Calico update has changed the calico rules within the cluster. We have an EKS cluster and three nodes joining the cluster, after the calico update noticed that the network connection is dropping intermittently, the nodes connected to the LoadBalancer target groups shows as unhealthy.
Below is the IPtables logs of an instance, is there any way we can remove the blocking firewall or rule that was applied during the upgrade.
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
cali-INPUT all – anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c /
KUBE-PROXY-FIREWALL all – anywhere anywhere ctstate NEW / kubernetes load balancer firewall /
KUBE-NODEPORTS all – anywhere anywhere / kubernetes health check service ports /
KUBE-EXTERNAL-SERVICES all – anywhere anywhere ctstate NEW / kubernetes externally-visible service portals */
KUBE-FIREWALL all – anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
cali-FORWARD all – anywhere anywhere /* cali:wUHhoiAYhphO9Mso /
KUBE-PROXY-FIREWALL all – anywhere anywhere ctstate NEW / kubernetes load balancer firewall /
KUBE-FORWARD all – anywhere anywhere / kubernetes forwarding rules /
KUBE-SERVICES all – anywhere anywhere ctstate NEW / kubernetes service portals /
KUBE-EXTERNAL-SERVICES all – anywhere anywhere ctstate NEW / kubernetes externally-visible service portals /
ACCEPT all – anywhere anywhere / cali:S93hcgKJrXEqnTfs / / Policy explicitly accepted packet. / mark match 0x10000/0x10000
MARK all – anywhere anywhere / cali:mp77cMpurHhyjLrM */ MARK or 0x10000
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
cali-OUTPUT all – anywhere anywhere /* cali:tVnHkvAo15HuiPy0 /
KUBE-PROXY-FIREWALL all – anywhere anywhere ctstate NEW / kubernetes load balancer firewall /
KUBE-SERVICES all – anywhere anywhere ctstate NEW / kubernetes service portals */
KUBE-FIREWALL all – anywhere anywhere
Chain KUBE-EXTERNAL-SERVICES (2 references)
target prot opt source destination
Chain KUBE-FIREWALL (2 references)
target prot opt source destination
DROP all – !localhost/8 localhost/8 /* block incoming localnet connections / ! ctstate RELATED,ESTABLISHED,DNAT
DROP all – anywhere anywhere / kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000
Chain KUBE-FORWARD (1 references)
target prot opt source destination
DROP all – anywhere anywhere ctstate INVALID
ACCEPT all – anywhere anywhere /* kubernetes forwarding rules / mark match 0x4000/0x4000
ACCEPT all – anywhere anywhere / kubernetes forwarding conntrack rule */ ctstate RELATED,ESTABLISHED
Chain KUBE-KUBELET-CANARY (0 references)
target prot opt source destination
Chain KUBE-NODEPORTS (1 references)
target prot opt source destination
Chain KUBE-PROXY-CANARY (0 references)
target prot opt source destination
Chain KUBE-PROXY-FIREWALL (3 references)
target prot opt source destination
Chain KUBE-SERVICES (2 references)
target prot opt source destination
REJECT tcp – anywhere ip-172-20-172-21.ap-northeast-1.compute.internal /* dmsjp-uat-ns/dms-outbound-services:http has no endpoints */ tcp dpt:http-alt reject-with icmp-port-unreachable
Chain cali-FORWARD (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:vjrMJCRpqwy5oRoX / MARK and 0xfff1ffff
cali-from-hep-forward all – anywhere anywhere / cali:A_sPAO0mcxbT9mOV / mark match 0x0/0x10000
cali-from-wl-dispatch all – anywhere anywhere / cali:zSuvpsKZMnLBOFg- /
cali-to-wl-dispatch all – anywhere anywhere / cali:ZD6sBvTDTQIcyWe3 /
cali-to-hep-forward all – anywhere anywhere / cali:VyilXNpEbr584kvI /
cali-cidr-block all – anywhere anywhere / cali:KHV1shAhs1mIlf-Z */
Chain cali-INPUT (1 references)
target prot opt source destination
ACCEPT udp – anywhere anywhere /* cali:srac2cQ5E3exSwlu / / Allow incoming IPv4 Wireguard packets / multiport dports 51820 ADDRTYPE match dst-type LOCAL
cali-wl-to-host all – anywhere anywhere [goto] / cali:XVlm2mzXaTRGN12x /
ACCEPT all – anywhere anywhere / cali:onF0Mrv8wRiq0T_I / mark match 0x10000/0x10000
