<p>To change the source IP to 100.101.102.103 for outgoing data to a specific destination, I modified <strong>iptables</strong> inside the container of a Kubernetes Pod by executing iptables CLI tool:</p>

<pre><code>iptables -t nat -A POSTROUTING --destination 100.200.150.50/32 -j SNAT --to-source 100.101.102.103
</code></pre>

<p>But it blocks my outgoing data to that destination and seems like the data is caught inside the container for example when I send a simple request by Curl and watch it by Tcpdump tool.</p>

<p>The main question can be: How to modify source IP for a Pod in Kubernetes for a destination outside the cluster?</p>

<p><strong>P.S</strong>. I deployed my pod in privileged mode with <strong>NET_ADMIN</strong> and <strong>NET_RAW</strong> access.</p>

losingsleeep
<blockquote>
  <p>I modified iptables inside the container of a Kubernetes Pod</p>
</blockquote>

<p>I suggest not to do this as it may corrupt kubernetes' CNI and/or kube-proxy. Instead, consider using kubernetes egress to have a well-known source IP address in outgoing packets to a destination outside the cluster.</p>

<p>Egress packets from a k8s cluster to a destination outside the cluster have node's IP as the source IP.</p>

<p><a href="https://kubernetes.io/docs/tutorials/services/source-ip/" rel="nofollow noreferrer">https://kubernetes.io/docs/tutorials/services/source-ip/</a> says egress packets from k8s get source NAT'ed with node's IP:</p>

<blockquote>
  <p><a href="https://en.wikipedia.org/wiki/Network_address_translation#SNAT" rel="nofollow noreferrer">Source NAT</a>: replacing the source IP on a packet, usually with a node’s IP</p>
</blockquote>

<p>Following can be used to send egress packets from a k8s cluster:</p>

<ul>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">k8s network policies</a></li>
<li><a href="https://docs.projectcalico.org/v3.6/security/kubernetes-network-policy#create-egress-policies" rel="nofollow noreferrer">calico CNI egress policies</a></li>
<li><a href="https://istio.io/docs/tasks/traffic-management/egress/egress-gateway/" rel="nofollow noreferrer">istio egress gateway</a></li>
<li><a href="https://github.com/nirmata/kube-static-egress-ip" rel="nofollow noreferrer">nirmata/kube-static-egress-ip GitHub project</a></li>
</ul>
