262177309]
:CILIUM_POST_mangle - [0:0]
:CILIUM_PRE_mangle - [0:0]
:KUBE-IPTABLES-HINT - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:KUBE-PROXY-CANARY - [0:0]
[743378:279928194] -A PREROUTING -m comment --comment "cilium-feeder: CILIUM_PRE_mangle" -j CILIUM_PRE_mangle
[737507:274606424] -A POSTROUTING -m comment --comment "cilium-feeder: CILIUM_POST_mangle" -j CILIUM_POST_mangle
[1056:611093] -A CILIUM_PRE_mangle ! -o lo -m socket --transparent -m mark ! --mark 0xe00/0xf00 -m mark ! --mark 0x800/0xf00 -m comment --comment "cilium: any->pod redirect proxied traffic to host proxy" -j MARK --set-xmark 0x200/0xffffffff
[0:0] -A CILIUM_PRE_mangle -p tcp -m mark --mark 0x51820200 -m comment --comment "cilium: TPROXY to host cilium-dns-egress proxy" -j TPROXY --on-port 33361 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[55:3897] -A CILIUM_PRE_mangle -p udp -m mark --mark 0x51820200 -m comment --comment "cilium: TPROXY to host cilium-dns-egress proxy" -j TPROXY --on-port 33361 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[18:1080] -A CILIUM_PRE_mangle -p tcp -m mark --mark 0xd44b0200 -m comment --comment "cilium: TPROXY to host cilium-http-egress proxy" -j TPROXY --on-port 19412 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[0:0] -A CILIUM_PRE_mangle -p udp -m mark --mark 0xd44b0200 -m comment --comment "cilium: TPROXY to host cilium-http-egress proxy" -j TPROXY --on-port 19412 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[37:2220] -A CILIUM_PRE_mangle -p tcp -m mark --mark 0x29470200 -m comment --comment "cilium: TPROXY to host cilium-http-ingress proxy" -j TPROXY --on-port 18217 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[0:0] -A CILIUM_PRE_mangle -p udp -m mark --mark 0x29470200 -m comment --comment "cilium: TPROXY to host cilium-http-ingress proxy" -j TPROXY --on-port 18217 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[10:600] -A CILIUM_PRE_mangle -p tcp -m mark --mark 0xba4c0200 -m comment --comment "cilium: TPROXY to host cilium-proxylib-egress proxy" -j TPROXY --on-port 19642 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
[0:0] -A CILIUM_PRE_mangle -p udp -m mark --mark 0xba4c0200 -m comment --comment "cilium: TPROXY to host cilium-proxylib-egress proxy" -j TPROXY --on-port 19642 --on-ip 127.0.0.1 --tproxy-mark 0x200/0xffffffff
COMMIT
# Completed on Fri Aug  1 19:23:38 2025
# Generated by iptables-save v1.8.8 on Fri Aug  1 19:23:38 2025
*nat
:PREROUTING ACCEPT [35:2092]
:INPUT ACCEPT [33:1980]
:OUTPUT ACCEPT [378:22672]
:POSTROUTING ACCEPT [380:22784]
:CILIUM_OUTPUT_nat - [0:0]
:CILIUM_POST_nat - [0:0]
:CILIUM_PRE_nat - [0:0]
:DOCKER_OUTPUT - [0:0]
:DOCKER_POSTROUTING - [0:0]
:KUBE-EXT-27YWRMSW4RAVU3PK - [0:0]
:KUBE-EXT-2SJUF5GDC6NLARGO - [0:0]
:KUBE-EXT-3QM5IQ6QX7PPX5BT - [0:0]
:KUBE-EXT-BNUWD5A2AZOIN4Z2 - [0:0]
:KUBE-EXT-F4Q44K2SZKRK7TNH - [0:0]
:KUBE-EXT-FO3H5TAIBXYGQWVH - [0:0]
