# kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain

DevFeed: [kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain](<https://devfeed.tech/articles/kube-proxy-in-iptables-mode-and-native-nftables-rules-in-the-forward-chain-34106.md>)

Original publisher: [Read original article](<https://philipptheserver.com/posts/kube-proxy-native-nftables/>)

Author: Philipp Lehmann (philipp.lehmann@gruppe.ai)

Published: 2026-09-08T07:00:00Z

Content type: article

Language: en

Sources: [Philipp Lehmann](<https://devfeed.tech/sources/philipp-lehmann.md>)

Topics: [proxy](<https://devfeed.tech/topics/proxy.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>)

Tags: [firewall](<https://devfeed.tech/tags/firewall.md>), [handle](<https://devfeed.tech/tags/handle.md>), [ip](<https://devfeed.tech/tags/ip.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [networking](<https://devfeed.tech/tags/networking.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [vpn](<https://devfeed.tech/tags/vpn.md>)

## AI overview

The article explains how native nftables rules added by a WireGuard-based mesh agent to the FORWARD chain can cause kube-proxy in iptables mode to abort synchronization silently, leaving service endpoints stale. It describes removing the conflicting rules by handle.

## Source excerpt

kube-proxy iptables-nft sync silently aborts on native nftables rules a mesh agent adds to the FORWARD chain. Fix: nft delete rule by handle, ip and ip6.