iptables-save -c
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:08 2025
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [835293437:987870528935]
:POSTROUTING ACCEPT [857843396:994542330607]
:KUBE-IPTABLES-HINT - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-ITP - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[835293437:987870528935] -A OUTPUT -j OVN-KUBE-ITP
[857843396:994542330607] -A POSTROUTING -j SUBMARINER-POSTROUTING
[10849:650940] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-LOCALCIDRS src -m set --match-set SUBMARINER-REMOTECIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
[10663:639780] -A SUBMARINER-POSTROUTING -p tcp -m set --match-set SUBMARINER-REMOTECIDRS src -m set --match-set SUBMARINER-LOCALCIDRS dst -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
COMMIT
# Completed on Fri Feb 14 16:49:08 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:08 2025
*raw
:PREROUTING ACCEPT [864406044:421765167376]
:OUTPUT ACCEPT [835294069:987870616275]
[583686645:327913470090] -A PREROUTING -p udp -m udp --dport 6081 -j NOTRACK
[595426076:711220626065] -A OUTPUT -p udp -m udp --dport 6081 -j NOTRACK
COMMIT
# Completed on Fri Feb 14 16:49:08 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:08 2025
*filter
:INPUT ACCEPT [840753534:414877107833]
:FORWARD DROP [161:35318]
:OUTPUT ACCEPT [835297004:987871262931]
:KUBE-FIREWALL - [0:0]
:KUBE-KUBELET-CANARY - [0:0]
:SUBMARINER-FORWARD - [0:0]
:SUBMARINER-FWD-MSSCLAMP - [0:0]
[840753534:414877107833] -A INPUT -j KUBE-FIREWALL
[22551224:6672071043] -A FORWARD -j SUBMARINER-FWD-MSSCLAMP
[22551224:6672071043] -A FORWARD -j SUBMARINER-FORWARD
[0:0] -A FORWARD -d 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -s 169.254.0.1/32 -j ACCEPT
[0:0] -A FORWARD -d 172.30.0.0/16 -j ACCEPT
[4370359:1451034935] -A FORWARD -s 172.30.0.0/16 -j ACCEPT
[1:80] -A FORWARD -d 10.254.0.0/16 -j ACCEPT
[7060930:1807061809] -A FORWARD -s 10.254.0.0/16 -j ACCEPT
[0:0] -A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A OUTPUT -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[835297004:987871262931] -A OUTPUT -j KUBE-FIREWALL
[0:0] -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
[0:0] -A SUBMARINER-FORWARD -d 242.0.0.0/16 -i ovn-k8s-mp0 -o br-ex -j ACCEPT
[11119776:3413939081] -A SUBMARINER-FORWARD -s 242.0.0.0/16 -i br-ex -o ovn-k8s-mp0 -j ACCEPT
[22665:1359900] -A SUBMARINER-FWD-MSSCLAMP -d 242.0.0.0/16 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1398
[22424:1345440] -A SUBMARINER-FWD-MSSCLAMP -s 242.0.0.0/16 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1398
COMMIT
# Completed on Fri Feb 14 16:49:08 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Feb 14 16:49:08 2025
*nat
:PREROUTING ACCEPT [5676715:551044750]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [8752790:552818617]
:POSTROUTING ACCEPT [1224295:101109157]
:KUBE-KUBELET-CANARY - [0:0]
:OVN-KUBE-EGRESS-IP-MULTI-NIC - [0:0]
:OVN-KUBE-EGRESS-SVC - [0:0]
:OVN-KUBE-ETP - [0:0]
:OVN-KUBE-EXTERNALIP - [0:0]
:OVN-KUBE-ITP - [0:0]
:OVN-KUBE-NODEPORT - [0:0]
:OVN-KUBE-SNAT-MGMTPORT - [0:0]
:SM-GN-EGRESS-CLUSTER - [0:0]
:SM-GN-EGRESS-HDLS-EPS - [0:0]
:SM-GN-EGRESS-HDLS-PODS - [0:0]
:SM-GN-EGRESS-NS - [0:0]
:SM-GN-EGRESS-PODS - [0:0]
:SUBMARINER-GN-EGRESS - [0:0]
:SUBMARINER-GN-INGRESS - [0:0]
:SUBMARINER-GN-MARK - [0:0]
:SUBMARINER-POSTROUTING - [0:0]
[6232892:580060799] -A PREROUTING -j SUBMARINER-GN-INGRESS
[5688473:551751228] -A PREROUTING -j OVN-KUBE-ETP
[5688473:551751228] -A PREROUTING -j OVN-KUBE-EXTERNALIP
[5676715:551044750] -A PREROUTING -j OVN-KUBE-NODEPORT
