Calico unconditionally drops VXLAN packets that are not related to Calico

I set up a Kubernetes cluster using Calico with the following configuration.

• VXLAN mode: Always
• VXLAN port: 4789 (default)
• VXLAN ID (VNI): 4096 (default)

I also configured a VXLAN tunnel with the same port number but a different VXLAN ID.

Then, Calico drops all packets for the second VXLAN tunnel, even though I am using a different VXLAN ID for it.

Expected Behavior

Calico does not interfere packets for the second VXLAN tunnel.

Current Behavior

Calico drops all packets for the second VXLAN tunnel, since Calico adds the following iptables rule.

-A cali-INPUT -p udp -m comment --comment "cali:c3JpWekSTKWcdGH0" -m comment --comment "Drop IPv4 VXLAN packets from non-whitelisted hosts" -m multiport --dports 4789 -m addrtype --dst-type LOCAL -j DROP

This rule is generated here. https://github.com/projectcalico/calico/blob/c041eec3ea3714c3a92b9f992f55af1e42a4842e/felix/rules/static.go#L243-L249

Possible Solution

Revert https://github.com/projectcalico/calico/commit/cce544613169bd84a8a06f5536abd65cdc3c7ab8 if possible. The commit was introduced to fix errors that occur when the u32 extension is used with iptables-nft.

According to this comment https://github.com/moby/moby/issues/43382#issuecomment-1143240624, iptables-nft also supports the u32 extension, when the xt_u32 kernel module is loaded. This kernel module is available by Default in Ubuntu, and available in the kernel-modules-extra package of RHEL.

If revering the commit is not possible, providing it as an optional feature is another possible solution.

Steps to Reproduce (for bugs)

1. Set up Kubernetes with Calico as described above
2. Establish a VXLAN tunnel using the ip command at a worker node
3. Send PING packets from the other end of the VXLAN tunnel

Context

Your Environment

• Calico version: v3.24.1
• Orchestrator version: Kubernetes v1.25.1
• Operating System and version: Ubuntu 20.04.3 LTS