hmm, on the KUBE-SERVICES chain, there are reject rules for everything. e.g.,

REJECT     tcp  --  anywhere             10.43.140.245        /* vault/vault:https has no endpoints */ tcp dpt:8200 reject-with icmp-port-unreachable