resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for global { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" } }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" }

resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for eni=true }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" } "/etc/cni/net.d/calico-kubeconfig" } }, { "type": "portmap", "snat": true, "capabilities": {"portMappings": true} }, { "type": "cilium-cni"

resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for eni.enabled=true }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" } "/etc/cni/net.d/calico-kubeconfig" } }, { "type": "portmap", "snat": true, "capabilities": {"portMappings": true} }, { "type": "cilium-cni"

resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. To set up Cilium overlay mode default). 2. Flush iptables rules added by VPC CNI iptables -t nat -F AWS-SNAT-CHAIN-0 \\ && iptables -t nat -F AWS-SNAT-CHAIN-1 \\ && iptables -t nat -F AWS-CONNMARK-CHAIN-0 \\ && iptables -t }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" }

driver kube-proxy DNAT kube-proxy SNAT worker node nodePort request backend endpoint tc eBPF NAT XDP eBPF NAT DSR 加速南北向 nodePort 访问 传统的 nodePort 转发，伴随着 SNAT的发生。而 Cilium 为 nodePort 提供了 native redirect_neigh step1 client -> node1 : nodePort step3 client -> pod2 : targetPort native DSR DNAT and No SNAT step4 pod2:targetPort -> client step6 node2 : nodePort -> client client step5 node2 : nodePort

resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for global }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" } }, { "type": "portmap", "capabilities": {"portMappings": true}, "snat": true }, { "name": "cilium", "type": "cilium-cni" }

REJECT DROP nat 地址转换 PREROUTING OUTPUT POSTROUTING 地址转换发生在路由之前 DNAT 转换由系统生成的包 地址转换发生在路由之后 SNAT DNAT REDIRECT SNAT security ...... ③iptables 命令工具 本地进程 93 iptables 语法： iptables -t filter 操作 链名 匹配规则 -j -A INPUT -i ens33 -m mac --mac-source 00:04:0d:33:33:21 -j DROP SNAT #iptables -t nat -A POSTROUTING -o ens37 -s 192.68.1.0/24 -j SNAT --to 200.1.1.2 或者转换为出接口的 IP（pppoe 拨号时） #iptables -t nat -A POSTROUTING

：当前正在使用的区域。 ➢ ：管理当前被选中区域中的服务。 ➢ ：管理当前被选中区域中的端口。 ➢ 设置允许被访问的协议。 ➢ 设置允许被访问的端口。 ➢ ：开启或关闭 SNAT（源网络地址转换）技术。 ➢ ：设置端口转发策略。 255 ➢ ：控制请求 icmp 服务的流量。 ➢ ：管理防火墙的富规则。 ➢ ：被选中区域的服务， 略立即生效（见图 8-6）。这与在命令行中使用--reload 参数的效果一样。 前面在讲解 firewall-config 工具的功能时，曾经提到了 SNAT（Source Network Address Translation，源网络地址转换）技术。SNAT 是一种为了解决 IP 地址匮乏而设计的技术，它可 以使得多个内网中的用户通过同一个外网 IP 接入 Internet。该技术的应用非常广泛，甚至可以 com 时，就用到了 SNAT 技术。 257 图 8-5 放行访问 8080～8088 端口的流量 图 8-6 让配置的防火墙策略规则立即生效 大家可以看一下在网络中不使用 SNAT 技术（见图 8-7）和使用 SNAT 技术（见图 8-8） 时的情况。在图 8-7 所示的局域网中有多台 PC，如果网关服务器没有应用 SNAT 技术，则互 联网中的网站服务器在收到

works as a router PREROUTING for port forwarding POSTROUTING for Source Network Address Translation (SNAT), this applies to all packets leaving the system filter table filter is the default table of iptables iptables. It has 3 default chains. INPUT OUTPUT FORWARD nat table nat table is a special table for SNAT and DNAT (port forwarding). It has the following chains. PREROUTING POSTROUTING OUTPUT There are destination_ip | DNAT | | | -L (list) | USER_DEFINED_CHAINS | -i incoming | SNAT | | | -S (show) | | -o outgoing | LIMIT | |

a router • PREROUTING for port forwarding • POSTROUTING for Source Network Address Translation (SNAT), this applies to all packets leaving the sys- tem 14.3 filter table filter is the default table 3 default chains. • INPUT • OUTPUT • FORWARD 14.4 nat table nat table is a special table for SNAT and DNAT (port forwarding). It has the following chains. • PREROUTING • POSTROUTING • OUTPUT There POSTROUTING | --dport destination_ip | ˓→DNAT | | | -L (list) | USER_DEFINED_CHAINS | -i incoming | ˓→SNAT | | | -S (show) | | -o outgoing | ˓→LIMIT | | | -Z (zero) | | -m mac | ˓→RETURN | | | -N | |