:KUBE-EXT-NI2E673P5HGXOBSN - [0:0]
:KUBE-EXT-U6JYEE6UBJSBLLKL - [0:0]
:KUBE-EXT-ULN7VW6DRN5PSKNW - [0:0]
:KUBE-EXT-WIJ434UCAZQUM5AL - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:KUBE-MARK-MASQ - [0:0]
:KUBE-NODEPORTS - [0:0]
:KUBE-POSTROUTING - [0:0]
:KUBE-PROXY-CANARY - [0:0]
:KUBE-SEP-2RYXDNIG4K5Z3TST - [0:0]
:KUBE-SEP-3NJHLNOIKGNLGDGP - [0:0]
:KUBE-SEP-5X5IIR4URSM2M74K - [0:0]
:KUBE-SEP-6AWCDDDW4BU26BVH - [0:0]
:KUBE-SEP-DL4WY5CJIMMSKRZS - [0:0]
:KUBE-SEP-GPTHH2B7WJNRA3HI - [0:0]
:KUBE-SEP-KKMPEWJGHTBRA6A6 - [0:0]
:KUBE-SEP-M5KYAPNREIWJKMQZ - [0:0]
:KUBE-SEP-MNAXFGWWCZ6MUVGQ - [0:0]
:KUBE-SEP-MRSQFNVIPTUTPTZP - [0:0]
:KUBE-SEP-O472KRCNDM2ZX7EH - [0:0]
:KUBE-SEP-OJCTP5LCEHQJ3D72 - [0:0]
:KUBE-SEP-OP5NMAARQEDQD3QT - [0:0]
:KUBE-SEP-T4SQPHGKFWG5IT4X - [0:0]
:KUBE-SEP-TT62VHDR7G7MQVAX - [0:0]
:KUBE-SEP-VCLGED3QPNJSAMML - [0:0]
:KUBE-SEP-WJID6KPDUCNGT7FN - [0:0]
:KUBE-SEP-Z6OKR4TANU3UYKXL - [0:0]
:KUBE-SERVICES - [0:0]
:KUBE-SVC-27YWRMSW4RAVU3PK - [0:0]
:KUBE-SVC-2SJUF5GDC6NLARGO - [0:0]
:KUBE-SVC-3QM5IQ6QX7PPX5BT - [0:0]
:KUBE-SVC-BNUWD5A2AZOIN4Z2 - [0:0]
:KUBE-SVC-ERIFXISQEP7F7OF4 - [0:0]
:KUBE-SVC-F4Q44K2SZKRK7TNH - [0:0]
:KUBE-SVC-FO3H5TAIBXYGQWVH - [0:0]
:KUBE-SVC-JD5MR3NA4I4DYORP - [0:0]
:KUBE-SVC-NI2E673P5HGXOBSN - [0:0]
:KUBE-SVC-NPX46M4PTMTKRN6Y - [0:0]
:KUBE-SVC-TCOU7JCQXEZGVUNU - [0:0]
:KUBE-SVC-U6JYEE6UBJSBLLKL - [0:0]
:KUBE-SVC-ULN7VW6DRN5PSKNW - [0:0]
:KUBE-SVC-WIJ434UCAZQUM5AL - [0:0]
:KUBE-SVL-NZTS37XDTDNXGCKJ - [0:0]
[1446:92893] -A PREROUTING -m comment --comment "cilium-feeder: CILIUM_PRE_nat" -j CILIUM_PRE_nat
[1446:92893] -A PREROUTING -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
[0:0] -A PREROUTING -d 172.18.0.1/32 -j DOCKER_OUTPUT
[9039:542612] -A OUTPUT -m comment --comment "cilium-feeder: CILIUM_OUTPUT_nat" -j CILIUM_OUTPUT_nat
[9140:548852] -A OUTPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
[12:926] -A OUTPUT -d 172.18.0.1/32 -j DOCKER_OUTPUT
[9529:578049] -A POSTROUTING -m comment --comment "cilium-feeder: CILIUM_POST_nat" -j CILIUM_POST_nat
[9549:579237] -A POSTROUTING -m comment --comment "kubernetes postrouting rules" -j KUBE-POSTROUTING
[0:0] -A POSTROUTING -d 172.18.0.1/32 -j DOCKER_POSTROUTING
[0:0] -A CILIUM_OUTPUT_nat -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_OUTPUT_nat chain" -j ACCEPT
[2:296] -A CILIUM_OUTPUT_nat -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_OUTPUT_nat chain" -j ACCEPT
[0:0] -A CILIUM_POST_nat -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_POST_nat chain" -j ACCEPT
[2:296] -A CILIUM_POST_nat -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_POST_nat chain" -j ACCEPT
[28:1872] -A CILIUM_POST_nat -s 10.244.3.0/24 -m set --match-set cilium_node_set_v4 dst -m comment --comment "exclude traffic to cluster nodes from masquerade" -j ACCEPT
[33:1980] -A CILIUM_POST_nat -s 10.244.3.0/24 ! -d 10.244.0.0/16 ! -o cilium_+ -m comment --comment "cilium masquerade non-cluster" -j MASQUERADE
