Chain INPUT (policy ACCEPT 2747 packets, 1257K bytes) pkts bytes target prot opt in out source destination 4595 1868K KUBE-ROUTER-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0 /* kube-router netpol - 4IA2OSFRMVNDXBVV */ 429 29043 KUBE-ROUTER-SERVICES all -- * * 0.0.0.0/0 0.0.0.0/0 /* handle traffic to IPVS service IPs in custom chain */ match-set kube-router-service-ips dst 3638 1461K KUBE-FIREWALL all -- * * 0.0.0.0/0 0.0.0.0/0 42 3990 ACCEPT tcp -- * * 192.168.1.135 0.0.0.0/0 tcp dpt:6443 /* iX Custom Rule to allow access to k8s cluster from internal TrueNAS connections */ 849 200K ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:6443 /* iX Custom Rule to allow access to k8s cluster from internal TrueNAS connections */ 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6443 /* iX Custom Rule to drop connection requests to k8s cluster from external sources */ Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 22 2590 KUBE-ROUTER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0 /* kube-router netpol - TEMCG2JMHZYE7H7T */ 0 0 ACCEPT all -- * enp3s0 0.0.0.0/0 0.0.0.0/0 /* allow outbound node port traffic on node interface with which node ip is associated */ 0 0 ACCEPT all -- * kube-bridge 0.0.0.0/0 0.0.0.0/0 /* allow inbound traffic to pods */ 0 0 ACCEPT all -- kube-bridge * 0.0.0.0/0 0.0.0.0/0 /* allow outbound traffic from pods */ Chain OUTPUT (policy ACCEPT 3354 packets, 1484K bytes) pkts bytes target prot opt in out source destination 4406 1665K KUBE-ROUTER-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0 /* kube-router netpol - VEAAIY32XVBHCSCY */ 3354 1484K KUBE-FIREWALL all -- * * 0.0.0.0/0 0.0.0.0/0 Chain KUBE-FIREWALL (2 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * !127.0.0.0/8 127.0.0.0/8 /* block incoming localnet connections */ ! ctstate RELATED,ESTABLISHED,DNAT 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000 Chain KUBE-KUBELET-CANARY (0 references) pkts bytes target prot opt in out source destination Chain KUBE-NWPLCY-DEFAULT (20 references) pkts bytes target prot opt in out source destination 38 4902 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to mark traffic matching a network policy */ MARK or 0x10000 Chain KUBE-POD-FW-7XXLW7A74UEWBX7U (7 references) pkts bytes target prot opt in out source destination 319 170K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 28 1680 ACCEPT all -- * * 0.0.0.0/0 172.16.0.130 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.130 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.130 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-C7MYVZEMCVF4WRBB (7 references) pkts bytes target prot opt in out source destination 314 169K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 28 1680 ACCEPT all -- * * 0.0.0.0/0 172.16.0.133 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.133 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.133 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 (7 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.131 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.131 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.131 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-EQFYWSUZKYZEGKQL (7 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.128 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.128 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.128 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-FSF4CZVICEDYYZMQ (7 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.126 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.126 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.126 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK (7 references) pkts bytes target prot opt in out source destination 720 194K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.124 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.124 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.124 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:openebs-zfs-controller-0 namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:openebs-zfs-controller-0 namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 (7 references) pkts bytes target prot opt in out source destination 136 15634 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 14 840 ACCEPT all -- * * 0.0.0.0/0 172.16.0.127 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 38 4902 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.127 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.127 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 38 4902 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 38 4902 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-NYXIEHEPU3VXQE34 (7 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.129 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.129 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.129 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX (7 references) pkts bytes target prot opt in out source destination 407 31980 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 41 2460 ACCEPT all -- * * 0.0.0.0/0 172.16.0.125 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.125 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.125 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:coredns-75fc8f8fff-tffxg namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:coredns-75fc8f8fff-tffxg namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-POD-FW-UOQGWPMBERWWSPQA (7 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to drop invalid state for pod */ ctstate INVALID 0 0 ACCEPT all -- * * 0.0.0.0/0 172.16.0.132 /* rule to permit the traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL 0 0 KUBE-NWPLCY-DEFAULT all -- * * 172.16.0.132 0.0.0.0/0 /* run through default egress network policy chain */ 0 0 