the cluster is built on Aliyun VPC. The computer enters the intranet by connecting to the openvpn located above the gateway (172.16.10.1).

k8s (calico) cluster is on the same network segment, and the ip of the machine can be accessed

now I think other machines in the intranet can access the services in K8s through 10.42.x.x ip, and there is no problem on the nodes of K8s cluster. But there is no way to do it on other machines (add the following iptable rules)

on the gateway node iptables-t nat-A POSTROUTING-d 10.42.0.0 SNAT 16-j SNAT-- to 172.16.10.21 where 172.16.10.21 is the ip. of a node iptables-t nat-A PREROUTING-d 10.42.0.0 to 16-j DNAT-- to 172.16.10.21 has also tried not to.

then iptables-t nat-A POSTROUTING-s 172.16.10 on the node 24-j MASQUERADE

I don"t know which step is wrong?