----NodeA首次上行-------
-A PREROUTING -j ztunnel-PREROUTING
-A ztunnel-PREROUTING -p tcp -m set --match-set ztunnel-pods-ips src -j MARK --set-xmark 0x100/0x100
-A ztunnel-PREROUTING -m mark --mark 0x100/0x100 -j ACCEPT
from all fwmark 0x100/0x100 lookup 101
101 路由表：default via 192.168.127.2 dev istioout
----ztunnelA首次上行-------
-A PREROUTING -i pistioout -p tcp -j TPROXY --on-port 15001 --on-ip 127.0.0.1 --tproxy-mark 0x400/0xfff
from all fwmark 0x400/0xfff lookup 100
100 路由表local default dev lo scope host
----NodeA回程-------
-A ztunnel-PREROUTING ! -s 10.244.2.3/32 -i veth51e3b96d -j MARK --set-xmark 0x210/0x210
from all fwmark 0x200/0x200 goto 32766
32766: from all lookup main
main 路由表10.244.2.8 dev vethbda3de4b scope host
由于该数据包的目标地址并非本机，所以将再执行 iptables FORWARD 链
-A FORWARD -j ztunnel-FORWARD
-A ztunnel-FORWARD -m mark --mark 0x210/0x210 -j CONNMARK --save-mark --nfmask 0x210 --ctmask 0x210
----NodeA后续上行-------
-A ztunnel-PREROUTING ! -i veth51e3b96d -m connmark --mark 0x210/0x210 -j MARK --set-xmark 0x40/0x40
from all fwmark 0x40/0x40 lookup 102
102 路由表default via 10.244.2.3 dev veth51e3b96d onlink
----ztunnelA后续上行-------
-A PREROUTING ! -d 10.244.2.3/32 -i eth0 -p tcp -j MARK --set-xmark 0x4d3/0xfff
from all fwmark 0x4d3/0xfff lookup 100
100 路由表local default dev lo scope host
带 CONN 的是连接的标记，不带的是标记数据包的；
--save-mark 是把数据包中的 mark 设置到连接中；
--restore-mark 是把连接中的 mark 设置到数据包中。
----NodeA到 NodeB-------
main 路由表10.244.1.0/24 via 172.18.0.4 dev eth0
---- NodeB首个上行-------
from all lookup 100
100 路由表10.244.1.7 via 192.168.126.2 dev istioin src 10.244.1.1
----ztunnel-B首个上行-------
A PREROUTING -i pistioin -p tcp -m tcp --dport 15008 -j TPROXY --on-port 15008 --on-ip 127.0.0.1 --tproxy-mark 0x400/0xfff
from all fwmark 0x400/0xfff lookup 100
100 路由表local default dev lo scope host
---- NodeB下行-------
-A ztunnel-PREROUTING ! -s 10.244.2.3/32 -i veth51e3b96d -j MARK --set-xmark 0x210/0x210
from all fwmark 0x200/0x200 goto 3276632766: from all lookup main10.244.2.0/24 via 172.18.0.3 dev eth0-A ztunnel-FORWARD -m mark --mark 0x210/0x210 -j CONNMARK --save-mark --nfmask 0x210 --ctmask 0x210----ztunnel-B后续上行-------
A ztunnel-PREROUTING ! -i vethbcda8cd4 -m connmark --mark 0x210/0x210 -j MARK --set-xmark 0x40/0x40
from all fwmark 0x40/0x40 lookup 102
default via 10.244.1.3 dev vethbcda8cd4 onlink
ztunnel-B 到 httpbin
----ztunnel-B—node-B-------
from all lookup main
main 路由表default via 10.244.1.1 dev eth0
---- node-B-------
-A ztunnel-PREROUTING ! -s 10.244.1.3/32 -i vethbcda8cd4 -j MARK --set-xmark 0x210/0x210
from all fwmark 0x200/0x200 goto 32766
from all lookup main
10.244.1.7 dev vethfc1b555e scope host
