<p>I have a hybrid GKE Cluster running with some Linux and Windows nodes. I followed this how-to (<a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent</a>) in order to configure the masquerade for some of my networks and it works like a charm on Linux Nodes. But it doesn't work on the windows hosts, it gives me this error:</p>
<pre><code>Failed to create pod sandbox: rpc error: code = Unknown desc = failed to start sandbox container for pod &quot;ip-masq-agent-pc9vn&quot;: Error response from daemon: network host not found
</code></pre>
<p>Anyone knows how can I configure masquerade on Windows Nodes?</p>
<p><strong>Adding details:</strong></p>
<p>I know that Linux containers don't run on Windows nodes, so ip-masq-agent won't run on that node and I know that I can use taints or labels to avoid the pods to be scheduled on that node.</p>
<p>I use Windows nodes with kubernetes because I have some .Net Framework applications running on it, and it works fine. My problem is that I need to masquerade the connections from the pod to hosts outside of the cluster because the source connections are the Pod IPs, not the node IP.</p>
<p>On Linux machines, I can do that using ip-masq-agent, that mange Iptables rules to masquerade the traffic. But on Windows, the ip-masq-agent doesn't work, for the reasons that @Rico said in his answer.</p>
<p>I want to know if someone knows another way to achieve the same thing on Windows nodes.</p>
<p>I can use a &quot;NAT Machine&quot; holding all connections in the middle and route all traffic to that machine, but it's a really ugly way to do that.</p>
<p><strong>Solution:</strong>
I end up allowing the pod network to go through VPN. Thank you for all the replies.</p>

Bruno R. Rodrigues
<p>The simple answer is you can't. iptables is a Linux thing. Windows has some alternatives that you can use to set up NAT (<code>netsh</code>) like described here: <a href="https://superuser.com/questions/1088309/windows-10-nat-port-forwarding-ip-masquerade">https://superuser.com/questions/1088309/windows-10-nat-port-forwarding-ip-masquerade</a>, but there's no specific K8s support so you will be on your own.</p>
<p>To make sure your <code>ip-masq-agent</code> doesn't get scheduled on your Windows nodes you can follow a <code>NodeSelector</code>, <code>Taint/Toleration</code> approach as described <a href="https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/#ensuring-os-specific-workloads-land-on-the-appropriate-container-host" rel="nofollow noreferrer">here</a>.</p>
<p>A wider question would be what are you trying to run on the Windows machines? <a href="https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/#ensuring-os-specific-workloads-land-on-the-appropriate-container-host" rel="nofollow noreferrer">Windows containers</a> are not interchangeable with Linux containers. If you want your Linux pods and Windows pods to talk to each other have you tried <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/#getting-started-adding-a-windows-node-to-your-cluster" rel="nofollow noreferrer">Flannel</a>?</p>
