It seems like we're missing this kind of stuff lately. Even the April 1st hacks have failed to be interesting on the same level. I wonder what has happened and why.
# netstat $(hostname) 40443
Trying 10.X.X.X
Connected to hostname.foo.bar
Escape character is '^]'
...
# ss -tpln | grep 40443
#
# lsof -i :40443
#
No, seriously, there is no L7 reverse proxy implemented using kube-proxy mechanism (aforementioned DNAT) - It's L4 proxy for supporting legacy code that doesn't support intelligently querying for endpoints (by SRV record, k8s API, or other service discovery protocol).
It's not even required to use it, Services can be declared to not need it (common example is using service mesh or ingress controller with http)
nginx-ingress will read Service Endpoints through k8s API and resolve connections to specific pod IPs so long as your network is properly deployed.
Of course it's also possible to make it go through serviceIP (which by default is still implemented using DNAT in kube-proxy), but it's not recommended.
NodePorts like the example given earlier exist for dealing with external traffic from hosts unaware of (possibly unroutable) serviceIP and podIP ranges.
I had lots of !FUN! with nginx-ingress, but that's not one of its faults.