{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27161","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27161/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27161/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27161/events","html_url":"https://github.com/kubernetes/kubernetes/issues/27161","id":159536644,"number":27161,"title":"Iptables forwarding routes for ClusterIP services","user":{"login":"paralin","id":534887,"avatar_url":"https://avatars.githubusercontent.com/u/534887?v=3","gravatar_id":"","url":"https://api.github.com/users/paralin","html_url":"https://github.com/paralin","followers_url":"https://api.github.com/users/paralin/followers","following_url":"https://api.github.com/users/paralin/following{/other_user}","gists_url":"https://api.github.com/users/paralin/gists{/gist_id}","starred_url":"https://api.github.com/users/paralin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paralin/subscriptions","organizations_url":"https://api.github.com/users/paralin/orgs","repos_url":"https://api.github.com/users/paralin/repos","events_url":"https://api.github.com/users/paralin/events{/privacy}","received_events_url":"https://api.github.com/users/paralin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"cjcullen","id":7154008,"avatar_url":"https://avatars.githubusercontent.com/u/7154008?v=3","gravatar_id":"","url":"https://api.github.com/users/cjcullen","html_url":"https://github.com/cjcullen","followers_url":"https://api.github.com/users/cjcullen/followers","following_url":"https://api.github.com/users/cjcullen/following{/other_user}","gists_url":"https://api.github.com/users/cjcullen/gists{/gist_id}","starred_url":"https://api.github.com/users/cjcullen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjcullen/subscriptions","organizations_url":"https://api.github.com/users/cjcullen/orgs","repos_url":"https://api.github.com/users/cjcullen/repos","events_url":"https://api.github.com/users/cjcullen/events{/privacy}","received_events_url":"https://api.github.com/users/cjcullen/received_events","type":"User","site_admin":false},"assignees":[{"login":"cjcullen","id":7154008,"avatar_url":"https://avatars.githubusercontent.com/u/7154008?v=3","gravatar_id":"","url":"https://api.github.com/users/cjcullen","html_url":"https://github.com/cjcullen","followers_url":"https://api.github.com/users/cjcullen/followers","following_url":"https://api.github.com/users/cjcullen/following{/other_user}","gists_url":"https://api.github.com/users/cjcullen/gists{/gist_id}","starred_url":"https://api.github.com/users/cjcullen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjcullen/subscriptions","organizations_url":"https://api.github.com/users/cjcullen/orgs","repos_url":"https://api.github.com/users/cjcullen/repos","events_url":"https://api.github.com/users/cjcullen/events{/privacy}","received_events_url":"https://api.github.com/users/cjcullen/received_events","type":"User","site_admin":false}],"milestone":null,"comments":48,"created_at":"2016-06-10T00:23:08Z","updated_at":"2016-09-21T10:57:46Z","closed_at":null,"body":"I have the following use case:\r\n\r\nI need to route from non-kubernetes servers to Kubernetes ClusterIPs. I already have the routes set up properly to FORWARD to pod IP addresses, and this works perfectly (I can access pod IP addresses from outside the cluster). But nothing I've tried seems to get the service routing to work properly.\r\n\r\nHow can I set this up properly? Is this something that potentially should be included in Kubernetes?"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/248578128","html_url":"https://github.com/kubernetes/kubernetes/issues/27161#issuecomment-248578128","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27161","id":248578128,"user":{"login":"kdima","id":4558851,"avatar_url":"https://avatars.githubusercontent.com/u/4558851?v=3","gravatar_id":"","url":"https://api.github.com/users/kdima","html_url":"https://github.com/kdima","followers_url":"https://api.github.com/users/kdima/followers","following_url":"https://api.github.com/users/kdima/following{/other_user}","gists_url":"https://api.github.com/users/kdima/gists{/gist_id}","starred_url":"https://api.github.com/users/kdima/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kdima/subscriptions","organizations_url":"https://api.github.com/users/kdima/orgs","repos_url":"https://api.github.com/users/kdima/repos","events_url":"https://api.github.com/users/kdima/events{/privacy}","received_events_url":"https://api.github.com/users/kdima/received_events","type":"User","site_admin":false},"created_at":"2016-09-21T10:57:45Z","updated_at":"2016-09-21T10:57:45Z","body":"Sorry about the delay. \r\nHere is the tcp dump of the the timeout:\r\n\r\nI am running the following command on my local box:\r\n```\r\n$ curl -k --max-time 5 https://10.220.254.1/           \r\ncurl: (28) Connection timed out after 5000 milliseconds\r\n```\r\n\r\ntcpdump on my local box:\r\n```\r\nsudo tcpdump -i any -n host 10.220.254.1\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes\r\nIP 10.11.0.5.37273 > 10.220.254.1.443: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174251689 ecr 0,nop,wscale 7], length 0\r\nIP 10.11.0.5.37273 > 10.220.254.1.443: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174251939 ecr 0,nop,wscale 7], length 0\r\nIP 10.11.0.5.37273 > 10.220.254.1.443: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174252440 ecr 0,nop,wscale 7], length 0\r\n```\r\n\r\nTcp dump on the remote box inside k8s cluster that is the gateway:\r\n```\r\ntcpdump -i any -n port 443\r\nIP 172.29.12.5.37273 > 10.220.254.1.https: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174251689 ecr 0,nop,wscale 7], length 0\r\nIP 172.29.12.5.37273 > 10.220.254.1.https: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174251939 ecr 0,nop,wscale 7], length 0\r\nIP 172.29.12.5.37273 > 10.220.254.1.https: Flags [S], seq 4026671374, win 23200, options [mss 1160,sackOK,TS val 174252440 ecr 0,nop,wscale 7], length 0\r\n```\r\n\r\nAs you can see sequence numbers match on my local box and what was captured on the remote box. So the traffic is getting to the gateway box.\r\n\r\nHere is a tcpdump of the case where traffic actually goes through:\r\nCommand I ran on my local box:\r\n```\r\ncurl -k --max-time 5 https://10.220.254.1/ \r\nUnauthorized\r\n```\r\n\r\nLocal box tcpdump\r\n```\r\nsudo tcpdump -i any -n host 10.220.254.1\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [S], seq 3864019960, win 23200, options [mss 1160,sackOK,TS val 174372844 ecr 0,nop,wscale 7], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [S.], seq 3620472236, ack 3864019961, win 28160, options [mss 1160,sackOK,TS val 89257878 ecr 174372844,nop,wscale 7], length 0\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 1, win 182, options [nop,nop,TS val 174372847 ecr 89257878], length 0\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [P.], seq 1:274, ack 1, win 182, options [nop,nop,TS val 174372847 ecr 89257878], length 273\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [.], ack 274, win 229, options [nop,nop,TS val 89257888 ecr 174372847], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 1:55, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 54\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 55, win 182, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [.], seq 55:1203, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 1148\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 1203, win 200, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [.], seq 1203:2351, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 1148\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 2351, win 218, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [.], seq 2351:3499, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 1148\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 3499, win 236, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 3499:4312, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 813\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 4312, win 253, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 4312:4650, ack 274, win 229, options [nop,nop,TS val 89257895 ecr 174372847], length 338\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 4650, win 271, options [nop,nop,TS val 174372851 ecr 89257895], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 4650:5008, ack 274, win 229, options [nop,nop,TS val 89257896 ecr 174372847], length 358\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 5008, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 5008:5017, ack 274, win 229, options [nop,nop,TS val 89257896 ecr 174372847], length 9\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 5017, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 0\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [P.], seq 274:412, ack 5017, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 138\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 5017:5023, ack 412, win 237, options [nop,nop,TS val 89257906 ecr 174372851], length 6\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 5023:5068, ack 412, win 237, options [nop,nop,TS val 89257906 ecr 174372851], length 45\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [.], ack 5068, win 289, options [nop,nop,TS val 174372854 ecr 89257906], length 0\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [P.], seq 412:517, ack 5068, win 289, options [nop,nop,TS val 174372854 ecr 89257906], length 105\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 5068:5270, ack 517, win 237, options [nop,nop,TS val 89257916 ecr 174372854], length 202\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [P.], seq 517:548, ack 5270, win 307, options [nop,nop,TS val 174372856 ecr 89257916], length 31\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [F.], seq 548, ack 5270, win 307, options [nop,nop,TS val 174372856 ecr 