Re: Operation not supported when adding jump command

["Serguei Bezverkhi (sbezverk)" <sbezverk@xxxxxxxxx>]

Hello,

I totally get it that it is not possible in theory, but the matter of fact is in kubernetes somehow it works, maybe in some cases this check is not enforced, I do not know. If you are interested to investigate it further, please let me know as I said I have a cluster with these 2 rules configured.

Thank you
Serguei

On 2019-11-26, 10:40 AM, "Pablo Neira Ayuso" <pablo@xxxxxxxxxxxxx> wrote:

    On Tue, Nov 26, 2019 at 02:30:02PM +0000, Serguei Bezverkhi (sbezverk) wrote:
    > Hello Florian,
    >
    > Thank you very much for your reply. Once I changed to Input chain type, the rule worked. It seems iptables DO allow the same rule configuration see below:
    >
    > -A PREROUTING -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
    > -A KUBE-SERVICES -d 57.131.151.19/32 -p tcp -m comment --comment "default/portal:portal has no endpoints" -m tcp --dport 8989 -j REJECT --reject-with icmp-port-unreachable
    
    static struct xt_target reject_tg_reg __read_mostly = {
            .name           = "REJECT",
            .family         = NFPROTO_IPV4,
            .target         = reject_tg,
            .targetsize     = sizeof(struct ipt_reject_info),
            .table          = "filter",
            .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
                              (1 << NF_INET_LOCAL_OUT),
            .checkentry     = reject_tg_check,
            .me             = THIS_MODULE,
    };