root@cockbox:/opt/mailcow-dockerized# sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
KUBE-ROUTER-INPUT  all  --  0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - 4IA2OSFRMVNDXBVV */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
KUBE-PROXY-FIREWALL  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes load balancer firewall */
KUBE-NODEPORTS  all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes health check service ports */
KUBE-EXTERNAL-SERVICES  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* KUBE-ROUTER rule to explicitly ACCEPT traffic that comply to network policies */ mark match 0x20000/0x20000

Chain FORWARD (policy DROP)
target     prot opt source               destination
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
KUBE-ROUTER-FORWARD  all  --  0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - TEMCG2JMHZYE7H7T */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
KUBE-PROXY-FIREWALL  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes load balancer firewall */
KUBE-FORWARD  all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */
KUBE-SERVICES  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
KUBE-ROUTER-FORWARD  all  --  0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - TEMCG2JMHZYE7H7T */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* KUBE-ROUTER rule to explicitly ACCEPT traffic that comply to network policies */ mark match 0x20000/0x20000
MAILCOW    all  --  0.0.0.0/0            0.0.0.0/0            /* mailcow */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
FLANNEL-FWD  all  --  0.0.0.0/0            0.0.0.0/0            /* flanneld forward */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-ROUTER-OUTPUT  all  --  0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - VEAAIY32XVBHCSCY */
KUBE-PROXY-FIREWALL  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes load balancer firewall */
KUBE-SERVICES  all  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
KUBE-ROUTER-OUTPUT  all  --  0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - VEAAIY32XVBHCSCY */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* KUBE-ROUTER rule to explicitly ACCEPT traffic that comply to network policies */ mark match 0x20000/0x20000

Chain DOCKER (4 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.2           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.2           tcp dpt:81
ACCEPT     tcp  --  0.0.0.0/0            172.18.0.2           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.6           tcp dpt:9000
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.5           tcp dpt:8983
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.249         tcp dpt:6379
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.6           tcp dpt:3306
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:110
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:143
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:993
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:995
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:4190
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.250         tcp dpt:12345
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.253         tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.253         tcp dpt:465
ACCEPT     tcp  --  0.0.0.0/0            172.22.1.253         tcp dpt:587

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (4 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain FLANNEL-FWD (1 references)
target     prot opt source               destination
ACCEPT     all  --  10.42.0.0/16         0.0.0.0/0            /* flanneld forward */
ACCEPT     all  --  0.0.0.0/0            10.42.0.0/16         /* flanneld forward */

Chain KUBE-EXTERNAL-SERVICES (1 references)
target     prot opt source               destination

Chain KUBE-FIREWALL (1 references)
target     prot opt source               destination
DROP       all  -- !127.0.0.0/8          127.0.0.0/8          /* block incoming localnet connections */ ! ctstate RELATED,ESTABLISHED,DNAT

Chain KUBE-FORWARD (1 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */ mark match 0x4000/0x4000
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding conntrack rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-KUBELET-CANARY (0 references)
target     prot opt source               destination

Chain KUBE-NODEPORTS (1 references)
target     prot opt source               destination

Chain KUBE-NWPLCY-DEFAULT (18 references)
target     prot opt source               destination
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* allow icmp echo requests */ icmptype 8
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* allow icmp destination unreachable messages */ icmptype 3
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* allow icmp time exceeded messages */ icmptype 11
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to mark traffic matching a network policy */ MARK or 0x10000

Chain KUBE-POD-FW-5EIJTC7IC3H23DWA (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.31           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.31           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.31           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-AQLRGFH6IIDDSVRA (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.38           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.38           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.38           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-BDTZMM2DESDYSUJW (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.34           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.34           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.34           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-BGWZUIC5AW7LYNCA (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.36           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.36           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.36           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-EAFAP6BOHPCZSLRA (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.39           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.39           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.39           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-LEANWN2RPOIAZRYW (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.32           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.32           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.32           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-MAESWTBB4SQKFPUC (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.33           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.33           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.33           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:coredns-7b98449c4-j76l6 namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:coredns-7b98449c4-j76l6 namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-PNTDMRKSXN473R62 (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.37           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.37           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.37           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-POD-FW-YNPBDQSWKL5KLPHX (7 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule for stateful firewall for pod */ ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* rule to drop invalid state for pod */ ctstate INVALID
ACCEPT     all  --  0.0.0.0/0            10.42.0.35           /* rule to permit the traffic traffic to pods when source is the pod's local node */ ADDRTYPE match src-type LOCAL
KUBE-NWPLCY-DEFAULT  all  --  10.42.0.35           0.0.0.0/0            /* run through default egress network policy chain */
KUBE-NWPLCY-DEFAULT  all  --  0.0.0.0/0            10.42.0.35           /* run through default ingress network policy chain */
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            /* rule to log dropped traffic POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            /* rule to REJECT traffic destined for POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xfffeffff
MARK       all  --  0.0.0.0/0            0.0.0.0/0            /* set mark to ACCEPT traffic that comply to network policies */ MARK or 0x20000

