switch config.Mode {
	case kubeproxyconfig.ProxyModeIPVS:
		allErrs = append(allErrs, validateKubeProxyIPVSConfiguration(config.IPVS, newPath.Child("KubeProxyIPVSConfiguration"))...)
	case kubeproxyconfig.ProxyModeNFTables:
		allErrs = append(allErrs, validateKubeProxyNFTablesConfiguration(config.NFTables, newPath.Child("KubeProxyNFTablesConfiguration"))...)
	}

	if config.Mode == "" {
		o.logger.Info("Using iptables proxy")
		config.Mode = proxyconfigapi.ProxyModeIPTables
	}

	if config.Mode == proxyconfigapi.ProxyModeNFTables && len(config.NodePortAddresses) == 0 {
		config.NodePortAddresses = []string{proxyconfigapi.NodePortAddressesPrimary}
	}

	if config.DetectLocalMode == "" {

			legacyregistry.MustRegister(IPTablesRulesLastSync)

		case kubeproxyconfig.ProxyModeIPVS:
			legacyregistry.MustRegister(IPTablesRestoreFailuresTotal)

		case kubeproxyconfig.ProxyModeNFTables:
			legacyregistry.MustRegister(NFTablesSyncFailuresTotal)
			legacyregistry.MustRegister(NFTablesCleanupFailuresTotal)

		case kubeproxyconfig.ProxyModeKernelspace:
			// currently no winkernel-specific metrics

		},
		"iptables is allowed": {
			mode: kubeproxyconfig.ProxyModeIPTables,
		},
		"ipvs is allowed": {
			mode: kubeproxyconfig.ProxyModeIPVS,
		},
		"nftables is allowed": {
			mode: kubeproxyconfig.ProxyModeNFTables,
		},
		"winkernel is not allowed": {
			mode:         kubeproxyconfig.ProxyModeKernelspace,

// will exit with an error.
type ProxyMode string

const (
	ProxyModeIPTables    ProxyMode = "iptables"
	ProxyModeIPVS        ProxyMode = "ipvs"
	ProxyModeNFTables    ProxyMode = "nftables"
	ProxyModeKernelspace ProxyMode = "kernelspace"
)

func (m *ProxyMode) Set(s string) error {
	*m = ProxyMode(s)
	return nil
}

func (m *ProxyMode) String() string {

// rules are exactly as expected.
func TestOverallNFTablesRules(t *testing.T) {
	nft, fp := NewFakeProxier(v1.IPv4Protocol)
	metrics.RegisterMetrics(kubeproxyconfig.ProxyModeNFTables)

	makeServiceMap(fp,
		// create ClusterIP service
		makeTestService("ns1", "svc1", func(svc *v1.Service) {
			svc.Spec.ClusterIP = "172.30.0.41"
			svc.Spec.Ports = []v1.ServicePort{{