Bridge to Netfilter / IPTables

[jhunt]

Ran into this issue this morning, with a tinynetes: coredns/coredns#1879 and kubernetes/kubernetes#21613.

We were in fact bypassing netfilter for bridged traffic, causing our DNS responses to come directly from the pod IP, and not get mangled to "originate" from the service IP for DNS.

Fixed it with the following:

# modprobe br_netfilter

Afterwards, the sysctl were set (automagically):

k8s/08ea6ac6-9e85-44d6-81be-0dc94c73ddd7:~# sysctl -a | grep nf-call
net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1

but we could be forgiven for manually setting those.