Chain KUBE-PROXY-CANARY (0 references)
target     prot opt source               destination

Chain KUBE-PROXY-FIREWALL (3 references)
target     prot opt source               destination

Chain KUBE-ROUTER-FORWARD (2 references)
target     prot opt source               destination
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  0.0.0.0/0            10.42.0.37           /* rule to jump traffic destined to POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  0.0.0.0/0            10.42.0.37           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  10.42.0.37           0.0.0.0/0            /* rule to jump traffic from POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  10.42.0.37           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  0.0.0.0/0            10.42.0.35           /* rule to jump traffic destined to POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  0.0.0.0/0            10.42.0.35           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  10.42.0.35           0.0.0.0/0            /* rule to jump traffic from POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  10.42.0.35           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  0.0.0.0/0            10.42.0.33           /* rule to jump traffic destined to POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  0.0.0.0/0            10.42.0.33           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  10.42.0.33           0.0.0.0/0            /* rule to jump traffic from POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  10.42.0.33           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  0.0.0.0/0            10.42.0.39           /* rule to jump traffic destined to POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  0.0.0.0/0            10.42.0.39           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  10.42.0.39           0.0.0.0/0            /* rule to jump traffic from POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  10.42.0.39           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  0.0.0.0/0            10.42.0.34           /* rule to jump traffic destined to POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  0.0.0.0/0            10.42.0.34           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  10.42.0.34           0.0.0.0/0            /* rule to jump traffic from POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  10.42.0.34           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  0.0.0.0/0            10.42.0.36           /* rule to jump traffic destined to POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  0.0.0.0/0            10.42.0.36           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  10.42.0.36           0.0.0.0/0            /* rule to jump traffic from POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  10.42.0.36           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  0.0.0.0/0            10.42.0.31           /* rule to jump traffic destined to POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  0.0.0.0/0            10.42.0.31           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  10.42.0.31           0.0.0.0/0            /* rule to jump traffic from POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  10.42.0.31           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  0.0.0.0/0            10.42.0.38           /* rule to jump traffic destined to POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  0.0.0.0/0            10.42.0.38           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  10.42.0.38           0.0.0.0/0            /* rule to jump traffic from POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  10.42.0.38           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  0.0.0.0/0            10.42.0.32           /* rule to jump traffic destined to POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  0.0.0.0/0            10.42.0.32           PHYSDEV match --physdev-is-bridged /* rule to jump traffic destined to POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  10.42.0.32           0.0.0.0/0            /* rule to jump traffic from POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  10.42.0.32           0.0.0.0/0            PHYSDEV match --physdev-is-bridged /* rule to jump traffic from POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */

Chain KUBE-ROUTER-INPUT (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            10.43.0.0/16         /* allow traffic to primary/secondary cluster IP range - EKROEGTNIJ3AP3LC */
RETURN     tcp  --  0.0.0.0/0            0.0.0.0/0            /* allow LOCAL TCP traffic to node ports - LR7XO7NXDBGQJD2M */ ADDRTYPE match dst-type LOCAL multiport dports 30000:32767
RETURN     udp  --  0.0.0.0/0            0.0.0.0/0            /* allow LOCAL UDP traffic to node ports - 76UCBPIZNGJNWNUZ */ ADDRTYPE match dst-type LOCAL multiport dports 30000:32767
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  10.42.0.37           0.0.0.0/0            /* rule to jump traffic from POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  10.42.0.35           0.0.0.0/0            /* rule to jump traffic from POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  10.42.0.33           0.0.0.0/0            /* rule to jump traffic from POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  10.42.0.39           0.0.0.0/0            /* rule to jump traffic from POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  10.42.0.34           0.0.0.0/0            /* rule to jump traffic from POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  10.42.0.36           0.0.0.0/0            /* rule to jump traffic from POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  10.42.0.31           0.0.0.0/0            /* rule to jump traffic from POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  10.42.0.38           0.0.0.0/0            /* rule to jump traffic from POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  10.42.0.32           0.0.0.0/0            /* rule to jump traffic from POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */

