iptables: Fix 127.0.0.1:NodePort to remote pods
iptables: Fix 127.0.0.1:NodePort to remote pods

Commit c6888d48780 fixed 127.0.0.1:NodePort redirection by adding an additional
clause to the kube-proxy masquerade bit clearing rule to ensure that kube-proxy
masquerades all traffic with a source IP of 127.0.0.1. This fixes NodePort
redirection to local pods but it can cause problem when running in
encapsulation mode depending on the rp_filter settings of nodes because the
source IP of the traffic will have a source IP equal to any of the node IPs
which are not routable on the overlay. This causes reply traffic to be routed
back via the underlay which the reverse path filter can potentially drop.

Fixes: c6888d48780 ("iptables: Ensure NAT for locally-sourced packets")

Signed-off-by: Thomas Graf <5f50a84c1fa3bcff146405017f36aec1a10a9e38@cilium.io>

cilium/cilium,michi-covalent/cilium,tgraf/cilium,tklauser/cilium,cilium-team/cilium,cilium/cilium,tklauser/cilium,cilium/cilium,michi-covalent/cilium,tgraf/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,michi-covalent/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,cilium-team/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tklauser/cilium