- orRules:
                rules:
                - destinationPort: 80
        principals:
        - andIds:
            ids:
            - any: true
      ns[foo]-policy[httpbin-deny]-rule[5]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 8080
        principals:
        - andIds:
            ids:

                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[2]
            - orRules:
                rules:
                - destinationPort: 9001
                - destinationPort: 9002
            - orRules:
                rules:
                - destinationIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32

                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[2]
            - orRules:
                rules:
                - destinationPort: 9001
                - destinationPort: 9002
            - orRules:
                rules:
                - destinationIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32

            - orRules:
                rules:
                - destinationPort: 80
                - destinationPort: 90
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 8000
                  - destinationPort: 9000
            - orRules:
                rules:
                - destinationIp:

            - orRules:
                rules:
                - destinationPort: 80
                - destinationPort: 90
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 8000
                  - destinationPort: 9000
            - orRules:
                rules:
                - destinationIp:

				return false
			}
		}
	}

	// check match for destination port within the FilterChainMatch
	if match.DestinationPort > 0 {
		if fc.FilterChainMatch == nil || fc.FilterChainMatch.DestinationPort == nil {
			return false
		} else if fc.FilterChainMatch.DestinationPort.Value != match.DestinationPort {
			return false
		}
	}
	return true
}

				break
			}
		}
		if !found {
			descrs = append(descrs, fmt.Sprintf("App: %s", strings.Join(match.ApplicationProtocols, ",")))
		}
	}

	port := ""
	if match.DestinationPort != nil {
		port = fmt.Sprintf(":%d", match.DestinationPort.GetValue())
	}
	if len(match.PrefixRanges) > 0 {
		pf := []string{}
		for _, p := range match.PrefixRanges {

				Chain:           iptables.Chain("KUBE-NODEPORTS"),
				Comment:         &IPTablesValue{Value: "ns2/svc2:p80 health check node port"},
				Protocol:        &IPTablesValue{Value: "tcp"},
				DestinationPort: &IPTablesValue{Value: "30000"},
				Jump:            &IPTablesValue{Value: "ACCEPT"},
			},
		},
		{
			name: "addRuleToChainRegex requires an actual rule, not just a chain name",
			rule: `-A KUBE-NODEPORTS`,

          addressPrefix: 1.2.3.4
          prefixLen: 32`),
		},
		{
			name:  "destPortGenerator",
			g:     destPortGenerator{},
			value: "80",
			want: yamlPermission(t, `
         destinationPort: 80`),
		},
		{
			name:  "connSNIGenerator",
			g:     connSNIGenerator{},
			value: "exact.com",
			want: yamlPermission(t, `
         requestedServerName:
          exact: exact.com`),
		},

	SourcePort    *IPTablesValue `param:"--sport" negatable:"true"`

	DestinationAddress *IPTablesValue `param:"-d" negatable:"true"`
	DestinationType    *IPTablesValue `param:"--dst-type" negatable:"true"`
	DestinationPort    *IPTablesValue `param:"--dport" negatable:"true"`

	MatchSet *IPTablesValue `param:"--match-set" negatable:"true"`

	Jump            *IPTablesValue `param:"-j"`