// -t nat -A PREROUTING -p tcp -j ISTIO_PRERT
		iptablesBuilder.AppendRule(
			iptableslog.UndefinedCommand, iptablesconstants.PREROUTING, iptablesconstants.NAT,
			"-j", ChainInpodPrerouting,
		)
	}

	// From here on, we should be only inserting rules into our custom chains.

	if !ingressMode {
		// CLI: -A ISTIO_PRERT -m mark --mark 0x539/0xfff -j CONNMARK --set-xmark 0x111/0xfff
		//