DNAT

이전에 미리 설치해 둔 dashboard 를 이용해서 DNAT 를 확인해보고자 한다.

service 는 nodePort 로 띄웠기 때문에 손쉽게 외부에서 내부로 접근할 수 있었다.

외부에서 token 을 통해 접속 후 dashboard 가 뜬 노드를 확인하면 아래와 같이

10.0.2.10:32100 이었던 목적지가 10.32.0.5:8443 으로 DNAT 된 것을 확인할 수 있다.

root@k8s-master:~/dashboard# conntrack -L | grep 32100
tcp      6 86393 ESTABLISHED src=10.0.2.1 dst=10.0.2.10 sport=62716 dport=32100 src=10.32.0.5 dst=10.32.0.1 sport=8443 dport=12612 [ASSURED] mark=0 use=1
conntrack v1.4.6 (conntrack-tools): 409 flow entries have been shown.

root@k8s-master:~/dashboard# k get po -A -o wide | grep 10.32.0.5
kubernetes-dashboard   kubernetes-dashboard-kong-79867c9c48-v5ksq             1/1     Running   0                3m30s   10.32.0.5    k8s-master    <none>           <none>

 

 

이번에는 체인룰을 직접 확인해보자. KUBE-NODEPORTS 에 관한 룰 확인 가능

root@k8s-master:~/dashboard# iptables -t nat -nvL KUBE-SERVICES | grep -i nodeport
# Warning: iptables-legacy tables present, use iptables-legacy to see them
 3118  192K KUBE-NODEPORTS  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

 

 

KUBE-NODEPORTS 룰을 통해 KUBE-EXT-3JWJBWA3QD3XT7IS 룰 적용됨을 확인 가능하다.

root@k8s-master:~/dashboard# sudo iptables -t nat -nvL KUBE-NODEPORTS
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain KUBE-NODEPORTS (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 KUBE-EXT-FWDTHD7PLJSQSVVA  tcp  --  *      *       0.0.0.0/0            127.0.0.0/8          /* default/my-app */ nfacct-name  localhost_nps_accepted_pkts
    0     0 KUBE-EXT-FWDTHD7PLJSQSVVA  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default/my-app */
    0     0 KUBE-EXT-3JWJBWA3QD3XT7IS  tcp  --  *      *       0.0.0.0/0            127.0.0.0/8          /* kubernetes-dashboard/kubernetes-dashboard-kong-proxy:kong-proxy-tls */ nfacct-name  localhost_nps_accepted_pkts
    2   104 KUBE-EXT-3JWJBWA3QD3XT7IS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes-dashboard/kubernetes-dashboard-kong-proxy:kong-proxy-tls */

 

 

KUBE-EXT-3JWJBWA3QD3XT7IS 룰을 통해서는 KUBE-SVC-3JWJBWA3QD3XT7IS 룰이 적용된다.

번외로 KUBE-MARK-MASQ 룰을 통해 SNAT 룰도 확인 가능하다.

root@k8s-master:~/dashboard# sudo iptables -t nat -nvL KUBE-EXT-3JWJBWA3QD3XT7IS
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain KUBE-EXT-3JWJBWA3QD3XT7IS (2 references)
 pkts bytes target     prot opt in     out     source               destination
    7   364 KUBE-MARK-MASQ  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* masquerade traffic for kubernetes-dashboard/kubernetes-dashboard-kong-proxy:kong-proxy-tls external destinations */
    7   364 KUBE-SVC-3JWJBWA3QD3XT7IS  all  --  *      *       0.0.0.0/0            0.0.0.0/0

 

 

KUBE-SVC-3JWJBWA3QD3XT7IS 룰을 통해서는 최종적으로 KUBE-SEP-UBIV3DN2K4Y63A2U 룰이 적용된다.

즉, 처음 확인했던 10.32.0.5:8443 으로 DNAT 된다.

root@k8s-master:~/dashboard# sudo iptables -t nat -nvL KUBE-SVC-3JWJBWA3QD3XT7IS
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain KUBE-SVC-3JWJBWA3QD3XT7IS (2 references)
 pkts bytes target     prot opt in     out     source               destination
    7   364 KUBE-SEP-UBIV3DN2K4Y63A2U  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes-dashboard/kubernetes-dashboard-kong-proxy:kong-proxy-tls -> 10.32.0.5:8443 */

 

 

 

정리

[클라이언트]
  ↓  NodeIP:32100 요청
KUBE-NODEPORTS
  ↓
KUBE-EXT-3JWJBWA3QD3XT7IS
  ├── KUBE-MARK-MASQ  ← (필요 시 SNAT용)
  └── KUBE-SVC-3JWJBWA3QD3XT7IS
        ↓
    KUBE-SEP-UBIV3DN2K4Y63A2U
        ↓
    DNAT to: 10.32.0.5:8443