[20:1200] -A CILIUM_POST_nat -m mark --mark 0xa00/0xe00 -m comment --comment "exclude proxy return traffic from masquerade" -j ACCEPT
[0:0] -A CILIUM_POST_nat -s 127.0.0.1/32 -o lxc+ -m comment --comment "cilium host->cluster from 127.0.0.1 masquerade" -j SNAT --to-source 10.244.3.143
[0:0] -A CILIUM_PRE_nat -m mark --mark 0xd00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_PRE_nat chain" -j ACCEPT
[0:0] -A CILIUM_PRE_nat -m mark --mark 0xe00/0xf00 -m comment --comment "exclude xfrm marks from nat CILIUM_PRE_nat chain" -j ACCEPT
[0:0] -A DOCKER_OUTPUT -d 172.18.0.1/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46513
[12:926] -A DOCKER_OUTPUT -d 172.18.0.1/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:52906
[0:0] -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46513 -j SNAT --to-source 172.18.0.1:53
[0:0] -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 52906 -j SNAT --to-source 172.18.0.1:53
[4:240] -A KUBE-EXT-27YWRMSW4RAVU3PK -m comment --comment "masquerade traffic for cilium-test-1/echo-other-node:http external destinations" -j KUBE-MARK-MASQ
[4:240] -A KUBE-EXT-27YWRMSW4RAVU3PK -j KUBE-SVC-27YWRMSW4RAVU3PK
[1:60] -A KUBE-EXT-2SJUF5GDC6NLARGO -m comment --comment "masquerade traffic for cilium-test-2/echo-other-node:http external destinations" -j KUBE-MARK-MASQ
[1:60] -A KUBE-EXT-2SJUF5GDC6NLARGO -j KUBE-SVC-2SJUF5GDC6NLARGO
[4:240] -A KUBE-EXT-3QM5IQ6QX7PPX5BT -m comment --comment "masquerade traffic for cilium-test-3/echo-same-node:http external destinations" -j KUBE-MARK-MASQ
[4:240] -A KUBE-EXT-3QM5IQ6QX7PPX5BT -j KUBE-SVC-3QM5IQ6QX7PPX5BT
[2:120] -A KUBE-EXT-BNUWD5A2AZOIN4Z2 -m comment --comment "masquerade traffic for cilium-test-5/echo-same-node:http external destinations" -j KUBE-MARK-MASQ
[2:120] -A KUBE-EXT-BNUWD5A2AZOIN4Z2 -j KUBE-SVC-BNUWD5A2AZOIN4Z2
[4:240] -A KUBE-EXT-F4Q44K2SZKRK7TNH -m comment --comment "masquerade traffic for cilium-test-1/echo-same-node:http external destinations" -j KUBE-MARK-MASQ
[4:240] -A KUBE-EXT-F4Q44K2SZKRK7TNH -j KUBE-SVC-F4Q44K2SZKRK7TNH
[4:240] -A KUBE-EXT-FO3H5TAIBXYGQWVH -m comment --comment "masquerade traffic for cilium-test-3/echo-other-node:http external destinations" -j KUBE-MARK-MASQ
[4:240] -A KUBE-EXT-FO3H5TAIBXYGQWVH -j KUBE-SVC-FO3H5TAIBXYGQWVH
[1:60] -A KUBE-EXT-NI2E673P5HGXOBSN -m comment --comment "masquerade traffic for cilium-test-2/echo-same-node:http external destinations" -j KUBE-MARK-MASQ
[1:60] -A KUBE-EXT-NI2E673P5HGXOBSN -j KUBE-SVC-NI2E673P5HGXOBSN
[2:120] -A KUBE-EXT-U6JYEE6UBJSBLLKL -m comment --comment "masquerade traffic for cilium-test-5/echo-other-node:http external destinations" -j KUBE-MARK-MASQ
[2:120] -A KUBE-EXT-U6JYEE6UBJSBLLKL -j KUBE-SVC-U6JYEE6UBJSBLLKL
[3:180] -A KUBE-EXT-ULN7VW6DRN5PSKNW -m comment --comment "masquerade traffic for cilium-test-4/echo-other-node:http external destinations" -j KUBE-MARK-MASQ
