code: func iptablesCommonPortalArgs(destIP net.IP, addPhysicalInterfaceMatch bool, addDstLocalMatch bool, destPort int, protocol v1.Protocol, service proxy.ServicePortName) []string {
  	// This list needs to include all fields as they are eventually spit out
  	// by iptables-save.  This is because some systems do not support the
  	// 'iptables -C' arg, and so fall back on parsing iptables-save output.
  	// If this does not match, it will not pass the check.  For example:
  	// adding the /32 on the destination IP arg is not strictly required,
  	// but causes this list to not match the final iptables-save output.
  	// This is fragile and I hope one day we can stop supporting such old
  	// iptables versions.
  	args := []string{
  		"-m", "comment",
  		"--comment", service.String(),
  		"-p", strings.ToLower(string(protocol)),
  		"-m", strings.ToLower(string(protocol)),
  		"--dport", fmt.Sprintf("%d", destPort),
  	}
  
  	if destIP != nil {
  		args = append(args, "-d", utilproxy.ToCIDR(destIP))
  	}
  
  	if addPhysicalInterfaceMatch {
  		args = append(args, "-m", "physdev", "!", "--physdev-is-in")
  	}
  
  	if addDstLocalMatch {
  		args = append(args, "-m", "addrtype", "--dst-type", "LOCAL")
  	}
  
  	return args
  }
docs: // Build a slice of iptables args that are common to from-container and from-host portal rules.