Nimendra's Notes 🪴

Packet Handling & High Level Routing

4 min read

kubernetes kubernetes/networking

Core Idea

Kubernetes relies on Linux’s own packet machinery: netfilter inspects packets, routing directs them, iptables and NAT reshape them, and masquerading hides container egress behind the host.

  • Netfilter: the kernel packet filtering framework, with project and DigitalOcean references.
  • Routing and iptables rules that steer traffic.
  • NAT and IP masquerading, with a worked example.

K8s heavily rely on Linux’s underlying packet management.

Netfilter

netfilter/iptables project homepage - The netfilter.org project
A Deep Dive into Iptables and Netfilter Architecture | DigitalOcean

Netfilter is a Linux kernel framework that provides,

  • Packet Filtering – Allows or blocks packets based on rules (used in firewalls like iptables, nftables).
  • Network Address Translation (NAT) – Supports SNAT, DNAT, and IP masquerading for routing traffic.
  • Connection Tracking – Maintains the state of connections (useful for stateful firewalls).
  • User-Space Hooks – Enables interaction between kernel and user-space applications.

Routing

What is Routing
Understanding Routing Table in Linux and Unix - nixCraft

Routing is the process of determining the path that network packets take to reach their destination across interconnected networks.

  • Your computer (192.168.1.10) sends a request to www.google.com.
  • Your router (192.168.1.1) forwards it to your ISP.
  • The ISP’s routers determine the best path using BGP.
  • The packet reaches Google’s servers, and the response is sent back.

iptables

iptables can be used to create firewalls and audit logs, mutate and reroute packets, and even implement crude connection fan-out. iptables uses Netfilter, which allows iptables to intercept and mutate packets.

Iptables rules are complex. UFW, firewalld and kubernetes components (kubelet, kube proxy) simplify it.

Warning

Most Linux distributions are replacing iptables with nftables, a similar but more performant tool built atop Netfilter. Some distros already ship with a version of iptables that is powered by nftables.

There are three key concepts,
a table contains chains & a chain contains rules.

NAT

Network Address Translation (NAT) - GeeksforGeeks

Network Address Translation (NAT) is a technique used in networking to modify IP addresses in packet headers as they pass through a router or firewall. It allows multiple devices on a private network to share a single public IP address to access external networks, such as the internet.

  1. Static NAT —> Maps a private IP address to a fixed public IP address.
  2. Dynamic NAT —> Maps private IP addresses to a pool of public IP addresses dynamically.
    • Useful when multiple devices need internet access but do not require a specific public IP.
  3. PAT (Port Address Translation) or NAT Overload —> Maps multiple private IPs to a single public IP using different port numbers.
    • Most commonly used in home and corporate networks.

IP Masquerading

IP Masquerading is a form of NAT Overload (PAT) where multiple devices on a private network share a single public IP address.
It is commonly used in Linux networking and Kubernetes.

  • The router/firewall replaces the source IP of outgoing packets with its public IP.
  • It keeps track of connections using port numbers.
  • When responses come back, the router translates them back to the original private IP using its connection table.

Example

  1. Request Sent (Outbound):
    • The pod with IP 192.168.2.50 sends a request to api.example.com.
    • The Kubernetes node (with IP 10.0.0.5) masquerades the pod’s IP address. This means that the source IP address in the outbound request is replaced by the node’s public IP address (e.g., 203.0.113.5) and a unique source port (e.g., 203.0.113.5:50001).
  2. Response Received (Inbound):
    • The external service (api.example.com) sends the response back to the public IP of the node (203.0.113.5:50001).
    • The node receives the response and uses Connection Tracking to identify the original connection. It looks up the source port number (50001) in its NAT table to figure out which pod the request originated from.
  3. Translation and Forwarding:
    • The node forwards the response to the correct pod IP (in this case, 192.168.2.50) using the connection information it tracked.
    • The pod receives the response from api.example.com as if it had sent the request directly.

Graph View