iptables & nftables

Netfilter tables, chains, rules, NAT, connection tracking, and Kubernetes kube-proxy iptables rules.

Overview

Overview iptables is the userspace interface to the Linux kernel's Netfilter packet filtering framework. nftables is the modern replacement, but iptables knowledge remains essential because Kubernetes kube-proxy still uses iptables mode by default.

Tables and Purposes

filter (default) — INPUT / FORWARD / OUTPUT chains — packet filtering
nat — PREROUTING / POSTROUTING — address translation
mangle — packet modification
raw — connection tracking bypass

Chains and Rule Evaluation

Rules in a chain are checked top-to-bottom; the first matching rule's target is applied. Targets: ACCEPT, DROP, REJECT (sends RST/ICMP), RETURN, LOG.

Connection Tracking

Connection tracking (conntrack) allows stateful firewalling:

This allows return traffic without explicit rules for each port.

Kubernetes kube-proxy

kube-proxy (iptables mode) installs thousands of rules to implement Services. Large Kubernetes clusters with many services have slow iptables rule updates because iptables replaces the entire ruleset atomically — O(n) for n rules. eBPF-based alternatives (Cilium, IPVS mode) solve this.

Key concepts

Chains: Ordered lists of rules. Built-in chains: INPUT (to local process), FORWARD (routed through), OUTPUT (locally generated), PREROUTING, POSTROUTING.
Connection tracking: -m conntrack --ctstate ESTABLISHED,RELATED allows return traffic automatically without symmetric rules.
DNAT / SNAT: DNAT rewrites the destination IP (used by kube-proxy). SNAT rewrites the source IP (used for internet egress from private IPs).
MASQUERADE: Dynamic SNAT that uses the outgoing interface IP automatically. Used for containers needing internet access through the host.
Default policy: Action taken if no rule matches. For production hardening, set INPUT and FORWARD to DROP.

When to use it

Debugging connectivity in Kubernetes when pods cannot reach a Service ClusterIP
Explaining how NAT masquerade enables containers to reach the internet
Auditing iptables rules that may be blocking expected traffic

Interview questions

How does Kubernetes kube-proxy use iptables to implement a ClusterIP service?
How do you allow all outbound traffic but only allow inbound SSH and established return traffic?