iptables-save -c
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:47:53 2025
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [322491886:246170780194]
:POSTROUTING ACCEPT [322491121:246170584751]
:KUBE-IPTABLES-HINT - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-ITP - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[322491886:246170780194] -A OUTPUT -j OVN-KUBE-ITP
[322491121:246170584751] -A POSTROUTING -j SUBMARINER-POSTROUTING
[1:60] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-LOCALCIDRS src -m set --match-set SUBMARINER-REMOTECIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
[0:0] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-REMOTECIDRS src -m set --match-set SUBMARINER-LOCALCIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
COMMIT
# Completed on Fri Feb 14 16:47:53 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:47:53 2025
*raw
:PREROUTING ACCEPT [293563937:123600809369]
:OUTPUT ACCEPT [322492500:246170860667]
[63553464:35586943681] -A PREROUTING -p udp -m udp --dport 6081 -j NOTRACK
[82094072:26628902636] -A OUTPUT -p udp -m udp --dport 6081 -j NOTRACK
COMMIT
# Completed on Fri Feb 14 16:47:53 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:47:53 2025
*filter
:INPUT ACCEPT [292462696:123384673457]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [322495312:246171517381]
:KUBE-FIREWALL - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:SUBMARINER-FORWARD - [0:0]
:SUBMARINER-FWD-MSSCLAMP - [0:0]
[292462696:123384673457] -A INPUT -j KUBE-FIREWALL
[0:0] -A FORWARD -j SUBMARINER-FWD-MSSCLAMP
[0:0] -A FORWARD -j SUBMARINER-FORWARD
[0:0] -A FORWARD -d 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -s 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -d 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -d 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[322495312:246171517381] -A OUTPUT -j KUBE-FIREWALL
[0:0] -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
COMMIT
# Completed on Fri Feb 14 16:47:53 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:47:53 2025
*nat
:PREROUTING ACCEPT [5806067:558433584]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [23456613:1409573313]
:POSTROUTING ACCEPT [1049522:65632181]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-EGRESS-IP-MULTI-NIC - [0:0]
:OVN-KUBE-EGRESS-SVC - [0:0]
:OVN-KUBE-ETP - [0:0]
:OVN-KUBE-EXTERNALIP - [0:0]
:OVN-KUBE-ITP - [0:0]
:OVN-KUBE-NODEPORT - [0:0]
:OVN-KUBE-SNAT-MGMTPORT - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[5806067:558433584] -A PREROUTING -j OVN-KUBE-ETP
[5806067:558433584] -A PREROUTING -j OVN-KUBE-EXTERNALIP
[5806067:558433584] -A PREROUTING -j OVN-KUBE-NODEPORT
[23461722:1409879853] -A OUTPUT -j OVN-KUBE-EXTERNALIP
[23456613:1409573313] -A OUTPUT -j OVN-KUBE-NODEPORT
[23456613:1409573313] -A OUTPUT -j OVN-KUBE-ITP
[23461699:1409878291] -A POSTROUTING -j SUBMARINER-POSTROUTING
[23461715:1409879417] -A POSTROUTING -j OVN-KUBE-EGRESS-IP-MULTI-NIC
[23461722:1409879853] -A POSTROUTING -j OVN-KUBE-EGRESS-SVC
[22412201:1344247732] -A POSTROUTING -o ovn-k8s-mp0 -j OVN-KUBE-SNAT-MGMTPORT
[0:0] -A OVN-KUBE-EGRESS-SVC -m mark --mark 0x3f0 -m comment --comment DoNotSNAT -j RETURN
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.244/32 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.30.208.38:8000
[848:50880] -A OVN-KUBE-EXTERNALIP -d 242.1.255.253/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.134.4:6800
[30:1800] -A OVN-KUBE-EXTERNALIP -d 242.1.255.247/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.111.140:3300
[537:32220] -A OVN-KUBE-EXTERNALIP -d 242.1.255.252/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.87.74:6800
[848:50880] -A OVN-KUBE-EXTERNALIP -d 242.1.255.250/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.17.89:6800
[31:1860] -A OVN-KUBE-EXTERNALIP -d 242.1.255.246/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.45.170:3300
[32:1920] -A OVN-KUBE-EXTERNALIP -d 242.1.255.245/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.162.218:3300
[1096:65760] -A OVN-KUBE-EXTERNALIP -d 242.1.255.249/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.240.255:6800
[841:50460] -A OVN-KUBE-EXTERNALIP -d 242.1.255.251/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.40.62:6800
[846:50760] -A OVN-KUBE-EXTERNALIP -d 242.1.255.248/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.121.113:6800
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31659 -j DNAT --to-destination 172.30.138.30:50051
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30625 -j DNAT --to-destination 172.30.69.228:7004
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31116 -j DNAT --to-destination 172.30.69.228:8444
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30465 -j DNAT --to-destination 172.30.69.228:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 32632 -j DNAT --to-destination 172.30.69.228:80
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31571 -j DNAT --to-destination 172.30.142.195:443
[22412201:1344247732] -A OVN-KUBE-SNAT-MGMTPORT -o ovn-k8s-mp0 -m comment --comment "OVN SNAT to Management Port" -j SNAT --to-source 10.254.24.2
COMMIT
# Completed on Fri Feb 14 16:47:53 2025