Nat not always working about klipper-lb HOT 1 OPEN

Not sure if you have found the solution since then, but for the sake of other people in the same situation, here's an explanation.

What you describe is the expected behavior when running the app with only 1 replica scheduled on node 1.
Here is the relevant documentation: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer and https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

Basically, externalTrafficPolicy: Local indicates that traffic reaching a load balancer (i.e. node) should be sent to a pod scheduled on that same node, which as a side effect allows to preserve the client's IP.
If no pod is scheduled on that node (e.g. node 2), then it has to add a hop to another node (e.g. node 1) on which a pod is running.
And thus it has to change the IP packet's source to the load balancing node's (e.g. node 2) IP address. Otherwise, return traffic wouldn't follow that same path and would go directly to the client IP (from e.g. node 1), which would probably get dropped.

The solution is to use a DeamonSet to run one replica (pod) on each node which you expect clients to connect to.
In this scenario, you might also want to use a NodePort service instead of Klipper LB when you have control over the port number, since it can achieve the same result in most cases.

Related issue: #31

from klipper-lb.