Network Policy not applied to OpenVPN Container?

General Discussions
1 
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8

This is a snippet from a network policy applied to a namespace, which contains an OpenVPN deployment.

The container has the NET_ADMIN capability available.

For the OpenVPN setup to work, an iptables rule is created inside the container (not on the node), which looks like the following.

iptables -t nat -A POSTROUTING -s 10.95.0.0/255.255.0.0 -o eth0 -j MASQUERADE

Now, the NetworkPolicy works as expected on everything, all deployments and containers, as necessary, however the OpenVPN server is reachable through the internet and can communicate with clients over IPs like 10.95.0.9.

How can the OpenVPN server communicate through that IP, when a range including this IP is explicitly blocked for access by a NetworkPolicy applied to the namespace containing the Deployment with the OpenVPN Container?

2

The MASQUERADE changes the IP address of the packets to a benign internal Kubernetes IP address, which is not caught by the except block in the NetworkPolicy.