Chain KUBE-ROUTER-OUTPUT (2 references)
target     prot opt source               destination
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  0.0.0.0/0            10.42.0.37           /* rule to jump traffic destined to POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-PNTDMRKSXN473R62  all  --  10.42.0.37           0.0.0.0/0            /* rule to jump traffic from POD name:metrics-server-cdcc87586-kkh9b namespace: kube-system to chain KUBE-POD-FW-PNTDMRKSXN473R62 */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  0.0.0.0/0            10.42.0.35           /* rule to jump traffic destined to POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-YNPBDQSWKL5KLPHX  all  --  10.42.0.35           0.0.0.0/0            /* rule to jump traffic from POD name:tron-shkeeper-775dd8cb57-v75np namespace: shkeeper to chain KUBE-POD-FW-YNPBDQSWKL5KLPHX */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  0.0.0.0/0            10.42.0.33           /* rule to jump traffic destined to POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-MAESWTBB4SQKFPUC  all  --  10.42.0.33           0.0.0.0/0            /* rule to jump traffic from POD name:coredns-7b98449c4-j76l6 namespace: kube-system to chain KUBE-POD-FW-MAESWTBB4SQKFPUC */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  0.0.0.0/0            10.42.0.39           /* rule to jump traffic destined to POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-EAFAP6BOHPCZSLRA  all  --  10.42.0.39           0.0.0.0/0            /* rule to jump traffic from POD name:shkeeper-deployment-f74b4f846-g5mxm namespace: shkeeper to chain KUBE-POD-FW-EAFAP6BOHPCZSLRA */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  0.0.0.0/0            10.42.0.34           /* rule to jump traffic destined to POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BDTZMM2DESDYSUJW  all  --  10.42.0.34           0.0.0.0/0            /* rule to jump traffic from POD name:local-path-provisioner-6795b5f9d8-k8lqh namespace: kube-system to chain KUBE-POD-FW-BDTZMM2DESDYSUJW */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  0.0.0.0/0            10.42.0.36           /* rule to jump traffic destined to POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-BGWZUIC5AW7LYNCA  all  --  10.42.0.36           0.0.0.0/0            /* rule to jump traffic from POD name:kubernetes-secret-generator-5778c8867b-sdvkr namespace: default to chain KUBE-POD-FW-BGWZUIC5AW7LYNCA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  0.0.0.0/0            10.42.0.31           /* rule to jump traffic destined to POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-5EIJTC7IC3H23DWA  all  --  10.42.0.31           0.0.0.0/0            /* rule to jump traffic from POD name:svclb-shkeeper-external-c27b07a6-wzlkx namespace: kube-system to chain KUBE-POD-FW-5EIJTC7IC3H23DWA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  0.0.0.0/0            10.42.0.38           /* rule to jump traffic destined to POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-AQLRGFH6IIDDSVRA  all  --  10.42.0.38           0.0.0.0/0            /* rule to jump traffic from POD name:mariadb-9fdf5b-sbvq2 namespace: shkeeper to chain KUBE-POD-FW-AQLRGFH6IIDDSVRA */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  0.0.0.0/0            10.42.0.32           /* rule to jump traffic destined to POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */
KUBE-POD-FW-LEANWN2RPOIAZRYW  all  --  10.42.0.32           0.0.0.0/0            /* rule to jump traffic from POD name:monero-wallet-rpc-5f7777857f-swxmw namespace: shkeeper to chain KUBE-POD-FW-LEANWN2RPOIAZRYW */

Chain KUBE-SERVICES (2 references)
target     prot opt source               destination

Chain MAILCOW (13 references)
target     prot opt source               destination
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            /* mailcow isolation */
root@cockbox:/opt/mailcow-dockerized#