---
# System prepended metadata

title: iptables (externelTrafficPolicy=Local)

---

# iptables (externelTrafficPolicy=Local)

```bash
/ # iptables -L POSTROUTING -t nat --line-numbers
Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    CNI-HOSTPORT-SNAT  all  --  localhost           !localhost
2    KUBE-POSTROUTING  all  --  anywhere             anywhere             /* kubernetes postrouting rules */
3    MASQUERADE  all  --  172.17.0.0/16        anywhere
4    MASQUERADE  all  --  172.18.0.0/16       !base-address.mcast.net/4 
5    MASQUERADE  all  -- !172.18.0.0/16        172.18.0.0/16
6    RETURN     all  --  172.18.0.0/16        172.18.0.0/16
7    MASQUERADE  all  --  172.18.0.0/16       !base-address.mcast.net/4  random-fully
8    RETURN     all  -- !172.18.0.0/16        172.18.8.0/24
9    MASQUERADE  all  -- !172.18.0.0/16        172.18.0.0/16        random-fully
```
4跟7重複
5跟9重複

本來正常的規則想走8這條路的，但因為4跟5更新flannel時沒被清掉，所以變成直接走了5這條

# 結論 FLUSH 保平安