Comment by moosingin3space

This depends on the CNI plugin you're using. In particular, Cilium implements the entire firewall in eBPF.