MARK all – anywhere anywhere / cali:Fg7Of_TRI_V1PdUs / MARK and 0xfff0ffff
cali-from-host-endpoint all – anywhere anywhere / cali:0zYRH6TE4bP4mVKF /
ACCEPT all – anywhere anywhere / cali:rWp0ibdp4Lg3YaXF / / Host endpoint policy accepted packet. */ markmatch 0x10000/0x10000
Chain cali-OUTPUT (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:Mq1_rAdXXH3YkrzW / mark match 0x10000/0x10000
RETURN all – anywhere anywhere / cali:hq_0Rh96d-5PSih6 /
ACCEPT udp – anywhere anywhere / cali:93A2dxzxXCpnF01N / / Allow outgoing IPv4 Wireguard packets / multiport dports 51820 ADDRTYPE match src-type LOCAL
MARK all – anywhere anywhere / cali:2ijpXcCFTBNWjIQA / MARK and 0xfff0ffff
cali-to-host-endpoint all – anywhere anywhere / cali:7Ob_k4TNF_fb6lyA / ! ctstate DNAT
ACCEPT all – anywhere anywhere / cali:Uqfqfph6Jq9dMx47 / / Host endpoint policy accepted packet. */ markmatch 0x10000/0x10000
Chain cali-cidr-block (1 references)
target prot opt source destination
Chain cali-from-hep-forward (1 references)
target prot opt source destination
Chain cali-from-host-endpoint (1 references)
target prot opt source destination
Chain cali-from-wl-dispatch (2 references)
target prot opt source destination
cali-from-wl-dispatch-4 all – anywhere anywhere [goto] /* cali:4O4ImUyrQ4SflvN9 /
cali-fw-eni7285d10142d all – anywhere anywhere [goto] / cali:dpndN34KzzREUFXi /
cali-fw-eni8eb4e114a05 all – anywhere anywhere [goto] / cali:KlysxqDzs7N8JjF_ /
cali-fw-eni97fb8f1117e all – anywhere anywhere [goto] / cali:2UlK5H0cv2lcyVio /
cali-fw-enie104302dfab all – anywhere anywhere [goto] / cali:ewVyUtZGIyj6euCo /
DROP all – anywhere anywhere / cali:St_RfexXBMn4BTYx / / Unknown interface */
Chain cali-from-wl-dispatch-4 (1 references)
target prot opt source destination
cali-fw-eni45e16bf6f5b all – anywhere anywhere [goto] /* cali:CpB-DlzgK2kbLU74 /
cali-fw-eni4f2d2d88b88 all – anywhere anywhere [goto] / cali:CsNmsdGI1_IsTP8R /
DROP all – anywhere anywhere / cali:REzGhxJGxvXRrpcY / / Unknown interface */
Chain cali-fw-eni45e16bf6f5b (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:fL3jJYbhEiWLmC6J / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:netbGHs7WkKdjMhN / ctstate INVALID
MARK all – anywhere anywhere / cali:FQL1NN6_AF4F8Npr / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:Tber9lt7hmQfg1vF / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:UtUVnsvFG5EWY08u / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.kube-system all – anywhere anywhere / cali:tcnRm3k155id1ObS /
RETURN all – anywhere anywhere / cali:q8PETFCD2gq8LiD9 / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-_3YKmhN15BSI84Y4zhX all – anywhere anywhere / cali:wk_QNl6L8QcUNrHN /
RETURN all – anywhere anywhere / cali:LaU8BOEnxZsBWMlH / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:pF8u0QUunBh8CBsZ / / Drop if no profiles matched */
Chain cali-fw-eni4f2d2d88b88 (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:D92-L78VoOCyYgJ- / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:yCGoTK7JgLuPVY_i / ctstate INVALID
MARK all – anywhere anywhere / cali:hx8f51E3HuD_zGaQ / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:LTqy_5o0xZgC8I_s / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:OWhs4UMp6Y-9otrD / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.kube-devops all – anywhere anywhere / cali:6lseC0MLLH3KRWPV /
RETURN all – anywhere anywhere / cali:YyNAIIF7r7WZi80D / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-_tSBGUf1f6mNStiQMgf all – anywhere anywhere / cali:jKdItK5uKwEz_m1w /
RETURN all – anywhere anywhere / cali:5DKdOxshmHUSYX-W / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:GGrtXv-3maZRj5cZ / / Drop if no profiles matched */
Chain cali-fw-eni7285d10142d (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:DuZ1ogzDG3btTDm3 / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:FWd1BtrdIK5qctrb / ctstate INVALID
