i can also see after the reboot, all of those

REJECT

rules on the

KUBE-SERVICES

chain have disappeared. k3s must add those automatically when theres no route to a service from that box