iptables-save -c
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:41 2025
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6256124814:4731353957825]
:POSTROUTING ACCEPT [6256110141:4731349212796]
:KUBE-IPTABLES-HINT - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-ITP - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[6256124815:4731353957877] -A OUTPUT -j OVN-KUBE-ITP
[6256110142:4731349212848] -A POSTROUTING -j SUBMARINER-POSTROUTING
[0:0] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-LOCALCIDRS src -m set --match-set SUBMARINER-REMOTECIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
[0:0] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-REMOTECIDRS src -m set --match-set SUBMARINER-LOCALCIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
COMMIT
# Completed on Fri Feb 14 16:49:41 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:41 2025
*raw
:PREROUTING ACCEPT [6282198643:4029542686076]
:OUTPUT ACCEPT [6256129016:4731354461479]
[245026243:611479560564] -A PREROUTING -p udp -m udp --dport 6081 -j NOTRACK
[228633574:233307957779] -A OUTPUT -p udp -m udp --dport 6081 -j NOTRACK
COMMIT
# Completed on Fri Feb 14 16:49:41 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:41 2025
*filter
:INPUT ACCEPT [6281106625:4029371505358]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [6256140853:4731355945687]
:KUBE-FIREWALL - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:SUBMARINER-FORWARD - [0:0]
:SUBMARINER-FWD-MSSCLAMP - [0:0]
[6281106625:4029371505358] -A INPUT -j KUBE-FIREWALL
[0:0] -A FORWARD -j SUBMARINER-FWD-MSSCLAMP
[0:0] -A FORWARD -j SUBMARINER-FORWARD
[0:0] -A FORWARD -d 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -s 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -d 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -d 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[6256140855:4731355945874] -A OUTPUT -j KUBE-FIREWALL
[0:0] -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
COMMIT
# Completed on Fri Feb 14 16:49:41 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:41 2025
*nat
:PREROUTING ACCEPT [15027791:1111726169]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [20466258:1230294874]
:POSTROUTING ACCEPT [11810344:711424446]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-EGRESS-IP-MULTI-NIC - [0:0]
:OVN-KUBE-EGRESS-SVC - [0:0]
:OVN-KUBE-ETP - [0:0]
:OVN-KUBE-EXTERNALIP - [0:0]
:OVN-KUBE-ITP - [0:0]
:OVN-KUBE-NODEPORT - [0:0]
:OVN-KUBE-SNAT-MGMTPORT - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[15027786:1111725869] -A PREROUTING -j OVN-KUBE-ETP
[15027789:1111726049] -A PREROUTING -j OVN-KUBE-EXTERNALIP
[15027791:1111726169] -A PREROUTING -j OVN-KUBE-NODEPORT
[20466258:1230294874] -A OUTPUT -j OVN-KUBE-EXTERNALIP
[20466258:1230294874] -A OUTPUT -j OVN-KUBE-NODEPORT
[20466258:1230294874] -A OUTPUT -j OVN-KUBE-ITP
[20466110:1230285768] -A POSTROUTING -j SUBMARINER-POSTROUTING
[20466257:1230294814] -A POSTROUTING -j OVN-KUBE-EGRESS-IP-MULTI-NIC
[20466258:1230294874] -A POSTROUTING -j OVN-KUBE-EGRESS-SVC
[8656108:518882104] -A POSTROUTING -o ovn-k8s-mp0 -j OVN-KUBE-SNAT-MGMTPORT
[0:0] -A OVN-KUBE-EGRESS-SVC -m mark --mark 0x3f0 -m comment --comment DoNotSNAT -j RETURN
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.244/32 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.30.208.38:8000
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.253/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.134.4:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.247/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.111.140:3300
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.252/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.87.74:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.249/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.240.255:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.246/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.45.170:3300
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.250/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.17.89:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.245/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.162.218:3300
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.251/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.40.62:6800
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.248/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.121.113:6800
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31659 -j DNAT --to-destination 172.30.138.30:50051
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30625 -j DNAT --to-destination 172.30.69.228:7004
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31116 -j DNAT --to-destination 172.30.69.228:8444
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30465 -j DNAT --to-destination 172.30.69.228:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 32632 -j DNAT --to-destination 172.30.69.228:80
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31571 -j DNAT --to-destination 172.30.142.195:443
[8656055:518878924] -A OVN-KUBE-SNAT-MGMTPORT -o ovn-k8s-mp0 -m comment --comment "OVN SNAT to Management Port" -j SNAT --to-source 10.254.4.2
COMMIT
# Completed on Fri Feb 14 16:49:41 2025