k8s的iptables转发规则原理图

image.png

来源于https://github.com/cilium/k8s-iptables-diagram

#部分iptables规则
[root@localhost ~]# iptables-save 
# Generated by iptables-save v1.4.21 on Wed Nov 14 16:01:10 2018
*mangle
:PREROUTING ACCEPT [13123859:4246034841]
:INPUT ACCEPT [13090664:4240571126]
:FORWARD ACCEPT [3584:3013486]
:OUTPUT ACCEPT [12863341:3655778720]
:POSTROUTING ACCEPT [12866925:3658792206]
COMMIT
# Completed on Wed Nov 14 16:01:10 2018
# Generated by iptables-save v1.4.21 on Wed Nov 14 16:01:10 2018
*raw
:PREROUTING ACCEPT [13123859:4246034841]
:OUTPUT ACCEPT [12863341:3655778720]
COMMIT
# Completed on Wed Nov 14 16:01:10 2018
# Generated by iptables-save v1.4.21 on Wed Nov 14 16:01:10 2018
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
:KUBE-MARK-DROP - [0:0]
:KUBE-MARK-MASQ - [0:0]
:KUBE-NODEPORTS - [0:0]
:KUBE-POSTROUTING - [0:0]
:KUBE-SEP-2DR36SHMKG72WTUG - [0:0]
:KUBE-SEP-2FG2MTZOAJQOBCTO - [0:0]
:KUBE-SEP-6TIHUV4SBOWFDLOO - [0:0]
:KUBE-SEP-7LBTVXR4SNTYCXO7 - [0:0]
:KUBE-SEP-7YSF6JYM2PLNZOVZ - [0:0]
:KUBE-SEP-QLEXD5JUCJRC3DDG - [0:0]
:KUBE-SEP-WQKJNDAM4UDU2FCE - [0:0]
:KUBE-SERVICES - [0:0]
:KUBE-SVC-ERIFXISQEP7F7OF4 - [0:0]
:KUBE-SVC-LC5QY66VUV2HJ6WZ - [0:0]
:KUBE-SVC-NPX46M4PTMTKRN6Y - [0:0]
:KUBE-SVC-TCOU7JCQXEZGVUNU - [0:0]
:KUBE-SVC-XGLOHA7QRQ3V22RZ - [0:0]
-A PREROUTING -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.21.0.0/16 ! -o br-e3714bddecff -j MASQUERADE
-A POSTROUTING -m comment --comment "kubernetes postrouting rules" -j KUBE-POSTROUTING
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-6d3f1ea4b920 -j MASQUERADE
-A POSTROUTING -s 172.19.0.0/16 ! -o br-33d37d9728d5 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.20.0.0/16 -d 172.20.0.0/16 -j RETURN
-A POSTROUTING -s 172.20.0.0/16 ! -d 224.0.0.0/4 -j MASQUERADE
-A POSTROUTING ! -s 172.20.0.0/16 -d 172.20.0.0/24 -j RETURN
-A POSTROUTING ! -s 172.20.0.0/16 -d 172.20.0.0/16 -j MASQUERADE
-A POSTROUTING -s 172.21.0.2/32 -d 172.21.0.2/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.21.0.3/32 -d 172.21.0.3/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.21.0.3/32 -d 172.21.0.3/32 -p tcp -m tcp --dport 8000 -j MASQUERADE
-A DOCKER -i br-e3714bddecff -j RETURN
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-6d3f1ea4b920 -j RETURN
-A DOCKER -i br-33d37d9728d5 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 2333 -j DNAT --to-destination 172.17.0.2:80
-A DOCKER ! -i br-e3714bddecff -p tcp -m tcp --dport 3306 -j DNAT --to-destination 172.21.0.2:3306
-A DOCKER ! -i br-e3714bddecff -p tcp -m tcp --dport 8089 -j DNAT --to-destination 172.21.0.3:80
-A DOCKER ! -i br-e3714bddecff -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.21.0.3:8000
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
-A KUBE-NODEPORTS -p tcp -m comment --comment "kube-system/kubernetes-dashboard:" -m tcp --dport 31711 -j KUBE-MARK-MASQ
-A KUBE-NODEPORTS -p tcp -m comment --comment "kube-system/kubernetes-dashboard:" -m tcp --dport 31711 -j KUBE-SVC-XGLOHA7QRQ3V22RZ
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark 0x4000/0x4000 -j MASQUERADE
-A KUBE-SEP-2DR36SHMKG72WTUG -s 10.0.60.51/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-2DR36SHMKG72WTUG -p tcp -m tcp -j DNAT --to-destination 10.0.60.51:6443
-A KUBE-SEP-2FG2MTZOAJQOBCTO -s 172.20.0.5/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-2FG2MTZOAJQOBCTO -p tcp -m tcp -j DNAT --to-destination 172.20.0.5:8443
-A KUBE-SEP-6TIHUV4SBOWFDLOO -s 172.20.0.3/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-6TIHUV4SBOWFDLOO -p tcp -m tcp -j DNAT --to-destination 172.20.0.3:53
-A KUBE-SEP-7LBTVXR4SNTYCXO7 -s 172.20.0.4/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-7LBTVXR4SNTYCXO7 -p tcp -m tcp -j DNAT --to-destination 172.20.0.4:443
-A KUBE-SEP-7YSF6JYM2PLNZOVZ -s 172.20.0.2/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-7YSF6JYM2PLNZOVZ -p udp -m udp -j DNAT --to-destination 172.20.0.2:53
-A KUBE-SEP-QLEXD5JUCJRC3DDG -s 172.20.0.2/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-QLEXD5JUCJRC3DDG -p tcp -m tcp -j DNAT --to-destination 172.20.0.2:53
-A KUBE-SEP-WQKJNDAM4UDU2FCE -s 172.20.0.3/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-WQKJNDAM4UDU2FCE -p udp -m udp -j DNAT --to-destination 172.20.0.3:53
