access • Major modes • Iptables • IPVS Iptables mode • How it works • DNAT at PREROUTING chain • SNAT at POSTROUTING chain • Pros • Iptables is widely adopted in popular Linux distributions • Cons difficult to debug IPVS mode • Services are organized in hash table • IPVS DNAT • conntrack/iptables SNAT • Pros • O(1) time complexity in control/data plane • Stably runs for two decades • Support rich ingress/egress packets IPVS bypass conntrack • Why IPVS depends on conntrack? • Iptables/conntrack SNAT • How IPVS bypasses conntrack? • Ingress • Move IPVS Netfilter hook from local-in to PREROUTING