<p>I add one external ip <code>1.1.1.1</code> for one of my pod, and I can access pod's udp port <code>1234</code> via <code>1.1.1.1:1234</code> from external network, but I found that k8s do SNAT for the request and from my pod, the source ip is k8s's ip <code>10.244.0.1:1234</code>. When my pod response udp pkt to <code>10.244.0.1:1234</code>, k8s does not do DNAT for me, so external network can not receive response at all. What ip and port should my pod response? Any ideas?</p>

Mr Pang
<p>You don't need an explicit DNAT rule since there is a conntrack table created for the SNAT rule which has the 4-tuple(src ip, dst ip, src port, dst port) to identify a connection for the response packets. Do you send multiple udp requests with the same 4-tuple, I do remember there is a conntract table race condition for udp. You can take a look at the details of the race condition from the following <a href="https://www.weave.works/blog/racy-conntrack-and-dns-lookup-timeouts" rel="nofollow noreferrer">link</a>. </p>