-A KUBE-SERVICES -d 10.68.15.73/32 -p tcp -m comment --comment "kube-system/kubernetes-dashboard: cluster IP" -m tcp --dport 443 -j KUBE-SVC-XGLOHA7QRQ3V22RZ
-A KUBE-SERVICES -d 10.68.0.1/32 -p tcp -m comment --comment "default/kubernetes:https cluster IP" -m tcp --dport 443 -j KUBE-SVC-NPX46M4PTMTKRN6Y
-A KUBE-SERVICES -d 10.68.0.2/32 -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp cluster IP" -m tcp --dport 53 -j KUBE-SVC-ERIFXISQEP7F7OF4
-A KUBE-SERVICES -d 10.68.0.2/32 -p udp -m comment --comment "kube-system/kube-dns:dns cluster IP" -m udp --dport 53 -j KUBE-SVC-TCOU7JCQXEZGVUNU
-A KUBE-SERVICES -d 10.68.41.150/32 -p tcp -m comment --comment "kube-system/metrics-server: cluster IP" -m tcp --dport 443 -j KUBE-SVC-LC5QY66VUV2HJ6WZ
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
-A KUBE-SVC-ERIFXISQEP7F7OF4 -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-QLEXD5JUCJRC3DDG
-A KUBE-SVC-ERIFXISQEP7F7OF4 -j KUBE-SEP-6TIHUV4SBOWFDLOO
-A KUBE-SVC-LC5QY66VUV2HJ6WZ -j KUBE-SEP-7LBTVXR4SNTYCXO7
-A KUBE-SVC-NPX46M4PTMTKRN6Y -j KUBE-SEP-2DR36SHMKG72WTUG
-A KUBE-SVC-TCOU7JCQXEZGVUNU -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-7YSF6JYM2PLNZOVZ
-A KUBE-SVC-TCOU7JCQXEZGVUNU -j KUBE-SEP-WQKJNDAM4UDU2FCE
-A KUBE-SVC-XGLOHA7QRQ3V22RZ -j KUBE-SEP-2FG2MTZOAJQOBCTO
COMMIT
# Completed on Wed Nov 14 16:01:10 2018
# Generated by iptables-save v1.4.21 on Wed Nov 14 16:01:10 2018
*filter
:INPUT ACCEPT [1097:219353]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1093:231833]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:KUBE-EXTERNAL-SERVICES - [0:0]
:KUBE-FIREWALL - [0:0]
:KUBE-FORWARD - [0:0]
:KUBE-SERVICES - [0:0]
-A INPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes externally-visible service portals" -j KUBE-EXTERNAL-SERVICES
-A INPUT -j KUBE-FIREWALL
-A INPUT -s 10.0.0.0/8 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -s 172.16.0.0/12 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4194 -j DROP
-A INPUT -s 10.0.0.0/8 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -s 172.16.0.0/12 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport 4194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4194 -j DROP
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-e3714bddecff -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-e3714bddecff -j DOCKER
-A FORWARD -i br-e3714bddecff ! -o br-e3714bddecff -j ACCEPT
-A FORWARD -i br-e3714bddecff -o br-e3714bddecff -j ACCEPT
-A FORWARD -m comment --comment "kubernetes forwarding rules" -j KUBE-FORWARD
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-6d3f1ea4b920 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-6d3f1ea4b920 -j DOCKER
-A FORWARD -i br-6d3f1ea4b920 ! -o br-6d3f1ea4b920 -j ACCEPT
-A FORWARD -i br-6d3f1ea4b920 -o br-6d3f1ea4b920 -j ACCEPT
-A FORWARD -o br-33d37d9728d5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-33d37d9728d5 -j DOCKER
-A FORWARD -i br-33d37d9728d5 ! -o br-33d37d9728d5 -j ACCEPT
-A FORWARD -i br-33d37d9728d5 -o br-33d37d9728d5 -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -s 172.20.0.0/16 -j ACCEPT
-A FORWARD -d 172.20.0.0/16 -j ACCEPT
-A OUTPUT -m conntrack --ctstate NEW -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
-A OUTPUT -j KUBE-FIREWALL
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.21.0.2/32 ! -i br-e3714bddecff -o br-e3714bddecff -p tcp -m tcp --dport 3306 -j ACCEPT
-A DOCKER -d 172.21.0.3/32 ! -i br-e3714bddecff -o br-e3714bddecff -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.21.0.3/32 ! -i br-e3714bddecff -o br-e3714bddecff -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-e3714bddecff ! -o br-e3714bddecff -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-6d3f1ea4b920 ! -o br-6d3f1ea4b920 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-33d37d9728d5 ! -o br-33d37d9728d5 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-e3714bddecff -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-6d3f1ea4b920 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-33d37d9728d5 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
COMMIT
# Completed on Wed Nov 14 16:01:10 2018