<p>I would like to implement my own iptables rules before Kubernetes (kube-proxy) start doing it's magic and dynamically create rules based on services/pods running on the node. The kube-proxy is running in <code>--proxy-mode=iptables</code>.</p>

<p>Whenever I tried to load rules when booting up the node, for example in the <code>INPUT</code> chain, the Kubernetes rules (<code>KUBE-EXTERNAL-SERVICES</code> and <code>KUBE-FIREWALL</code>) are inserted on top of the chain even though my rules were also with <code>-I</code> flag. </p>

<p>What am I missing or doing wrong?</p>

<p>If it is somehow related, I am using weave-net plugin for the pod network.</p>

<p>The most common practice is to put all custom firewall rules on the gateway(<a href="https://en.wikipedia.org/wiki/Application_delivery_controller" rel="noreferrer">ADC</a>) or into cloud <a href="https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/" rel="noreferrer">security groups</a>. The rest of the cluster security is implemented by other features, like <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="noreferrer">Network Policy</a> (It depends on the network <a href="https://docs.projectcalico.org/v3.0/reference/calicoctl/resources/networkpolicy" rel="noreferrer">providers</a>), <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="noreferrer">Ingress</a>, <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">RBAC</a> and others.</p>

<p>Check out the articles about <a href="https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/" rel="noreferrer">Securing a Cluster</a> and <a href="https://github.com/freach/kubernetes-security-best-practice" rel="noreferrer">Kubernetes Security - Best Practice Guide</a>.</p>

<p>These articles can also be helpful to secure your cluster:</p>

<ul>
<li><p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster" rel="noreferrer">Hardening your cluster's security</a></p></li>
<li><p><a href="https://neuvector.com/container-security/kubernetes-security-guide/" rel="noreferrer">The Ultimate Guide to Kubernetes Security</a></p></li>
</ul>