KUBE-NWPLCY-DEFAULT all -- * * 0.0.0.0/0 172.16.0.132 /* run through default ingress network policy chain */ 0 0 NFLOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to log dropped traffic POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* rule to REJECT traffic destined for POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 MARK and 0xfffeffff 0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0 /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000 Chain KUBE-ROUTER-FORWARD (1 references) pkts bytes target prot opt in out source destination 0 0 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 0.0.0.0/0 172.16.0.127 /* rule to jump traffic destined to POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 0 0 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 0.0.0.0/0 172.16.0.127 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 22 2590 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 172.16.0.127 0.0.0.0/0 /* rule to jump traffic from POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 18 2322 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 172.16.0.127 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 0 0 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 0.0.0.0/0 172.16.0.130 /* rule to jump traffic destined to POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 0.0.0.0/0 172.16.0.130 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 172.16.0.130 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 172.16.0.130 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 0.0.0.0/0 172.16.0.126 /* rule to jump traffic destined to POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 0.0.0.0/0 172.16.0.126 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 172.16.0.126 0.0.0.0/0 /* rule to jump traffic from POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 172.16.0.126 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 0.0.0.0/0 172.16.0.128 /* rule to jump traffic destined to POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 0.0.0.0/0 172.16.0.128 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 172.16.0.128 0.0.0.0/0 /* rule to jump traffic from POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 172.16.0.128 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 0 0 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 0.0.0.0/0 172.16.0.125 /* rule to jump traffic destined to POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 0 0 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 0.0.0.0/0 172.16.0.125 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 0 0 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 172.16.0.125 0.0.0.0/0 /* rule to jump traffic from POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 0 0 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 172.16.0.125 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 0 0 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 0.0.0.0/0 172.16.0.124 /* rule to jump traffic destined to POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 0.0.0.0/0 172.16.0.124 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 172.16.0.124 0.0.0.0/0 /* rule to jump traffic from POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 172.16.0.124 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 0.0.0.0/0 172.16.0.132 /* rule to jump traffic destined to POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 0.0.0.0/0 172.16.0.132 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 172.16.0.132 0.0.0.0/0 /* rule to jump traffic from POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 172.16.0.132 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 0 0 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 0.0.0.0/0 172.16.0.133 /* rule to jump traffic destined to POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 0.0.0.0/0 172.16.0.133 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 172.16.0.133 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 172.16.0.133 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 0.0.0.0/0 172.16.0.131 /* rule to jump traffic destined to POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 0.0.0.0/0 172.16.0.131 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 172.16.0.131 0.0.0.0/0 /* rule to jump traffic from POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 172.16.0.131 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 0.0.0.0/0 172.16.0.129 /* rule to jump traffic destined to POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 0.0.0.0/0 172.16.0.129 PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 172.16.0.129 0.0.0.0/0 /* rule to jump traffic from POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 172.16.0.129 0.0.0.0/0 PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 18 2322 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* explicitly ACCEPT traffic that complies with network policies */ mark match 0x20000/0x20000 Chain KUBE-ROUTER-INPUT (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- * * 0.0.0.0/0 10.96.0.0/12 /* allow traffic to cluster IP - 4H2UH6XHRCCZXCYQ */ 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 /* allow LOCAL TCP traffic to node ports - LR7XO7NXDBGQJD2M */ ADDRTYPE match dst-type LOCAL multiport dports 30000:32767 0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 /* allow LOCAL UDP traffic to node ports - 76UCBPIZNGJNWNUZ */ ADDRTYPE match dst-type LOCAL multiport dports 30000:32767 72 10632 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 172.16.0.127 0.0.0.0/0 /* rule to jump traffic from POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 167 159K KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 172.16.0.130 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 172.16.0.126 0.0.0.0/0 /* rule to jump