here's the ipables on the Ingress node, https://gist.github.com/IAreKyleW00t/e31ac22e6e38af5a607782ac260d723f Rule #1 in the FORWARD chain is the fix quick tcpdump (on port 80) too, client was doing a

curl -v http://100.100.100.1/something

and dump was on the Ingress node. Also included a dump of a successful connection, after the iptable fix is applied https://gist.github.com/IAreKyleW00t/132f9020ac006010305180e2926ed2d9