<p>After manually adding some iptables rules and rebooting the machine, all of the rules are gone (no matter the type of rule ). </p>

<p>ex.</p>

<pre><code>$ iptables -A FUGA-INPUT -p tcp --dport 23 -j DROP
$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere
DROP       tcp  --  anywhere             anywhere             tcp dpt:telnet
</code></pre>

<p>After the reboot:</p>

<pre><code>$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere
</code></pre>

<p>If I am not mistaken, <code>kube-proxy</code> running on every node is dynamically modifying the <code>iptables</code>. If that is correct how can I add rules that are permanent but still enable kubernetes/kube-proxy to do it's magic and not delete all the <code>INPUT</code>, <code>FORWARD</code> and <code>OUTPUT</code> rules that both Kubernetes and Weave plugin network dynamically generate?</p>

<p>Running <code>iptables</code> on <strong>any</strong> system is not a persistent action and would be forgotten on reboot, a k8s node is not an exception. I doubt that k8s will erase the IPTABLES rules when it starts, so you could try this:</p>

<ul>
<li>create your rules (do this starting with empty iptables, with <code>iptables -A</code> commands, as you need them)</li>
<li>run <code>iptables-save &gt;/etc/my-iptables-rules</code> (NOTE you could create a rules file manually, too).</li>
<li>create a system service script that runs on boot (or use <code>/etc/rc.local</code>) and add <code>iptables-restore -n &lt;/etc/my-iptables-rules</code> to it. This would load your rules on reboot. Note if you use <code>rc.local</code>, your 'iptables-restore' command may well run after k8s starts, check that your <code>iptables -A</code> commands are not sensitive to being loaded after those of k8s; if needed replace the -A commands in the file with -I (to place your commands first in the tables).</li>
</ul>

<p>(be aware that some OS installations might include a boot-time service that loads iptables as well; there are some firewall packages that install such a service - if you have one on your server, the best approach is to add your rules to that firewall's config, not write and load your own custom config).</p>