traffic from POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 172.16.0.128 0.0.0.0/0 /* rule to jump traffic from POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 211 17113 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 172.16.0.125 0.0.0.0/0 /* rule to jump traffic from POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 335 61750 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 172.16.0.124 0.0.0.0/0 /* rule to jump traffic from POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 172.16.0.132 0.0.0.0/0 /* rule to jump traffic from POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 168 158K KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 172.16.0.133 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 172.16.0.131 0.0.0.0/0 /* rule to jump traffic from POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 172.16.0.129 0.0.0.0/0 /* rule to jump traffic from POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 2 258 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* explicitly ACCEPT traffic that complies with network policies */ mark match 0x20000/0x20000 Chain KUBE-ROUTER-OUTPUT (1 references) pkts bytes target prot opt in out source destination 76 5832 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 0.0.0.0/0 172.16.0.127 /* rule to jump traffic destined to POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 0 0 KUBE-POD-FW-IPVNLFDNM7SHLKU7 all -- * * 172.16.0.127 0.0.0.0/0 /* rule to jump traffic from POD name:syncthing-69cc797678-sfs96 namespace: ix-syncthing to chain KUBE-POD-FW-IPVNLFDNM7SHLKU7 */ 180 13182 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 0.0.0.0/0 172.16.0.130 /* rule to jump traffic destined to POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-7XXLW7A74UEWBX7U all -- * * 172.16.0.130 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-6cd6fdcbb7-kts6v namespace: ix-photoprism to chain KUBE-POD-FW-7XXLW7A74UEWBX7U */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 0.0.0.0/0 172.16.0.126 /* rule to jump traffic destined to POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-FSF4CZVICEDYYZMQ all -- * * 172.16.0.126 0.0.0.0/0 /* rule to jump traffic from POD name:oauth2-proxy-ix-chart-548c988d9d-6ssjr namespace: ix-oauth2-proxy to chain KUBE-POD-FW-FSF4CZVICEDYYZMQ */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 0.0.0.0/0 172.16.0.128 /* rule to jump traffic destined to POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 0 0 KUBE-POD-FW-EQFYWSUZKYZEGKQL all -- * * 172.16.0.128 0.0.0.0/0 /* rule to jump traffic from POD name:redis-ix-chart-5954dcc6d5-sgwk4 namespace: ix-redis to chain KUBE-POD-FW-EQFYWSUZKYZEGKQL */ 237 17327 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 0.0.0.0/0 172.16.0.125 /* rule to jump traffic destined to POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 0 0 KUBE-POD-FW-OHZ2HDR3HLKKXVNX all -- * * 172.16.0.125 0.0.0.0/0 /* rule to jump traffic from POD name:coredns-75fc8f8fff-tffxg namespace: kube-system to chain KUBE-POD-FW-OHZ2HDR3HLKKXVNX */ 385 132K KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 0.0.0.0/0 172.16.0.124 /* rule to jump traffic destined to POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-GDGOQQDQ5ZUA3IQK all -- * * 172.16.0.124 0.0.0.0/0 /* rule to jump traffic from POD name:openebs-zfs-controller-0 namespace: kube-system to chain KUBE-POD-FW-GDGOQQDQ5ZUA3IQK */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 0.0.0.0/0 172.16.0.132 /* rule to jump traffic destined to POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 0 0 KUBE-POD-FW-UOQGWPMBERWWSPQA all -- * * 172.16.0.132 0.0.0.0/0 /* rule to jump traffic from POD name:keycloak-ix-chart-647b9cbfcd-rwccm namespace: ix-keycloak to chain KUBE-POD-FW-UOQGWPMBERWWSPQA */ 174 12870 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 0.0.0.0/0 172.16.0.133 /* rule to jump traffic destined to POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-C7MYVZEMCVF4WRBB all -- * * 172.16.0.133 0.0.0.0/0 /* rule to jump traffic from POD name:photoprism-katelyn-6f97989bfd-fccf7 namespace: ix-photoprism-katelyn to chain KUBE-POD-FW-C7MYVZEMCVF4WRBB */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 0.0.0.0/0 172.16.0.131 /* rule to jump traffic destined to POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-EGRTJSQMQIGN7KR4 all -- * * 172.16.0.131 0.0.0.0/0 /* rule to jump traffic from POD name:ses-email-service-ix-chart-7b65849f4-gp9mr namespace: ix-ses-email-service to chain KUBE-POD-FW-EGRTJSQMQIGN7KR4 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 0.0.0.0/0 172.16.0.129 /* rule to jump traffic destined to POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 0 0 KUBE-POD-FW-NYXIEHEPU3VXQE34 all -- * * 172.16.0.129 0.0.0.0/0 /* rule to jump traffic from POD name:vaultwarden-ix-chart-6bcf6966b5-shq9l namespace: ix-vaultwarden to chain KUBE-POD-FW-NYXIEHEPU3VXQE34 */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* explicitly ACCEPT traffic that complies with network policies */ mark match 0x20000/0x20000 Chain KUBE-ROUTER-SERVICES (1 references) pkts bytes target prot opt in out source destination 4 268 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* allow input traffic to ipvs services */ match-set kube-router-ipvs-services dst,dst 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 /* allow icmp echo requests to service IPs */ icmptype 8 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 /* allow icmp destination unreachable messages to service IPs */ icmptype 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 /* allow icmp ttl exceeded messages to service IPs */ icmptype 11 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* reject all unexpected traffic to service IPs */ ! match-set kube-router-local-ips dst reject-with icmp-port-unreachable