### What happened?

I have recently been modifying kube-proxy to support our internal business, and I have doubts about two places.

* Why nodeport rules need to be inserted last after other rules？
* Why does local access to lb service require masq?

### What did you expect to happen?

I didn’t find any special reason for doing the above two questions.

### How can we reproduce it (as minimally and precisely as possible)?

Two problems are in the kube-proxy(v1.24.11-iptables mode)source code:

Why nodeport rules need to be inserted last after other rules？
https://github.com/kubernetes/kubernetes/blob/0f75679e3346160939924550fd3591462a4afec6/pkg/proxy/iptables/proxier.go#L1395

Why does local access to lb service require masq?
https://github.com/kubernetes/kubernetes/blob/0f75679e3346160939924550fd3591462a4afec6/pkg/proxy/iptables/proxier.go#L1134

### Anything else we need to know?

kube-proxy
v1.24.11
iptables mode

### Kubernetes version

v1.24.11

### Cloud provider

nothing

### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>

Some doubts about the iptables mode of kube-proxy
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : Some doubts about the iptables mode of kube-proxy
Issue date:

--- start body ---
### What happened?

I have recently been modifying kube-proxy to support our internal business, and I have doubts about two places.

* Why nodeport rules need to be inserted last after other rules？
* Why does local access to lb service require masq?

### What did you expect to happen?

I didn’t find any special reason for doing the above two questions.

### How can we reproduce it (as minimally and precisely as possible)?

Two problems are in the kube-proxy(v1.24.11-iptables mode)source code:

Why nodeport rules need to be inserted last after other rules？
https://github.com/kubernetes/kubernetes/blob/0f75679e3346160939924550fd3591462a4afec6/pkg/proxy/iptables/proxier.go#L1395

Why does local access to lb service require masq?
https://github.com/kubernetes/kubernetes/blob/0f75679e3346160939924550fd3591462a4afec6/pkg/proxy/iptables/proxier.go#L1134

### Anything else we need to know?

kube-proxy
v1.24.11
iptables mode

### Kubernetes version

v1.24.11

### Cloud provider

nothing

### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>

--- end body ---
