title: Is there a way to customize iptables rules in filter table on kubernetes master/worker node?
body: <p>I'm working on a project where we're attempting to transition legacy product (deployed as a standalone VM) to kubernetes infrastcurture.</p>
  
  <p>I'm using KUBEROUTER as CNI provider.</p>
  
  <p>To protect the VM against DoS(and log the attempt) we've added different chains in iptables filter table. (These include rules for ping flood, syn flood - I think network policies/ingress controller can manage syn flood, but not sure how icmp flood would be taken care of. )</p>
  
  <p>When I deployed kubernetes on my VM, I found that kubernetes updates iptables and creates it's own chains. (Mainly k8s updates NAT rules but chains are added in filter table as well)</p>
  
  <p>My questions are:</p>
  
  <ol>
  <li><p>Is it possible to customize iptables on VM where kubernetes is running?</p></li>
  <li><p>If I add my own chains (making sure that k8s chains are in place) to iptables configuration, would they be overwritten by k8s?</p></li>
  <li><p>Can I add chains using plain old iptables commands or need to do so via kubectl? (From k8s documentation, I got an impression that we can only update rules in NAT table using kubectl)</p></li>
  </ol>
  
  <p>Please let me know, if somebody knows more on this, thanks !</p>
  
  <p>~Prasanna</p>