Launder using routing into a loopback tunnel

laundromat.sh

#!/bin/bash

# SIGSTOP kube-proxy
kill -STOP `ps auxwww | grep kube-proxy | grep -v /bin/sh | grep -v grep | awk '{print $2}'`

export NODEID="3"
export CBRA="10.244.$NODEID.1"
export ETHA="10.128.0.$NODEID"

# GRE point to point tunnel to launder packets
ip tunnel add laundryin mode gre remote $ETHA local $CBRA
ip link set laundryin up
ip tunnel add laundryout mode gre local $ETHA remote $CBRA
ip link set laundryout up

# Create a routing table named laundromat pointing to the laundry tunnel
echo 200 laundromat >> /etc/iproute2/rt_tables
ip route add default dev laundryin table laundromat

# PBR rules to push packets into the laundromat
ip rule add fwmark 0x4000/0x4000 iif cbr0 lookup laundromat priority 1000
ip rule add from all iif laundryout lookup default priority 2000
ip rule add from all iif cbr0 oif cbr0 lookup laundromat priority 3000

# Need to prevent masquerade into the tunnel
iptables -t nat -I KUBE-POSTROUTING 1 -o laundryin -m mark --mark 0x4000/0x4000 -j ACCEPT