[3:180] -A KUBE-EXT-ULN7VW6DRN5PSKNW -j KUBE-SVC-ULN7VW6DRN5PSKNW
[3:180] -A KUBE-EXT-WIJ434UCAZQUM5AL -m comment --comment "masquerade traffic for cilium-test-4/echo-same-node:http external destinations" -j KUBE-MARK-MASQ
[3:180] -A KUBE-EXT-WIJ434UCAZQUM5AL -j KUBE-SVC-WIJ434UCAZQUM5AL
[0:0] -A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-1/echo-other-node:http" -m tcp --dport 32028 -j KUBE-EXT-27YWRMSW4RAVU3PK
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-2/echo-same-node:http" -m tcp --dport 32023 -j KUBE-EXT-NI2E673P5HGXOBSN
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-2/echo-other-node:http" -m tcp --dport 30474 -j KUBE-EXT-2SJUF5GDC6NLARGO
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-4/echo-same-node:http" -m tcp --dport 31649 -j KUBE-EXT-WIJ434UCAZQUM5AL
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-5/echo-same-node:http" -m tcp --dport 30566 -j KUBE-EXT-BNUWD5A2AZOIN4Z2
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-3/echo-same-node:http" -m tcp --dport 31905 -j KUBE-EXT-3QM5IQ6QX7PPX5BT
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-5/echo-other-node:http" -m tcp --dport 31472 -j KUBE-EXT-U6JYEE6UBJSBLLKL
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-4/echo-other-node:http" -m tcp --dport 31157 -j KUBE-EXT-ULN7VW6DRN5PSKNW
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-1/echo-same-node:http" -m tcp --dport 31778 -j KUBE-EXT-F4Q44K2SZKRK7TNH
[0:0] -A KUBE-NODEPORTS -p tcp -m comment --comment "cilium-test-3/echo-other-node:http" -m tcp --dport 32270 -j KUBE-EXT-FO3H5TAIBXYGQWVH
[380:22784] -A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
[0:0] -A KUBE-POSTROUTING -j MARK --set-xmark 0x4000/0x0
[0:0] -A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE --random-fully
[0:0] -A KUBE-SEP-2RYXDNIG4K5Z3TST -s 10.244.2.53/32 -m comment --comment "cilium-test-5/echo-same-node:http" -j KUBE-MARK-MASQ
[2:120] -A KUBE-SEP-2RYXDNIG4K5Z3TST -p tcp -m comment --comment "cilium-test-5/echo-same-node:http" -m tcp -j DNAT --to-destination 10.244.2.53:8080
[0:0] -A KUBE-SEP-3NJHLNOIKGNLGDGP -s 172.18.0.4/32 -m comment --comment "kube-system/hubble-peer:peer-service" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-3NJHLNOIKGNLGDGP -p tcp -m comment --comment "kube-system/hubble-peer:peer-service" -m tcp -j DNAT --to-destination 172.18.0.4:4244
[0:0] -A KUBE-SEP-5X5IIR4URSM2M74K -s 10.244.0.146/32 -m comment --comment "kube-system/kube-dns:dns-tcp" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-5X5IIR4URSM2M74K -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp" -m tcp -j DNAT --to-destination 10.244.0.146:53
[0:0] -A KUBE-SEP-6AWCDDDW4BU26BVH -s 10.244.3.35/32 -m comment --comment "cilium-test-4/echo-same-node:http" -j KUBE-MARK-MASQ
[3:180] -A KUBE-SEP-6AWCDDDW4BU26BVH -p tcp -m comment --comment "cilium-test-4/echo-same-node:http" -m tcp -j DNAT --to-destination 10.244.3.35:8080
