"dst",
		"-j", "SNAT",
		"--to-source", hostSNATIP.String(),
	)

	// For V6 we have to use a different set and a different SNAT IP
	if cfg.cfg.EnableIPv6 {
		iptablesBuilder.AppendRuleV6(
			iptableslog.UndefinedCommand, ChainHostPostrouting, iptablesconstants.NAT,
			"-m", "owner",
			"--socket-exists",
			"-p", "tcp",
			"-m", "set",
			"--match-set", fmt.Sprintf(ipset.V6Name, ProbeIPSet),