[8761595:553346917] -A OUTPUT -j OVN-KUBE-EXTERNALIP
[8752790:552818617] -A OUTPUT -j OVN-KUBE-NODEPORT
[8752790:552818617] -A OUTPUT -j OVN-KUBE-ITP
[9328959:583031225] -A POSTROUTING -j SUBMARINER-POSTROUTING
[8761566:553345417] -A POSTROUTING -j OVN-KUBE-EGRESS-IP-MULTI-NIC
[8761567:553345477] -A POSTROUTING -j OVN-KUBE-EGRESS-SVC
[7537274:452236440] -A POSTROUTING -o ovn-k8s-mp0 -j OVN-KUBE-SNAT-MGMTPORT
[0:0] -A OVN-KUBE-EGRESS-SVC -m mark --mark 0x3f0 -m comment --comment DoNotSNAT -j RETURN
[0:0] -A OVN-KUBE-EXTERNALIP -d 242.1.255.244/32 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.30.208.38:8000
[74:4440] -A OVN-KUBE-EXTERNALIP -d 242.1.255.253/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.134.4:6800
[39:2340] -A OVN-KUBE-EXTERNALIP -d 242.1.255.247/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.111.140:3300
[3247:194820] -A OVN-KUBE-EXTERNALIP -d 242.1.255.252/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.87.74:6800
[510:30600] -A OVN-KUBE-EXTERNALIP -d 242.1.255.251/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.40.62:6800
[91:5460] -A OVN-KUBE-EXTERNALIP -d 242.1.255.246/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.45.170:3300
[2646:158760] -A OVN-KUBE-EXTERNALIP -d 242.1.255.250/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.17.89:6800
[6831:409860] -A OVN-KUBE-EXTERNALIP -d 242.1.255.249/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.240.255:6800
[90:5400] -A OVN-KUBE-EXTERNALIP -d 242.1.255.245/32 -p tcp -m tcp --dport 3300 -j DNAT --to-destination 172.30.162.218:3300
[6763:406101] -A OVN-KUBE-EXTERNALIP -d 242.1.255.248/32 -p tcp -m tcp --dport 6800 -j DNAT --to-destination 172.30.121.113:6800
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31659 -j DNAT --to-destination 172.30.138.30:50051
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31571 -j DNAT --to-destination 172.30.142.195:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30625 -j DNAT --to-destination 172.30.69.228:7004
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 31116 -j DNAT --to-destination 172.30.69.228:8444
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30465 -j DNAT --to-destination 172.30.69.228:443
[0:0] -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 32632 -j DNAT --to-destination 172.30.69.228:80
[7537274:452236440] -A OVN-KUBE-SNAT-MGMTPORT -o ovn-k8s-mp0 -m comment --comment "OVN SNAT to Management Port" -j SNAT --to-source 10.254.20.2
[555689:28983529] -A SM-GN-EGRESS-CLUSTER -s 10.254.0.0/16 -m mark --mark 0xc0000/0xc0000 -j SNAT --to-source 242.1.0.1-242.1.0.8
[0:0] -A SM-GN-EGRESS-CLUSTER -s 172.30.0.0/16 -m mark --mark 0xc0000/0xc0000 -j SNAT --to-source 242.1.0.1-242.1.0.8
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SUBMARINER-GN-MARK
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SM-GN-EGRESS-PODS
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SM-GN-EGRESS-HDLS-PODS
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SM-GN-EGRESS-HDLS-EPS
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SM-GN-EGRESS-NS
[27915:1749247] -A SUBMARINER-GN-EGRESS -j SM-GN-EGRESS-CLUSTER
[1762:91624] -A SUBMARINER-GN-INGRESS -d 242.1.255.254/32 -p icmp -j DNAT --to-destination 10.254.20.2
[1768:91936] -A SUBMARINER-GN-MARK -d 242.0.0.0/16 -j MARK --set-xmark 0xc0000/0xc0000
[9328957:583031105] -A SUBMARINER-POSTROUTING -j SUBMARINER-GN-EGRESS
[1:52] -A SUBMARINER-POSTROUTING -d 242.0.0.0/16 -j ACCEPT
[11760:706598] -A SUBMARINER-POSTROUTING -s 242.0.0.0/16 -j ACCEPT
COMMIT
# Completed on Fri Feb 14 16:49:08 2025