Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug /assign I'll make the pull request tomorrow. What happened: start kube-proxy in ipvs mode, create some NodePort services. Then look at the iptables rules. match-set of KUBE-NODE-PORT-TCP is inadequate to be qualified as NodePort traffic. "--dst-type LOCAL" is needed. What you expected to happen: since we have also KUBE-NODE-PORT-UDP, another way would be like this: How to reproduce it (as minimally and precisely as possible): start kube-proxy in ipvs mode, create some NodePort services. Then look at the iptables rules. Anything else we need to know?: Environment: Kubernetes version (use ): commit Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): CentOS Linux release 7.2.1511 (Core) Kernel (e.g. ): Linux VM34centos 3.10.0-514.26.2.el7.x8664 SMP Tue Jul 4 15:04:05 UTC 2017 x8664 x8664 x86_64 GNU/Linux Install tools: Others:
/sig network /area kube-proxy /area ipvs /assign
/cc i remember this bug fixed, that's right?
, Thanks, seems like necessary. But you have any use case that ipvs proxier will have bugs in current mach rules?
It's already fixed by ? Can we close this issue now?
I don't see how fixed this issue. How about this scenario: k8s cluster A uses node port for service A k8s cluster B uses node port for service B pod (or host) in cluster A tries to access node port on k8s cluster B local node port rule matches the traffic and NATs it to the local node port, pod (or host) cannot reach cluster B's node port. Also, the remote node port could be replaced by any non-k8s host that happens to use port .
Then I think can solve this problem.

Discussion:
// `iptables -t nat -A <from> -m set --match-set <name> <matchType> -j <to>` // example: iptables -t nat -A KUBE-SERVICES -m set --match-set KUBE-NODE-PORT-TCP dst -j KUBE-NODE-PORT // ipsets with other match rules will be created Individually. <ins> // Note: kubeNodePortLocalSetTCP must be prior to kubeNodePortSetTCP, the same for UDP. </ins> var ipsetWithIptablesChain = []struct { name          string from          string

{kubeLoadBalancerSourceCIDRSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""}, {kubeLoadBalancerSourceIPSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""}, {kubeLoadBalancerLocalSet, string(KubeLoadBalancerChain), "RETURN", "dst,dst", ""}, <del> {kubeNodePortSetTCP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "tcp"}, </del> {kubeNodePortLocalSetTCP, string(KubeNodePortChain), "RETURN", "dst", "tcp"}, <del> {kubeNodePortSetUDP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "udp"}, </del> <ins> {kubeNodePortSetTCP, string(KubeNodePortChain), string(KubeMarkMasqChain), "dst", "tcp"}, </ins> {kubeNodePortLocalSetUDP, string(KubeNodePortChain), "RETURN", "dst", "udp"}, <ins> {kubeNodePortSetUDP, string(KubeNodePortChain), string(KubeMarkMasqChain), "dst", "udp"}, </ins> } var ipvsModules = []string{

writeLine(proxier.natRules, append(dstLocalOnlyArgs, "-j", "ACCEPT")...) } <del> // mark masq for KUBE-NODE-PORT writeLine(proxier.natRules, []string{ "-A", string(KubeNodePortChain), "-j", string(KubeMarkMasqChain), }...) </del> <ins> // -A KUBE-SERVICES  -m addrtype  --dst-type LOCAL -j KUBE-NODE-PORT args = append(args[:0], "-A", string(kubeServicesChain), "-m", "addrtype", "--dst-type", "LOCAL", ) writeLine(proxier.natRules, append(args, "-j", string(KubeNodePortChain))...) </ins> // mark drop for KUBE-LOAD-BALANCER writeLine(proxier.natRules, []string{

// Check iptables chain and rules epIpt := netlinktest.ExpectedIptablesChain{ <del> string(kubeServicesChain): {{ JumpChain: string(KubeNodePortChain), MatchSet: kubeNodePortSetUDP, }}, </del> string(KubeNodePortChain): {{ <del> JumpChain: string(KubeMarkMasqChain), MatchSet: "", </del> <ins> JumpChain: string(KubeMarkMasqChain), MatchSet: kubeNodePortSetUDP, }}, string(kubeServicesChain): {{ JumpChain: string(KubeNodePortChain), MatchSet: "", </ins> }}, } checkIptables(t, ipt, epIpt)

// Check iptables chain and rules epIpt := netlinktest.ExpectedIptablesChain{ string(kubeServicesChain): {{ <del> JumpChain: string(KubeNodePortChain), MatchSet: kubeNodePortSetTCP, </del> <ins> JumpChain: string(KubeNodePortChain), MatchSet: "", </ins> }}, string(KubeNodePortChain): {{ JumpChain: "RETURN", MatchSet: kubeNodePortLocalSetTCP, }, { <del> JumpChain: string(KubeMarkMasqChain), MatchSet: "", </del> <ins> JumpChain: string(KubeMarkMasqChain), MatchSet: kubeNodePortSetTCP, </ins> }}, } checkIptables(t, ipt, epIpt)