obj.OOMScoreAdj = &temp
	}
	if obj.IPTables.SyncPeriod.Duration == 0 {
		obj.IPTables.SyncPeriod = metav1.Duration{Duration: 30 * time.Second}
	}
	if obj.IPTables.MinSyncPeriod.Duration == 0 {
		obj.IPTables.MinSyncPeriod = metav1.Duration{Duration: 1 * time.Second}
	}
	if obj.IPTables.LocalhostNodePorts == nil {
		obj.IPTables.LocalhostNodePorts = ptr.To(true)
	}
	if obj.IPVS.SyncPeriod.Duration == 0 {

	// IfNotLocal returns iptables arguments that will match traffic that is not from
	// a local pod.
	IfNotLocal() []string

	// IfLocalNFT returns nftables arguments that will match traffic from a local pod.
	IfLocalNFT() []string

	// IfNotLocalNFT returns nftables arguments that will match traffic that is not
	// from a local pod.
	IfNotLocalNFT() []string
}

type detectLocal struct {
	ifLocal       []string

# NFTables kube-proxy

This is an implementation of service proxying via the nftables API of
the kernel netfilter subsystem.

## General theory of netfilter

Packet flow through netfilter looks something like:

```text
             +================+      +=====================+
             | hostNetwork IP |      | hostNetwork process |
             +================+      +=====================+
                         ^                |

logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
metricsBindAddress: 127.0.0.1:10249
mode: ""
nftables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 1s
  syncPeriod: 30s
nodePortAddresses: null
oomScoreAdj: -999
portRange: ""
showHiddenMetricsForVersion: ""
winkernel:
  enableDSR: false

// limitations under the License.

package plugin

// InterceptRuleMgr configures networking tables (e.g. iptables or nftables) for
// redirecting traffic to an Istio proxy.
type InterceptRuleMgr interface {
	Program(podName, netns string, redirect *Redirect) error
}

// Constructor for iptables InterceptRuleMgr
func IptablesInterceptRuleMgr() InterceptRuleMgr {
	return newIPTables()

					MinSyncPeriod:      metav1.Duration{Duration: 1 * time.Second},
				},
				IPVS: kubeproxyconfigv1alpha1.KubeProxyIPVSConfiguration{
					SyncPeriod: metav1.Duration{Duration: 30 * time.Second},
				},
				NFTables: kubeproxyconfigv1alpha1.KubeProxyNFTablesConfiguration{
					MasqueradeBit: ptr.To[int32](14),
					MasqueradeAll: false,
					SyncPeriod:    metav1.Duration{Duration: 30 * time.Second},

logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
metricsBindAddress: 127.0.0.1:10249
mode: ""
nftables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 1s
  syncPeriod: 30s
nodePortAddresses: null
oomScoreAdj: -999
portRange: ""
showHiddenMetricsForVersion: ""
winkernel:
  enableDSR: false

limitations under the License.
*/

// This is an empty file to avoid "build constraints exclude all Go files" error while running unit tests on non-linux platforms.

		for key, val := range *in {
			(*out)[key] = val
		}
	}
	out.ClientConnection = in.ClientConnection
	in.Logging.DeepCopyInto(&out.Logging)
	in.IPTables.DeepCopyInto(&out.IPTables)
	in.IPVS.DeepCopyInto(&out.IPVS)
	out.Winkernel = in.Winkernel
	in.NFTables.DeepCopyInto(&out.NFTables)
	out.DetectLocal = in.DetectLocal
	if in.NodePortAddresses != nil {
		in, out := &in.NodePortAddresses, &out.NodePortAddresses

			obj.HealthzBindAddress = fmt.Sprintf("%d.%d.%d.%d:%d", c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(65536))
			obj.IPTables.MasqueradeBit = ptr.To(c.Int31())
			obj.IPTables.LocalhostNodePorts = ptr.To(c.RandBool())
			obj.NFTables.MasqueradeBit = ptr.To(c.Int31())
			obj.MetricsBindAddress = fmt.Sprintf("%d.%d.%d.%d:%d", c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(65536))