# Huge number of iptables rules in k3s cluster

**URL:** <https://forum.ansible.com/t/huge-number-of-iptables-rules-in-k3s-cluster/38531>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [October 18, 2023, 5:11pm UTC](https://forum.ansible.com/t/huge-number-of-iptables-rules-in-k3s-cluster/38531 "2023-10-18T17:11:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjksohonet](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mjksohonet/32/1217_2.png) [@mjksohonet](https://forum.ansible.com/u/mjksohonet)\
**Post date:** [October 18, 2023, 5:11pm UTC](https://forum.ansible.com/t/huge-number-of-iptables-rules-in-k3s-cluster/38531/1 "2023-10-18T17:11:46Z")

</div>

Hi all,  
I don’t know if this is an awx issue or a k3s issue or some combination of both.  
Several months ago I created a couple of single node k3s clusters using [https://github.com/kurokobo/awx-on-k3s](https://github.com/kurokobo/awx-on-k3s) each with 4 vCPUs.  
What I’ve noticed over time is that some of the iptables rules are being duplicated over and over again.  
For example  
_~# iptables -L -n | sort | uniq -c | sort -k1n | tail -4_  
_# Warning: iptables-legacy tables present, use iptables-legacy to see them_  
_25 target prot opt source destination_  
_21931 RETURN udp – 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL multiport dports 30000:32767 /\* allow LOCAL UDP traffic to node ports - 76UCBPIZNGJNWNUZ \*/_  
_21932 RETURN tcp – 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL multiport dports 30000:32767 /\* allow LOCAL TCP traffic to node ports - LR7XO7NXDBGQJD2M \*/_  
_65790 ACCEPT all – 0.0.0.0/0 0.0.0.0/0 mark match 0x20000/0x20000 /\* rule to explicitly ACCEPT traffic that comply to network policies \*/_

When I run top, I can see 4 iptables consuming most of the CPU resource.  
The net effect of this is that some awx jobs fail with timeout errors.  
Stopping the k3s service, running k3s-killall.sh and starting the k3s service resolves the issue, for a while.

Any ideas about what’s happening here.

---

<div class="post-metadata">

**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\
**Post date:** [October 18, 2023, 6:21pm UTC](https://forum.ansible.com/t/huge-number-of-iptables-rules-in-k3s-cluster/38531/2 "2023-10-18T18:21:11Z")

</div>

Yes I have encountered this with system resources with k3s?. Do you have the normal iptables installed?

[https://github.com/k3s-io/k3s/issues/3117](https://github.com/k3s-io/k3s/issues/3117)