Skip to content

Instantly share code, notes, and snippets.

View fmuyassarov's full-sized avatar

Feruzjon Muyassarov fmuyassarov

View GitHub Profile
Chain INPUT (policy ACCEPT 827M packets, 270G bytes)
pkts bytes target prot opt in out source destination
299K 192M cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
344K 231M KUBE-IPVS-FILTER all -- any any anywhere anywhere /* kubernetes ipvs access filter */
344K 231M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere /* kube-proxy firewall rules */
344K 231M KUBE-NODE-PORT all -- any any anywhere anywhere /* kubernetes health check rules */
12M 717M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
827M 270G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
12M 717M KUBE-EXTERNAL-SERVICES all -- any any anywhere a
Chain INPUT (policy ACCEPT 827M packets, 270G bytes)
pkts bytes target prot opt in out source destination
275K 188M cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
321K 227M KUBE-IPVS-FILTER all -- any any anywhere anywhere /* kubernetes ipvs access filter */
321K 227M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere /* kube-proxy firewall rules */
321K 227M KUBE-NODE-PORT all -- any any anywhere anywhere /* kubernetes health check rules */
12M 717M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
827M 270G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
12M 717M KUBE-EXTERNAL-SERVICES all -- any any anywhere a
Chain INPUT (policy ACCEPT 827M packets, 270G bytes)
pkts bytes target prot opt in out source destination
203K 156M cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
250K 196M KUBE-IPVS-FILTER all -- any any anywhere anywhere /* kubernetes ipvs access filter */
250K 196M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere /* kube-proxy firewall rules */
250K 196M KUBE-NODE-PORT all -- any any anywhere anywhere /* kubernetes health check rules */
12M 717M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
827M 270G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
12M 717M KUBE-EXTERNAL-SERVICES all -- any any anywhere a
Chain INPUT (policy ACCEPT 827M packets, 270G bytes)
pkts bytes target prot opt in out source destination
188K 152M cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
236K 191M KUBE-IPVS-FILTER all -- any any anywhere anywhere /* kubernetes ipvs access filter */
236K 191M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere /* kube-proxy firewall rules */
236K 191M KUBE-NODE-PORT all -- any any anywhere anywhere /* kubernetes health check rules */
12M 717M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
827M 270G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
12M 717M KUBE-EXTERNAL-SERVICES all -- any any anywhere a
@fmuyassarov
fmuyassarov / calico_4.txt
Created August 19, 2025 13:31
when NetworkPolicy was created
Chain INPUT (policy ACCEPT 323M packets, 101G bytes)
pkts bytes target prot opt in out source destination
335M 104G cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
4639K 293M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
323M 101G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
4639K 293M KUBE-EXTERNAL-SERVICES all -- any any anywhere anywhere ctstate NEW /* kubernetes externally-visible service portals */
323M 101G KUBE-FIREWALL all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 2 packets, 181 bytes)
pkts bytes target prot opt in out source destination
@fmuyassarov
fmuyassarov / calico_3.txt
Created August 19, 2025 13:31
when Pods were created
Chain INPUT (policy ACCEPT 322M packets, 101G bytes)
pkts bytes target prot opt in out source destination
335M 103G cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
4638K 293M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
322M 101G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
4638K 293M KUBE-EXTERNAL-SERVICES all -- any any anywhere anywhere ctstate NEW /* kubernetes externally-visible service portals */
322M 101G KUBE-FIREWALL all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 2 packets, 181 bytes)
pkts bytes target prot opt in out source destination
@fmuyassarov
fmuyassarov / calico_1.txt
Created August 19, 2025 13:30
initial state
Chain INPUT (policy ACCEPT 322M packets, 101G bytes)
pkts bytes target prot opt in out source destination
334M 103G cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
4636K 293M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
322M 101G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
4636K 293M KUBE-EXTERNAL-SERVICES all -- any any anywhere anywhere ctstate NEW /* kubernetes externally-visible service portals */
322M 101G KUBE-FIREWALL all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 2 packets, 181 bytes)
pkts bytes target prot opt in out source destination
@fmuyassarov
fmuyassarov / calico_2.txt
Created August 19, 2025 13:29
when hostEndpoints & service were created
Chain INPUT (policy ACCEPT 322M packets, 101G bytes)
pkts bytes target prot opt in out source destination
335M 103G cali-INPUT all -- any any anywhere anywhere /* cali:Cz_u1IQiXIMmKD4c */
4637K 293M KUBE-PROXY-FIREWALL all -- any any anywhere anywhere ctstate NEW /* kubernetes load balancer firewall */
322M 101G KUBE-NODEPORTS all -- any any anywhere anywhere /* kubernetes health check service ports */
4637K 293M KUBE-EXTERNAL-SERVICES all -- any any anywhere anywhere ctstate NEW /* kubernetes externally-visible service portals */
322M 101G KUBE-FIREWALL all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 2 packets, 181 bytes)
pkts bytes target prot opt in out source destination
@fmuyassarov
fmuyassarov / calico-chains
Created August 4, 2025 13:53
calico-chains
sudo iptables -t filter -vnL | grep cali-
295K 184M cali-INPUT 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* cali:Cz_u1IQiXIMmKD4c */
1022 47669 cali-FORWARD 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* cali:wUHhoiAYhphO9Mso */
295K 186M cali-OUTPUT 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* cali:tVnHkvAo15HuiPy0 */
Chain cali-FORWARD (1 references)
1022 47669 cali-from-hep-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* cali:ZfgmjuiLaA8Pg0kp */ mark match 0x0/0x10000
1015 46326 cali-from-wl-dispatch 0 -- cali+ * 0.0.0.0/0 0.0.0.0/0 /* cali:tAzwBLPaV-j53OOZ */
7 1343 cali-to-wl-dispatch 0 -- * cali+ 0.0.0.0/0 0.0.0.0/0 /* cali:4Z0Pf0byo05NFe-P */
7 546 cali-to-hep-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* cali:hQ7Oc16wmUtLuneJ */
7 546 cali-cidr-block 0 -- * * 0.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: testpol1
namespace: test1
spec:
egress:
- ports:
- port: 80
protocol: TCP