[0:0] -A KUBE-SEP-DL4WY5CJIMMSKRZS -s 10.244.2.165/32 -m comment --comment "cilium-test-2/echo-same-node:http" -j KUBE-MARK-MASQ
[1:60] -A KUBE-SEP-DL4WY5CJIMMSKRZS -p tcp -m comment --comment "cilium-test-2/echo-same-node:http" -m tcp -j DNAT --to-destination 10.244.2.165:8080
[0:0] -A KUBE-SEP-GPTHH2B7WJNRA3HI -s 10.244.0.61/32 -m comment --comment "kube-system/kube-dns:metrics" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-GPTHH2B7WJNRA3HI -p tcp -m comment --comment "kube-system/kube-dns:metrics" -m tcp -j DNAT --to-destination 10.244.0.61:9153
[0:0] -A KUBE-SEP-KKMPEWJGHTBRA6A6 -s 10.244.3.102/32 -m comment --comment "cilium-test-1/echo-other-node:http" -j KUBE-MARK-MASQ
[4:240] -A KUBE-SEP-KKMPEWJGHTBRA6A6 -p tcp -m comment --comment "cilium-test-1/echo-other-node:http" -m tcp -j DNAT --to-destination 10.244.3.102:8080
[0:0] -A KUBE-SEP-M5KYAPNREIWJKMQZ -s 10.244.0.39/32 -m comment --comment "cilium-test-4/echo-other-node:http" -j KUBE-MARK-MASQ
[3:180] -A KUBE-SEP-M5KYAPNREIWJKMQZ -p tcp -m comment --comment "cilium-test-4/echo-other-node:http" -m tcp -j DNAT --to-destination 10.244.0.39:8080
[0:0] -A KUBE-SEP-MNAXFGWWCZ6MUVGQ -s 10.244.2.218/32 -m comment --comment "cilium-test-3/echo-other-node:http" -j KUBE-MARK-MASQ
[4:240] -A KUBE-SEP-MNAXFGWWCZ6MUVGQ -p tcp -m comment --comment "cilium-test-3/echo-other-node:http" -m tcp -j DNAT --to-destination 10.244.2.218:8080
[0:0] -A KUBE-SEP-MRSQFNVIPTUTPTZP -s 10.244.0.146/32 -m comment --comment "kube-system/kube-dns:dns" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-MRSQFNVIPTUTPTZP -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination 10.244.0.146:53
[0:0] -A KUBE-SEP-O472KRCNDM2ZX7EH -s 10.244.3.7/32 -m comment --comment "cilium-test-2/echo-other-node:http" -j KUBE-MARK-MASQ
[1:60] -A KUBE-SEP-O472KRCNDM2ZX7EH -p tcp -m comment --comment "cilium-test-2/echo-other-node:http" -m tcp -j DNAT --to-destination 10.244.3.7:8080
[0:0] -A KUBE-SEP-OJCTP5LCEHQJ3D72 -s 172.18.0.5/32 -m comment --comment "default/kubernetes:https" -j KUBE-MARK-MASQ
[5:300] -A KUBE-SEP-OJCTP5LCEHQJ3D72 -p tcp -m comment --comment "default/kubernetes:https" -m tcp -j DNAT --to-destination 172.18.0.5:6443
[0:0] -A KUBE-SEP-OP5NMAARQEDQD3QT -s 10.244.0.61/32 -m comment --comment "kube-system/kube-dns:dns-tcp" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-OP5NMAARQEDQD3QT -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp" -m tcp -j DNAT --to-destination 10.244.0.61:53
[0:0] -A KUBE-SEP-T4SQPHGKFWG5IT4X -s 10.244.3.238/32 -m comment --comment "cilium-test-5/echo-other-node:http" -j KUBE-MARK-MASQ
[2:120] -A KUBE-SEP-T4SQPHGKFWG5IT4X -p tcp -m comment --comment "cilium-test-5/echo-other-node:http" -m tcp -j DNAT --to-destination 10.244.3.238:8080
[0:0] -A KUBE-SEP-TT62VHDR7G7MQVAX -s 10.244.0.212/32 -m comment --comment "cilium-test-3/echo-same-node:http" -j KUBE-MARK-MASQ