89257916], length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [P.], seq 5270:5301, ack 549, win 237, options [nop,nop,TS val 89257926 ecr 174372856], length 31\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [R], seq 3864020509, win 0, length 0\r\nIP 10.220.254.1.443 > 10.11.0.5.37567: Flags [F.], seq 5301, ack 549, win 237, options [nop,nop,TS val 89257926 ecr 174372856], length 0\r\nIP 10.11.0.5.37567 > 10.220.254.1.443: Flags [R], seq 3864020509, win 0, length 0\r\n```\r\n\r\nRemote tcp dump\r\n```\r\ntcpdump -i any -n port 443\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [S], seq 3864019960, win 23200, options [mss 1160,sackOK,TS val 174372844 ecr 0,nop,wscale 7], length 0\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [S.], seq 3620472236, ack 3864019961, win 28160, options [mss 1420,sackOK,TS val 89257878 ecr 174372844,nop,wscale 7], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 1, win 182, options [nop,nop,TS val 174372847 ecr 89257878], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [P.], seq 1:274, ack 1, win 182, options [nop,nop,TS val 174372847 ecr 89257878], length 273\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [.], ack 274, win 229, options [nop,nop,TS val 89257888 ecr 174372847], length 0\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 1:55, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 54\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [.], seq 55:2351, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 2296\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 2351:4312, ack 274, win 229, options [nop,nop,TS val 89257889 ecr 174372847], length 1961\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 4312:4650, ack 274, win 229, options [nop,nop,TS val 89257895 ecr 174372847], length 338\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 4650:5008, ack 274, win 229, options [nop,nop,TS val 89257896 ecr 174372847], length 358\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 5008:5017, ack 274, win 229, options [nop,nop,TS val 89257896 ecr 174372847], length 9\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 55, win 182, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 1203, win 200, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 2351, win 218, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 3499, win 236, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 4312, win 253, options [nop,nop,TS val 174372849 ecr 89257889], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 4650, win 271, options [nop,nop,TS val 174372851 ecr 89257895], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 5008, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [.], ack 5017, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [P.], seq 274:412, ack 5017, win 289, options [nop,nop,TS val 174372851 ecr 89257896], length 138\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 5017:5023, ack 412, win 237, options [nop,nop,TS val 89257906 ecr 174372851], length 6\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 5023:5068, ack 412, win 237, options [nop,nop,TS val 89257906 ecr 174372851], length 45\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [P.], seq 412:517, ack 5068, win 289, options [nop,nop,TS val 174372854 ecr 89257906], length 105\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 5068:5270, ack 517, win 237, options [nop,nop,TS val 89257916 ecr 174372854], length 202\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [P.], seq 517:548, ack 5270, win 307, options [nop,nop,TS val 174372856 ecr 89257916], length 31\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [F.], seq 548, ack 5270, win 307, options [nop,nop,TS val 174372856 ecr 89257916], length 0\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [P.], seq 5270:5301, ack 549, win 237, options [nop,nop,TS val 89257926 ecr 174372856], length 31\r\nIP 10.220.254.1.https > 172.29.12.5.37567: Flags [F.], seq 5301, ack 549, win 237, options [nop,nop,TS val 89257926 ecr 174372856], length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [R], seq 3864020509, win 0, length 0\r\nIP 172.29.12.5.37567 > 10.220.254.1.https: Flags [R], seq 3864020509, win 0, length 0\r\nIP 1.2.3.4.https > 10.20.0.3.34318: Flags [P.], seq 479531611:479531674, ack 276920723, win 237, options [nop,nop,TS val 1085792045 ecr 89019131], length 63\r\nIP 1.2.3.4.https > 10.20.0.3.34318: Flags [F.], seq 63, ack 1, win 237, options [nop,nop,TS val 1085792045 ecr 89019131], length 0\r\nIP 10.20.0.3.34318 > 1.2.3.4.https: Flags [P.], seq 1:32, ack 64, win 1228, options [nop,nop,TS val 89259139 ecr 1085792045], length 31\r\nIP 10.20.0.3.34318 > 1.2.3.4.https: Flags [F.], seq 32, ack 64, win 1228, options [nop,nop,TS val 89259139 ecr 1085792045], length 0\r\nIP 1.2.3.4.https > 10.20.0.3.34318: Flags [R], seq 479531675, win 0, length 0\r\nIP 1.2.3.4.https > 10.20.0.3.34318: Flags [R], seq 479531675, win 0, length 0\r\n```"}}
{"actor":{"display_login":"kdima"}}