I've merged this question with k8s: forwarding from public VIP to clusterIP with iptables and this one can be closed.