for dstIP := range б networkpolicy.spec.podSelector ѡе Pod  IP ַ
  for srcIP := range б ingress.from.podSelector ѡе Pod  IP ַ
    for port, protocol := range ingress.ports {
      iptables -A KUBE-NWPLCY-CHAIN -s $srcIP -d $dstIP -p $protocol -m $protocol --dport $port -j ACCEPT 
    }
  }
} 









for pod := range  Node ϵ Pod {
    if pod  networkpolicy.spec.podSelector ѡе {
        iptables -A FORWARD -d $podIP -m physdev --physdev-is-bridged -j KUBE-POD-SPECIFIC-FW-CHAIN
        iptables -A FORWARD -d $podIP -j KUBE-POD-SPECIFIC-FW-CHAIN
        ...
    }
}
