Nat

What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.

Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.

Netfilter 자리에 걸린 함수 둘과 해시 테이블 하나로 연결을 5-tuple 로 기억하는 커널 모듈. 방화벽의 ESTABLISHED 판정과 NAT 의 답장 되돌리기가 이 테이블 위에서 성립한다.