MARK all – anywhere anywhere / cali:yzfsqXxIrxFPW6a7 / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:kK3UJQMejUrfA6DU / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:Bk8N86KN1bwBQNP9 / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.dmsjp-uat-ns all – anywhere anywhere / cali:hXh9C_wFUFTWt2nq /
RETURN all – anywhere anywhere / cali:t6VRXyRXB1q99EDF / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:vobnSmFhOEwqsUmd /
RETURN all – anywhere anywhere / cali:EDoT9zZjHHcUsnAt / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:lnudRL7_koG6na5u / / Drop if no profiles matched */
Chain cali-fw-eni8eb4e114a05 (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:w_MmbU84ZncohiJt / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:QHmHj24SxgjYc_xo / ctstate INVALID
MARK all – anywhere anywhere / cali:t-OfbzeslMBuQQ_2 / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:tBMsKiKejOnekzPT / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:t9GJ5Pc4lBdM3Evi / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.dmsjp-uat-ns all – anywhere anywhere / cali:7d_sa42SgjuEEC2W /
RETURN all – anywhere anywhere / cali:K6PU23z6QSP4Y-Wx / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:gyt-gIuOK9PFYEPe /
RETURN all – anywhere anywhere / cali:-XQrcfZtGO_gOaoT / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:vlEZYSdge19JELmI / / Drop if no profiles matched */
Chain cali-fw-eni97fb8f1117e (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:OkcUXfLXsSvp_QkW / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:fynUqzwTnmeStccp / ctstate INVALID
MARK all – anywhere anywhere / cali:8Adntsste6B4Kccd / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:ygnjGF9yh3HCQ7hx / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:bb72MA0v15fpYkGP / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.dmsjp-uat-ns all – anywhere anywhere / cali:yi3L1dxDkiFhnzyk /
RETURN all – anywhere anywhere / cali:t8cwc_GXwO9Buo13 / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:tVArqIJo9Yj9wdnQ /
RETURN all – anywhere anywhere / cali:d1duAgYa2v4Ihwic / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:bJtBjP0VOUWq78I1 / / Drop if no profiles matched */
Chain cali-fw-enie104302dfab (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:A2IRVTK_k8dhBOrT / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:iVoK8cdOPdwhvvYw / ctstate INVALID
MARK all – anywhere anywhere / cali:3vKx0pbQokhMNoUc / MARK and 0xfffeffff
DROP udp – anywhere anywhere / cali:VD5kXx9yrpYCW1L7 / / Drop VXLAN encapped packets originating in workloads / multiport dports 4789
DROP ipencap-- anywhere anywhere / cali:j4_L3wSw9vV8oCXa / / Drop IPinIP encapped packets originating inworkloads /
cali-pro-kns.kube-logging all – anywhere anywhere / cali:dU4jhl3rdaefrcDq /
RETURN all – anywhere anywhere / cali:knhrQuHGN6PqIPIV / / Return if profile accepted / mark match 0x10000/0x10000
cali-pro-_iNlzAgFpeD8erJECmu all – anywhere anywhere / cali:wQjsXOlKgMRDMUff /
RETURN all – anywhere anywhere / cali:chMDIvCLVYqZgmsU / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:2sl8KierbDZtcnMB / / Drop if no profiles matched */
Chain cali-pri-_3YKmhN15BSI84Y4zhX (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:cHJCuOKJ7Bx4RDTU / / Profile ksa.kube-system.ebs-csi-node-sa ingress */
Chain cali-pri-__AqIDS9YUyiKvVCc0p (3 references)
target prot opt source destination
all – anywhere anywhere /* cali:LYxMNOzi5zT7dEjX / / Profile ksa.dmsjp-uat-ns.default ingress */
Chain cali-pri-_iNlzAgFpeD8erJECmu (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:rvUrD98CmbFqihMe / / Profile ksa.kube-logging.fluentd ingress */
Chain cali-pri-_tSBGUf1f6mNStiQMgf (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:WJVEpgm-avCIeEdK / / Profile ksa.kube-devops.kured ingress */
Chain cali-pri-kns.dmsjp-uat-ns (3 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:DidQigQxpAywl9fl / / Profile kns.dmsjp-uat-ns ingress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:vdGO0bkT272R0kix */ mark match 0x10000/0x10000