[4:240] -A KUBE-SEP-TT62VHDR7G7MQVAX -p tcp -m comment --comment "cilium-test-3/echo-same-node:http" -m tcp -j DNAT --to-destination 10.244.0.212:8080
[0:0] -A KUBE-SEP-VCLGED3QPNJSAMML -s 10.244.0.61/32 -m comment --comment "kube-system/kube-dns:dns" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-VCLGED3QPNJSAMML -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination 10.244.0.61:53
[0:0] -A KUBE-SEP-WJID6KPDUCNGT7FN -s 10.244.2.247/32 -m comment --comment "cilium-test-1/echo-same-node:http" -j KUBE-MARK-MASQ
[4:240] -A KUBE-SEP-WJID6KPDUCNGT7FN -p tcp -m comment --comment "cilium-test-1/echo-same-node:http" -m tcp -j DNAT --to-destination 10.244.2.247:8080
[0:0] -A KUBE-SEP-Z6OKR4TANU3UYKXL -s 10.244.0.146/32 -m comment --comment "kube-system/kube-dns:metrics" -j KUBE-MARK-MASQ
[0:0] -A KUBE-SEP-Z6OKR4TANU3UYKXL -p tcp -m comment --comment "kube-system/kube-dns:metrics" -m tcp -j DNAT --to-destination 10.244.0.146:9153
[0:0] -A KUBE-SERVICES -d 10.96.0.10/32 -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp cluster IP" -m tcp --dport 53 -j KUBE-SVC-ERIFXISQEP7F7OF4
[0:0] -A KUBE-SERVICES -d 10.96.142.203/32 -p tcp -m comment --comment "cilium-test-1/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-27YWRMSW4RAVU3PK
[0:0] -A KUBE-SERVICES -d 10.96.0.1/32 -p tcp -m comment --comment "default/kubernetes:https cluster IP" -m tcp --dport 443 -j KUBE-SVC-NPX46M4PTMTKRN6Y
[0:0] -A KUBE-SERVICES -d 10.96.152.161/32 -p tcp -m comment --comment "cilium-test-2/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-NI2E673P5HGXOBSN
[0:0] -A KUBE-SERVICES -d 10.96.186.3/32 -p tcp -m comment --comment "cilium-test-2/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-2SJUF5GDC6NLARGO
[0:0] -A KUBE-SERVICES -d 10.96.12.51/32 -p tcp -m comment --comment "cilium-test-4/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-WIJ434UCAZQUM5AL
[0:0] -A KUBE-SERVICES -d 10.96.82.85/32 -p tcp -m comment --comment "cilium-test-5/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-BNUWD5A2AZOIN4Z2
[0:0] -A KUBE-SERVICES -d 10.96.165.251/32 -p tcp -m comment --comment "cilium-test-3/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-3QM5IQ6QX7PPX5BT
[0:0] -A KUBE-SERVICES -d 10.96.24.12/32 -p tcp -m comment --comment "cilium-test-5/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-U6JYEE6UBJSBLLKL
[0:0] -A KUBE-SERVICES -d 10.96.0.10/32 -p udp -m comment --comment "kube-system/kube-dns:dns cluster IP" -m udp --dport 53 -j KUBE-SVC-TCOU7JCQXEZGVUNU
[0:0] -A KUBE-SERVICES -d 10.96.0.10/32 -p tcp -m comment --comment "kube-system/kube-dns:metrics cluster IP" -m tcp --dport 9153 -j KUBE-SVC-JD5MR3NA4I4DYORP
[0:0] -A KUBE-SERVICES -d 10.96.232.97/32 -p tcp -m comment --comment "kube-system/hubble-peer:peer-service cluster IP" -m tcp --dport 443 -j KUBE-SVL-NZTS37XDTDNXGCKJ
