"Not",
	"Unreachable",
	"Nop",
	"Block",
	"Loop",
	"If",
	"Else",
	"End",
	"Br",
	"BrIf",
	"BrTable",
	"Return",
	"Call",
	"CallIndirect",
	"Drop",
	"Select",
	"LocalGet",
	"LocalSet",
	"LocalTee",
	"GlobalGet",
	"GlobalSet",
	"I32Load",
	"I64Load",
	"F32Load",
	"F64Load",
	"I32Load8S",
	"I32Load8U",
	"I32Load16S",
	"I32Load16U",
	"I64Load8S",
	"I64Load8U",

		// depend on it.
		if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain,
			"-m", "comment", "--comment", "block incoming localnet connections",
			"--dst", "127.0.0.0/8",
			"!", "--src", "127.0.0.0/8",
			"-m", "conntrack",
			"!", "--ctstate", "RELATED,ESTABLISHED,DNAT",
			"-j", "DROP"); err != nil {

127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
fe00::0	ip6-mcastprefix
fe00::1	ip6-allnodes
fe00::2	ip6-allrouters
123.45.67.89	some.domain
`,
			expectedHostsFileContent: `# Kubernetes-managed hosts file (host network).
# hosts file for testing.
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
fe00::0	ip6-mcastprefix
fe00::1	ip6-allnodes
fe00::2	ip6-allrouters

				-A KUBE-EXTERNAL-SERVICES -m comment --comment "ns2/svc2:p80 has no local endpoints" -m addrtype --dst-type LOCAL -m tcp -p tcp --dport 3001 -j DROP
				-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
				-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP

‚Ù$73c9f651-f023-4566-b012-cc537fdb7ce2Ä’·G1ˆ ÄTà¦Çñ 1ÊB5’ k@ N°›+Xýˆ qiO127.0.0.1 localhost 127.0.1.1 nano 127.0.1.2 nano ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet fÙ$1f163718-9bc5-4b01-bff7-5d8cf09caf10Ä’·G1ˆ ÄTà¦Çñ 1ÊB5’ k@ N°›+Xýˆ qiO127.0.0.1 localhost 127.0.1.1 nano 127.0.1.2 nano ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet f xl2/testbucket/hosts/xl.meta XL2 Æ ï Ä$•Ä 7 ›ÅK ¿÷]Œðœ¯ Ó ¹ôc â NÄ ó7 Å Mƒ¤Type ¥V2ObjÞ ¢IDÄ 7 ›ÅK ¿÷]Œðœ¯ ¤DDirÄ øë ÖzD'¨E<‹ÞÆ-ئEcAlgo £EcM £EcN §EcBSizeÒ...

		// created in the kernel.)
		proxier.filterChains.Write(utiliptables.MakeChainLine(kubeletFirewallChain))
		proxier.filterRules.Write(
			"-A", string(kubeletFirewallChain),
			"-m", "comment", "--comment", `"block incoming localnet connections"`,
			"-d", "127.0.0.0/8",
			"!", "-s", "127.0.0.0/8",
			"-m", "conntrack",
			"!", "--ctstate", "RELATED,ESTABLISHED,DNAT",
			"-j", "DROP",
		)
	}

	// Accumulate NAT chains to keep.

	buffer.WriteString("127.0.0.1\tlocalhost\n")                      // ipv4 localhost
	buffer.WriteString("::1\tlocalhost ip6-localhost ip6-loopback\n") // ipv6 localhost
	buffer.WriteString("fe00::0\tip6-localnet\n")
	buffer.WriteString("fe00::0\tip6-mcastprefix\n")
	buffer.WriteString("fe00::1\tip6-allnodes\n")
	buffer.WriteString("fe00::2\tip6-allrouters\n")
	if len(hostDomainName) > 0 {