target prot opt source destination DROP all -- anywhere anywhere /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000 上面的配置中,INPUT链的target为一条自定义的名为KUBE-FIREWALL的链,这样,从INPUT入口进入的数据包将会沿着链到达KUBE-FIREWALL链,然后将所有带有0x8000/0x8000...
88 5280 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK or 0x4000 对于KUBE-MARK-MASQ链中所有规则设置了kubernetes独有MARK标记,在KUBE-POSTROUTING链中对NODE节点上匹配kubernetes独有MARK标记的数据包,当报文离开node节点时进行SNAT,MASQUERADE源IP 1 -A KUBE-POSTROUTING -m comment --comment"kubernetes servi...
时至今日,在linux里只有一种方法能设置mark,即iptables的MARKtarget,以前在ipchains里是FWMARKtarget。这就是为什么在高级路由里我们仍要参照FWMARK的原因。mark字段的值是一个无符号的整数,在32位系统上最大可以是4294967296(就是2的32次方),这足够用的了:) Table 1-10. Mark match options 4.3.4. Multiport ma...
Chain KUBE-FIREWALL (2 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000 下面是对nexus的service的处理,可以看到该规对目的IP为172.21.12.49(Cluster IP)...
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000 -A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000 -A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN -A KUBE-POSTROUTING -j MARK --set-xmark 0x4000/0x0 ...
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000 Chain KUBE-FORWARD (1 references) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes forwarding rules */ mark match 0x4000/0x4000 ...
mark-for-masquerade chainKubeMarkMasqChain utiliptables.Chain="KUBE-MARK-MASQ"/*对于未能匹配到跳转规则的traffic set mark 0x8000,有此标记的数据包会在filter表drop掉*/// the mark-for-drop chainKubeMarkDropChain utiliptables.Chain="KUBE-MARK-DROP"/*对于符合条件的包 set mark 0x4000, 有此标记的...
进入KUBE-MARK-MASQ 链进行标记,一个进入KUBE-SVC-2RMP45C4XWDG5BGC链 Chain KUBE-POSTROUTING (1 references) pkts bytes target prot opt in out source destination 1 64 MASQUERADE all -- * * 0.0.0.0/0 0.0.0.0/0 /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000 ===...
-A KUBE-SERVICES -mset--match-set KUBE-CLUSTER-IP dst,dst -j ACCEPT# 其中 KUBE-CLUSTER-IP是一个clusteip ipset集合,使用ipset list KUBE-CLUSTER-IP 查看,里面存放所有服务clusterip-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000 ...
* * 0.0.0.0/0 0.0.0.0/0 MARK or 0x4000 Chain KUBE-NODEPORTS (1 references) pkts bytes target prot opt in out source destination Chain KUBE-POSTROUTING (1 references) pkts bytes target prot opt in out source destination 101 6189 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 mark match !