[0:0] -A KUBE-SERVICES -d 10.96.31.240/32 -p tcp -m comment --comment "cilium-test-4/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-ULN7VW6DRN5PSKNW
[0:0] -A KUBE-SERVICES -d 10.96.230.205/32 -p tcp -m comment --comment "cilium-test-1/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-F4Q44K2SZKRK7TNH
[0:0] -A KUBE-SERVICES -d 10.96.220.31/32 -p tcp -m comment --comment "cilium-test-3/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-SVC-FO3H5TAIBXYGQWVH
[92:5520] -A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
[0:0] -A KUBE-SVC-27YWRMSW4RAVU3PK ! -s 10.244.0.0/16 -d 10.96.142.203/32 -p tcp -m comment --comment "cilium-test-1/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[4:240] -A KUBE-SVC-27YWRMSW4RAVU3PK -m comment --comment "cilium-test-1/echo-other-node:http -> 10.244.3.102:8080" -j KUBE-SEP-KKMPEWJGHTBRA6A6
[0:0] -A KUBE-SVC-2SJUF5GDC6NLARGO ! -s 10.244.0.0/16 -d 10.96.186.3/32 -p tcp -m comment --comment "cilium-test-2/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[1:60] -A KUBE-SVC-2SJUF5GDC6NLARGO -m comment --comment "cilium-test-2/echo-other-node:http -> 10.244.3.7:8080" -j KUBE-SEP-O472KRCNDM2ZX7EH
[0:0] -A KUBE-SVC-3QM5IQ6QX7PPX5BT ! -s 10.244.0.0/16 -d 10.96.165.251/32 -p tcp -m comment --comment "cilium-test-3/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[4:240] -A KUBE-SVC-3QM5IQ6QX7PPX5BT -m comment --comment "cilium-test-3/echo-same-node:http -> 10.244.0.212:8080" -j KUBE-SEP-TT62VHDR7G7MQVAX
[0:0] -A KUBE-SVC-BNUWD5A2AZOIN4Z2 ! -s 10.244.0.0/16 -d 10.96.82.85/32 -p tcp -m comment --comment "cilium-test-5/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[2:120] -A KUBE-SVC-BNUWD5A2AZOIN4Z2 -m comment --comment "cilium-test-5/echo-same-node:http -> 10.244.2.53:8080" -j KUBE-SEP-2RYXDNIG4K5Z3TST
[0:0] -A KUBE-SVC-ERIFXISQEP7F7OF4 ! -s 10.244.0.0/16 -d 10.96.0.10/32 -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp cluster IP" -m tcp --dport 53 -j KUBE-MARK-MASQ
[0:0] -A KUBE-SVC-ERIFXISQEP7F7OF4 -m comment --comment "kube-system/kube-dns:dns-tcp -> 10.244.0.146:53" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-5X5IIR4URSM2M74K
[0:0] -A KUBE-SVC-ERIFXISQEP7F7OF4 -m comment --comment "kube-system/kube-dns:dns-tcp -> 10.244.0.61:53" -j KUBE-SEP-OP5NMAARQEDQD3QT
[0:0] -A KUBE-SVC-F4Q44K2SZKRK7TNH ! -s 10.244.0.0/16 -d 10.96.230.205/32 -p tcp -m comment --comment "cilium-test-1/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[4:240] -A KUBE-SVC-F4Q44K2SZKRK7TNH -m comment --comment "cilium-test-1/echo-same-node:http -> 10.244.2.247:8080" -j KUBE-SEP-WJID6KPDUCNGT7FN
[0:0] -A KUBE-SVC-FO3H5TAIBXYGQWVH ! -s 10.244.0.0/16 -d 10.96.220.31/32 -p tcp -m comment --comment "cilium-test-3/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[4:240] -A KUBE-SVC-FO3H5TAIBXYGQWVH -m comment --comment "cilium-test-3/echo-other-node:http -> 10.244.2.218:8080" -j KUBE-SEP-MNAXFGWWCZ6MUVGQ
