config      func(cfg *Config)
		ingressMode bool
	}{
		{
			name: "default",
			config: func(cfg *Config) {
				cfg.RedirectDNS = true
			},
		},
		{
			name: "tproxy",
			config: func(cfg *Config) {
				cfg.TPROXYRedirection = true
				cfg.RedirectDNS = true
			},
		},
		{
			name: "ingress",
			config: func(cfg *Config) {
			},
			ingressMode: true,
		},
	}

	// We use the SidecarTrafficExcludeInboundPorts annotation for compatibility (its somewhat widely used) but don't support all values.
	ingressMode := false
	if a, f := pod.Annotations[annotation.AmbientBypassInboundCapture.Name]; f {
		var err error
		ingressMode, err = strconv.ParseBool(a)
		if err != nil {
			log.Warnf("annotation %v=%q found, but only '*' is supported", annotation.AmbientBypassInboundCapture.Name, a)