code: func (e *podEnv) setupForwarding() error {
  	ipt, err := iptables.New()
  	if err != nil {
  		return err
  	}
  
  	// Create a separate chain for this pod. This helps with debugging
  	// and makes it easier to cleanup
  	chainDNAT := e.portFwdChain("DNAT")
  	chainSNAT := e.portFwdChain("SNAT")
  
  	if err = ipt.NewChain("nat", chainDNAT); err != nil {
  		return err
  	}
  
  	if err = ipt.NewChain("nat", chainSNAT); err != nil {
  		return err
  	}
  
  	chainRuleDNAT := e.portFwdChainRuleSpec(chainDNAT, "DNAT")
  	chainRuleSNAT := e.portFwdChainRuleSpec(chainSNAT, "SNAT")
  
  	for _, entry := range []struct {
  		chain           string
  		customChainRule []string
  	}{
  		{"POSTROUTING", chainRuleSNAT}, // traffic originating from this host from loopback
  		{"PREROUTING", chainRuleDNAT},  // outside traffic hitting this host
  		{"OUTPUT", chainRuleDNAT},      // traffic originating from this host on non-loopback
  	} {
  		exists, err := ipt.Exists("nat", entry.chain, entry.customChainRule...)
  		if err != nil {
  			return err
  		}
  		if !exists {
  			err = ipt.Insert("nat", entry.chain, 1, entry.customChainRule...)
  			if err != nil {
  				return err
  			}
  		}
  	}
  	return nil
  }
docs: // setupForwarding creates the iptables chains