t.Run(tt.name+"_"+ipstr(ipv6), func(t *testing.T) {
				cfg := constructTestConfig()
				cfg.EnableInboundIPv6 = ipv6
				tt.config(cfg)
				ext := &dep.DependenciesStub{}
				iptConfigurator, _ := NewIptablesConfigurator(cfg, ext, EmptyNlDeps())
				var probeIP *netip.Addr
				if ipv6 {
					probeIP = &probeSNATipv6
				} else {
					probeIP = &probeSNATipv4
				}
				err := iptConfigurator.CreateInpodRules(probeIP)

		return nil, fmt.Errorf("error initializing the ztunnel server: %w", err)
	}

	cfg := &iptables.Config{
		RestoreFormat: true,
		RedirectDNS:   args.DNSCapture,
	}

	iptablesConfigurator, err := iptables.NewIptablesConfigurator(cfg, realDependencies(), iptables.RealNlDeps())
	if err != nil {
		return nil, fmt.Errorf("error configuring iptables: %w", err)
	}

	// Create hostprobe rules now, in the host netns

}

func getTestFixure(ctx context.Context) netTestFixture {
	podNsMap := newPodNetnsCache(openNsTestOverride)
	nlDeps := &fakeIptablesDeps{}
	iptablesConfigurator, _ := iptables.NewIptablesConfigurator(nil, &dependencies.DependenciesStub{}, nlDeps)

	ztunnelServer := &fakeZtunnel{}

	fakeIPSetDeps := ipset.FakeNLDeps()
	set := ipset.IPSet{Name: "foo", Deps: fakeIPSetDeps}

	return &iptablesconfig.Config{
		RestoreFormat:     c.RestoreFormat,
		TraceLogging:      c.TraceLogging,
		EnableInboundIPv6: c.EnableInboundIPv6,
		RedirectDNS:       c.RedirectDNS,
	}
}

func NewIptablesConfigurator(cfg *Config, ext dep.Dependencies, nlDeps NetlinkDependencies) (*IptablesConfigurator, error) {
	if cfg == nil {
		cfg = &Config{
			RestoreFormat: true,
		}
	}

	configurator := &IptablesConfigurator{