<p>When creating a kubernetes service of type <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">nodePort</a>, kube-proxy configures each worker node to listen on a particular port.</p>

<p>How does kube-proxy (in the iptables proxy mode) actually configure this? Is it just done using iptables which opens a port? (not sure if that is even possible) </p>

<p>Kube Proxy uses IPTable and netfilter rules for forwarding traffic from nodeports to pods. Mark Betz's article series on K8's networking is a good read. 
 <a href="https://medium.com/google-cloud/understanding-kubernetes-networking-services-f0cb48e4cc82" rel="nofollow noreferrer">https://medium.com/google-cloud/understanding-kubernetes-networking-services-f0cb48e4cc82</a></p>
