see my prior comment - your technical understanding for Calico (host+iptables+bridge) is incorrect