[0:0] -A KUBE-SVC-JD5MR3NA4I4DYORP ! -s 10.244.0.0/16 -d 10.96.0.10/32 -p tcp -m comment --comment "kube-system/kube-dns:metrics cluster IP" -m tcp --dport 9153 -j KUBE-MARK-MASQ
[0:0] -A KUBE-SVC-JD5MR3NA4I4DYORP -m comment --comment "kube-system/kube-dns:metrics -> 10.244.0.146:9153" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-Z6OKR4TANU3UYKXL
[0:0] -A KUBE-SVC-JD5MR3NA4I4DYORP -m comment --comment "kube-system/kube-dns:metrics -> 10.244.0.61:9153" -j KUBE-SEP-GPTHH2B7WJNRA3HI
[0:0] -A KUBE-SVC-NI2E673P5HGXOBSN ! -s 10.244.0.0/16 -d 10.96.152.161/32 -p tcp -m comment --comment "cilium-test-2/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[1:60] -A KUBE-SVC-NI2E673P5HGXOBSN -m comment --comment "cilium-test-2/echo-same-node:http -> 10.244.2.165:8080" -j KUBE-SEP-DL4WY5CJIMMSKRZS
[5:300] -A KUBE-SVC-NPX46M4PTMTKRN6Y ! -s 10.244.0.0/16 -d 10.96.0.1/32 -p tcp -m comment --comment "default/kubernetes:https cluster IP" -m tcp --dport 443 -j KUBE-MARK-MASQ
[5:300] -A KUBE-SVC-NPX46M4PTMTKRN6Y -m comment --comment "default/kubernetes:https -> 172.18.0.5:6443" -j KUBE-SEP-OJCTP5LCEHQJ3D72
[0:0] -A KUBE-SVC-TCOU7JCQXEZGVUNU ! -s 10.244.0.0/16 -d 10.96.0.10/32 -p udp -m comment --comment "kube-system/kube-dns:dns cluster IP" -m udp --dport 53 -j KUBE-MARK-MASQ
[0:0] -A KUBE-SVC-TCOU7JCQXEZGVUNU -m comment --comment "kube-system/kube-dns:dns -> 10.244.0.146:53" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-MRSQFNVIPTUTPTZP
[0:0] -A KUBE-SVC-TCOU7JCQXEZGVUNU -m comment --comment "kube-system/kube-dns:dns -> 10.244.0.61:53" -j KUBE-SEP-VCLGED3QPNJSAMML
[0:0] -A KUBE-SVC-U6JYEE6UBJSBLLKL ! -s 10.244.0.0/16 -d 10.96.24.12/32 -p tcp -m comment --comment "cilium-test-5/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[2:120] -A KUBE-SVC-U6JYEE6UBJSBLLKL -m comment --comment "cilium-test-5/echo-other-node:http -> 10.244.3.238:8080" -j KUBE-SEP-T4SQPHGKFWG5IT4X
[0:0] -A KUBE-SVC-ULN7VW6DRN5PSKNW ! -s 10.244.0.0/16 -d 10.96.31.240/32 -p tcp -m comment --comment "cilium-test-4/echo-other-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[3:180] -A KUBE-SVC-ULN7VW6DRN5PSKNW -m comment --comment "cilium-test-4/echo-other-node:http -> 10.244.0.39:8080" -j KUBE-SEP-M5KYAPNREIWJKMQZ
[0:0] -A KUBE-SVC-WIJ434UCAZQUM5AL ! -s 10.244.0.0/16 -d 10.96.12.51/32 -p tcp -m comment --comment "cilium-test-4/echo-same-node:http cluster IP" -m tcp --dport 8080 -j KUBE-MARK-MASQ
[3:180] -A KUBE-SVC-WIJ434UCAZQUM5AL -m comment --comment "cilium-test-4/echo-same-node:http -> 10.244.3.35:8080" -j KUBE-SEP-6AWCDDDW4BU26BVH
[0:0] -A KUBE-SVL-NZTS37XDTDNXGCKJ ! -s 10.244.0.0/16 -d 10.96.232.97/32 -p tcp -m comment --comment "kube-system/hubble-peer:peer-service cluster IP" -m tcp --dport 443 -j KUBE-MARK-MASQ
[0:0] -A KUBE-SVL-NZTS37XDTDNXGCKJ -m comment --comment "kube-system/hubble-peer:peer-service -> 172.18.0.4:4244" -j KUBE-SEP-3NJHLNOIKGNLGDGP
COMMIT
# Completed on Fri Aug  1 19:23:38 2025
