// Single number. Some parsers accept this as an IPv4 address in
		// big-endian uint32 form, but we don't.
		"1234",
		// IPv4 with a zone specifier
		"1.2.3.4%eth0",
		// IPv4 field must have at least one digit
		".1.2.3",
		"1.2.3.",
		"1..2.3",
		// IPv4 address too long
		"1.2.3.4.5",
		// IPv4 in dotted octal form
		"0300.0250.0214.0377",
		// IPv4 in dotted hex form
		"0xc0.0xa8.0x8c.0xff",

	}{
		{
			name: "internal k8s service with ipv4 & ipv6 endpoint for Kubernetes TCP protocol",
			instances: []*model.ServiceInstance{
				buildServiceInstance(svc, "10.10.10.10"),
				buildServiceInstance(svc, "fd00:10:244:1::11"),
			},
			services:    []*model.Service{svc},
			listenersOn: "0.0.0.0_9999",
		},
		{
			name: "external service with ipv4 & ipv6 endpoints for Kubernetes auto protocol",

  // Defines which IP family to use for single stack or the order of IP families for dual-stack.
  // Valid list items are "IPv4", "IPv6".
  // More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
  repeated string ipFamilies = 29;

  // Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
  // are PreferDualStack, RequireDualStack, and SingleStack.

	// performance over iptables debuggability
	largeClusterEndpointsThreshold = 1000
)

const sysctlRouteLocalnet = "net/ipv4/conf/all/route_localnet"
const sysctlNFConntrackTCPBeLiberal = "net/netfilter/nf_conntrack_tcp_be_liberal"

// NewDualStackProxier creates a MetaProxier instance, with IPv4 and IPv6 proxies.
func NewDualStackProxier(
	ctx context.Context,
	ipt [2]utiliptables.Interface,
	sysctl utilsysctl.Interface,

) (proxy.Provider, error) {
	// Create an ipv4 instance of the single-stack proxier
	ipv4Proxier, err := NewProxier(ctx, v1.IPv4Protocol,
		syncPeriod, minSyncPeriod, masqueradeAll, masqueradeBit,
		localDetectors[v1.IPv4Protocol], hostname, nodeIPs[v1.IPv4Protocol],
		recorder, healthzServer, nodePortAddresses, initOnly)
	if err != nil {
		return nil, fmt.Errorf("unable to create ipv4 proxier: %v", err)
	}

  Try {
    Get-NetRoute `
        -ErrorAction "Stop" `
        -AddressFamily IPv4 `
        -DestinationPrefix ${GCE_METADATA_SERVER}/32 | Out-Null
  } Catch [Microsoft.PowerShell.Cmdletization.Cim.CimJobException] {
    Log-Output -Fatal `
        ("GCE metadata server route is not present as expected.`n" +
         "$(Get-NetRoute -AddressFamily IPv4 | Out-String)")
  }
}

      }
    spec:
      securityContext:
      {{- if .Values.gateways.securityContext }}
        {{- toYaml .Values.gateways.securityContext | nindent 4 }}
      {{- else }}
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      containers:
      - name: istio-proxy
      {{- if contains "/" .Values.global.proxy.image }}

      }
    spec:
      securityContext:
      {{- if .Values.gateways.securityContext }}
        {{- toYaml .Values.gateways.securityContext | nindent 4 }}
      {{- else }}
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      containers:
      - name: istio-proxy
      {{- if contains "/" .Values.global.proxy.image }}

      }
    spec:
      securityContext:
      {{- if .Values.gateways.securityContext }}
        {{- toYaml .Values.gateways.securityContext | nindent 4 }}
      {{- else }}
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      containers:
      - name: istio-proxy
      {{- if contains "/" .Values.global.proxy.image }}

      }
    spec:
      securityContext:
      {{- if .Values.gateways.securityContext }}
        {{- toYaml .Values.gateways.securityContext | nindent 4 }}
      {{- else }}
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      containers:
      - name: istio-proxy
      {{- if contains "/" .Values.global.proxy.image }}