iptables-save -c
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:25 2025
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [396050915:259360217888]
:POSTROUTING ACCEPT [396050045:259359985816]
:KUBE-IPTABLES-HINT - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-ITP - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[396050915:259360217888] -A OUTPUT -j OVN-KUBE-ITP
[396050045:259359985816] -A POSTROUTING -j SUBMARINER-POSTROUTING
[0:0] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-LOCALCIDRS src -m set --match-set SUBMARINER-REMOTECIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
[0:0] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-REMOTECIDRS src -m set --match-set SUBMARINER-LOCALCIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
COMMIT
# Completed on Fri Feb 14 16:49:25 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:25 2025
*raw
:PREROUTING ACCEPT [384852481:594346192497]
:OUTPUT ACCEPT [396051547:259360361082]
[191407506:515923602073] -A PREROUTING -p udp -m udp --dport 6081 -j NOTRACK
[197326171:58943018699] -A OUTPUT -p udp -m udp --dport 6081 -j NOTRACK
COMMIT
# Completed on Fri Feb 14 16:49:25 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:25 2025
*filter
:INPUT ACCEPT [383751190:594130007690]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [396054309:259361004234]
:KUBE-FIREWALL - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:SUBMARINER-FORWARD - [0:0]
:SUBMARINER-FWD-MSSCLAMP - [0:0]
[383751190:594130007690] -A INPUT -j KUBE-FIREWALL
[0:0] -A FORWARD -j SUBMARINER-FWD-MSSCLAMP
[0:0] -A FORWARD -j SUBMARINER-FORWARD
[0:0] -A FORWARD -d 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -s 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -d 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -d 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[396054309:259361004234] -A OUTPUT -j KUBE-FIREWALL
[0:0] -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
COMMIT
# Completed on Fri Feb 14 16:49:25 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:25 2025
*nat
:PREROUTING ACCEPT [5110088:516647335]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [19017206:1143213880]
:POSTROUTING ACCEPT [1035156:64775192]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-EGRESS-IP-MULTI-NIC - [0:0]
:OVN-KUBE-EGRESS-SVC - [0:0]
:OVN-KUBE-ETP - [0:0]
:OVN-KUBE-EXTERNALIP - [0:0]
:OVN-KUBE-ITP - [0:0]
:OVN-KUBE-NODEPORT - [0:0]
:OVN-KUBE-SNAT-MGMTPORT - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[5110088:516647335] -A PREROUTING -j OVN-KUBE-ETP
[5110088:516647335] -A PREROUTING -j OVN-KUBE-EXTERNALIP
[5110088:516647335] -A PREROUTING -j OVN-KUBE-NODEPORT
[19017206:1143213880] -A OUTPUT -j OVN-KUBE-EXTERNALIP
[19017206:1143213880] -A OUTPUT -j OVN-KUBE-NODEPORT
[19017206:1143213880] -A OUTPUT -j OVN-KUBE-ITP
[19017182:1143212186] -A POSTROUTING -j SUBMARINER-POSTROUTING
[19017200:1143213512] -A POSTROUTING -j OVN-KUBE-EGRESS-IP-MULTI-NIC
[19017206:1143213880] -A POSTROUTING -j OVN-KUBE-EGRESS-SVC
[17982053:1078438876] -A POSTROUTING -o ovn-k8s-mp0 -j OVN-KUBE-SNAT-MGMTPORT
[0:0] -A OVN-KUBE-EGRESS-SVC -m mark --mark 0x3f0 -m comment --comment DoNotSNAT -j RETURN
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.244/32 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.30.208.38:8000
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.253/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.134.4:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.249/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.240.255:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.247/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.111.140:3300
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.251/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.40.62:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.248/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.121.113:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.252/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.87.74:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.250/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.17.89:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.246/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.45.170:3300
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.245/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.162.218:3300
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31659 -j DNAT --to-destination 172.30.138.30:50051
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31571 -j DNAT --to-destination 172.30.142.195:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30625 -j DNAT --to-destination 172.30.69.228:7004
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31116 -j DNAT --to-destination 172.30.69.228:8444
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30465 -j DNAT --to-destination 172.30.69.228:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 32632 -j DNAT --to-destination 172.30.69.228:80
[17982053:1078438876] -A OVN-KUBE-SNAT-MGMTPORT -o ovn-k8s-mp0 -m comment --comment "OVN SNAT to Management Port" -j SNAT --to-source 10.254.28.2
COMMIT
# Completed on Fri Feb 14 16:49:25 2025