Chain cali-pri-kns.kube-devops (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:oIPaZj3wycTKScYm / / Profile kns.kube-devops ingress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:VALgxoWYE8mlgoAC */ mark match 0x10000/0x10000
Chain cali-pri-kns.kube-logging (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:u93C8_pUYSEzvcDr / / Profile kns.kube-logging ingress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:XIemzqgeD9bujedh */ mark match 0x10000/0x10000
Chain cali-pri-kns.kube-system (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:J1TyxtHWd0qaBGK- / / Profile kns.kube-system ingress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:QIB6k7eEKdIg73Jp */ mark match 0x10000/0x10000
Chain cali-pro-_3YKmhN15BSI84Y4zhX (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:EXtNSzMt_7kthZrS / / Profile ksa.kube-system.ebs-csi-node-sa egress */
Chain cali-pro-__AqIDS9YUyiKvVCc0p (3 references)
target prot opt source destination
all – anywhere anywhere /* cali:R1i_8JaxaYkoTNB9 / / Profile ksa.dmsjp-uat-ns.default egress */
Chain cali-pro-_iNlzAgFpeD8erJECmu (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:53DdcCAdAWA1fkF- / / Profile ksa.kube-logging.fluentd egress */
Chain cali-pro-_tSBGUf1f6mNStiQMgf (1 references)
target prot opt source destination
all – anywhere anywhere /* cali:nZVeiUonb3ubwi-G / / Profile ksa.kube-devops.kured egress */
Chain cali-pro-kns.dmsjp-uat-ns (3 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:QuGfuk3O4lnfr92X / / Profile kns.dmsjp-uat-ns egress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:wk253xfWYHBoPScK */ mark match 0x10000/0x10000
Chain cali-pro-kns.kube-devops (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:96-BCo2xrDqpQ534 / / Profile kns.kube-devops egress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:H-em2v-F4QspD2vp */ mark match 0x10000/0x10000
Chain cali-pro-kns.kube-logging (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:OqmUPJH1ExRTpRup / / Profile kns.kube-logging egress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:DaiY8TZAuiQnLSd9 */ mark match 0x10000/0x10000
Chain cali-pro-kns.kube-system (1 references)
target prot opt source destination
MARK all – anywhere anywhere /* cali:tgOR2S8DVHZW3F1M / / Profile kns.kube-system egress / MARK or 0x10000
RETURN all – anywhere anywhere / cali:HVEEtYPJsiGRXCIt */ mark match 0x10000/0x10000
Chain cali-to-hep-forward (1 references)
target prot opt source destination
Chain cali-to-host-endpoint (1 references)
target prot opt source destination
Chain cali-to-wl-dispatch (1 references)
target prot opt source destination
cali-to-wl-dispatch-4 all – anywhere anywhere [goto] /* cali:QZxV2FbbOInMsgis /
cali-tw-eni7285d10142d all – anywhere anywhere [goto] / cali:ytbOC9HhMjUbzbVZ /
cali-tw-eni8eb4e114a05 all – anywhere anywhere [goto] / cali:ESns0R–N4jmkXgn /
cali-tw-eni97fb8f1117e all – anywhere anywhere [goto] / cali:ArgeLNphn72Lg5dw /
cali-tw-enie104302dfab all – anywhere anywhere [goto] / cali:c2Cba5ehhBTtOUSm /
DROP all – anywhere anywhere / cali:Vgvjmz-xAdsFlfw5 / / Unknown interface */
Chain cali-to-wl-dispatch-4 (1 references)
target prot opt source destination
cali-tw-eni45e16bf6f5b all – anywhere anywhere [goto] /* cali:amj-y06u_OKU0tym /
cali-tw-eni4f2d2d88b88 all – anywhere anywhere [goto] / cali:QDBYKP0xkOr_R41s /
DROP all – anywhere anywhere / cali:GVU7ZQJgGifrhtNw / / Unknown interface */
Chain cali-tw-eni45e16bf6f5b (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:xQQxTSPYyduc4Fdn / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:FrEKMNaYCsEyTmOB / ctstate INVALID
MARK all – anywhere anywhere / cali:RIIXtfbqW46VrrZV / MARK and 0xfffeffff
cali-pri-kns.kube-system all – anywhere anywhere / cali:GUVzmYfdktQhM7Wy /
