Moved default ACCEPT policy at the end of the chain

Signed-off-by: Roberto Bonafiglia <[email protected]>

pkg/controllers/netpol/network_policy_controller.go

@@ -500,11 +500,11 @@ func (npc *NetworkPolicyController) ensureExplicitAccept() {
 	// for the traffic to/from the local pod's let network policy controller be
 	// authoritative entity to ACCEPT the traffic if it complies to network policies
 	for _, filterTableRules := range npc.filterTableRules {
-		for _, chain := range defaultChains {
-			comment := "\"rule to explicitly ACCEPT traffic that comply to network policies\""
+		for mainChain, _ := range defaultChains {
+			comment := "\"KUBE-ROUTER rule to explicitly ACCEPT traffic that comply to network policies\""
 			args := []string{"-m", "comment", "--comment", comment, "-m", "mark", "--mark", "0x20000/0x20000",
-				"-j", "RETURN"}
-			utils.AppendUnique(filterTableRules, chain, args)
+				"-j", "ACCEPT"}
+			utils.AppendUnique(filterTableRules, mainChain, args)
 		}
 	}
 }