Net.bridge.bridge-nf-call-iptables

lastmod 2025-12-16created 2025-12-164 edits

Determines whether IPv4 traffic passing through a bridge is processed by iptables

Why is it needed in Kubernetes?

• In Kubernetes, Pod-to-Pod communication goes through a virtual bridge network
• Without this setting, Network Policy does not work
• Required for the iptables mode of kube-proxy to work properly

Example of how it works

Pod A --> veth0 --> cni0(브리지) --> veth1 --> Pod B
         ↑
         이 (veth0) 구간의 트래픽을 iptables로 필터링

Problems if not set

• kube-proxy iptables rules are not applied to bridge traffic
• Service ClusterIP does not work
• Network Policy does not work

See also

• Sysctl
• Computer Network
• NAT
• Router
• net.bridge.bridge-nf-call-ip6tables
• net.bridge.bridge-nf-call-iptables
• net.ipv4.ip_forward
• Kubernetes