RETURN all – anywhere anywhere / cali:B8Ppv-aO4WIrYSxM / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-_3YKmhN15BSI84Y4zhX all – anywhere anywhere / cali:89q4GFoSPIs1cCYM /
RETURN all – anywhere anywhere / cali:EfCs65_jo6Bcxj32 / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:CnitVPq4EOOcafl3 / / Drop if no profiles matched */
Chain cali-tw-eni4f2d2d88b88 (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:Tdb2m6k7cLs__zG7 / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:4w9tFJrQuBhsuIdJ / ctstate INVALID
MARK all – anywhere anywhere / cali:vQWAL1CUDdJyJJv2 / MARK and 0xfffeffff
cali-pri-kns.kube-devops all – anywhere anywhere / cali:pAf5fRJol7UY9TBc /
RETURN all – anywhere anywhere / cali:XA-MPssVKVDafUmL / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-_tSBGUf1f6mNStiQMgf all – anywhere anywhere / cali:GsRIdnW2G66azi4x /
RETURN all – anywhere anywhere / cali:AKDNPIQ3zMe9d9T2 / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:vM-iWAKWK5788hf0 / / Drop if no profiles matched */
Chain cali-tw-eni7285d10142d (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:j3-Ik7CcoVfUBzBW / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:KonXxGCZoiBswhCw / ctstate INVALID
MARK all – anywhere anywhere / cali:l-aE-YBrlF-Q5VAs / MARK and 0xfffeffff
cali-pri-kns.dmsjp-uat-ns all – anywhere anywhere / cali:MbmfiUuW84-Rx95h /
RETURN all – anywhere anywhere / cali:80kv-7GOIp4SnwDV / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:Va2ORjf9rcSVsQ0M /
RETURN all – anywhere anywhere / cali:4m0vTtdhFzXYpB35 / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:L8MGBg01wm1ZRdeh / / Drop if no profiles matched */
Chain cali-tw-eni8eb4e114a05 (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:YdXoksYERmhhyLbk / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:QfdkV6rlGe7CGeC7 / ctstate INVALID
MARK all – anywhere anywhere / cali:LYmJ2zSEZKmZCrrS / MARK and 0xfffeffff
cali-pri-kns.dmsjp-uat-ns all – anywhere anywhere / cali:HXCmJOUmttbzfTtz /
RETURN all – anywhere anywhere / cali:QT8IxOWpRo6dN7KF / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:LS1kAXSnUrtgpjSJ /
RETURN all – anywhere anywhere / cali:lEFaZYRO9DACI1to / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:Ax6u8ZSbODHRHc3v / / Drop if no profiles matched */
Chain cali-tw-eni97fb8f1117e (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:FBe7NOL3bnPSvMkG / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:27k3FXy0d7yDYhjJ / ctstate INVALID
MARK all – anywhere anywhere / cali:rXNoe1Sp9TC_kiui / MARK and 0xfffeffff
cali-pri-kns.dmsjp-uat-ns all – anywhere anywhere / cali:6tW5VaIZPTe_JLsV /
RETURN all – anywhere anywhere / cali:RucaUh6uZ819N1xF / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-__AqIDS9YUyiKvVCc0p all – anywhere anywhere / cali:h_r7m6g1RW8sHDFg /
RETURN all – anywhere anywhere / cali:UFJpTF1e5uZUmcwO / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:jZOtVTWX2qmnfUMS / / Drop if no profiles matched */
Chain cali-tw-enie104302dfab (1 references)
target prot opt source destination
ACCEPT all – anywhere anywhere /* cali:0Ku2BbzURjXVQJGl / ctstate RELATED,ESTABLISHED
DROP all – anywhere anywhere / cali:FTdN535k_PNyl6Sl / ctstate INVALID
MARK all – anywhere anywhere / cali:c64WZeq4ot4AUsfh / MARK and 0xfffeffff
cali-pri-kns.kube-logging all – anywhere anywhere / cali:WURHv8NOW3pY8SXd /
RETURN all – anywhere anywhere / cali:S5ApB14eONXCk930 / / Return if profile accepted / mark match 0x10000/0x10000
cali-pri-_iNlzAgFpeD8erJECmu all – anywhere anywhere / cali:ImliuQ3HOPK5R3_k /
RETURN all – anywhere anywhere / cali:p94DFdHV_lMRcUOt / / Return if profile accepted / mark match 0x10000/0x10000
DROP all – anywhere anywhere / cali:23w1aiixMJgNS4ga / / Drop if no profiles matched */
Chain cali-wl-to-host (1 references)
target prot opt source destination
cali-from-wl-dispatch all – anywhere anywhere /* cali:Ee9Sbo10IpVujdIY /
ACCEPT all – anywhere anywhere / cali:nSZbcOoG1xPONxb8 / / Configured DefaultEndpointToHostAction */