switch v := match.GetOnNoMatch().GetOnMatch().(type) {
	case *matcher.Matcher_OnMatch_Action:
		if v.Action.GetName() == name {
			// TODO this only makes sense in context of a chain... do we need a way to give it context
			return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {
			return []string{"NONE"}, true
		}

	log.Info("configuring host-level iptables rules (healthchecks, etc)")

	iptablesBuilder := builder.NewIptablesRuleBuilder(ipbuildConfig(cfg.cfg))

	// For easier cleanup, insert a jump into an owned chain
	// -A POSTROUTING -p tcp -j ISTIO_POSTRT
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, iptablesconstants.POSTROUTING, iptablesconstants.NAT,
		"-j", ChainHostPostrouting,
	)