10.244.0.175:15014                               HEALTHY                  outbound|15014||istiod.istio-system.svc.cluster.local
10.244.0.8:53                                    HEALTHY                  outbound|53||kube-dns.kube-system.svc.cluster.local
10.244.0.3:53                                    HEALTHY                  outbound|53||kube-dns.kube-system.svc.cluster.local

iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT
iptables -t nat -A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -j ACCEPT

iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT
iptables -t nat -A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -j ACCEPT

-A ISTIO_OUTPUT -p tcp --dport 53 -j REDIRECT --to-ports 15053
-A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN
-A ISTIO_OUTPUT -j ISTIO_REDIRECT
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -j REDIRECT --to-port 15053
COMMIT
* raw
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1

    loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|53||kube-dns.kube-system.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.8
            portValue: 53
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
      metadata:

      "name": "kube-dns",
      "namespace": "kube-system",
      "hostname": "kube-dns.kube-system.svc.cluster.local",
      "vips": [
        "/10.96.0.10"
      ],
      "ports": {
        "53": 53,
        "9153": 9153
      },
      "endpoints": {
        "Kubernetes//Pod/kube-system/coredns-5dd5756b68-mgjn9:/10.244.0.2": {
          "workloadUid": "Kubernetes//Pod/kube-system/coredns-5dd5756b68-mgjn9",

                ],
                "loadBalancingWeight": 1
            }
        ],
        "policy": {
            "overprovisioningFactor": 140
        }
    },
    {
        "clusterName": "outbound|53||kube-dns.kube-system.svc.cluster.local",
        "endpoints": [
            {
                "locality": {},
                "lbEndpoints": [
                    {
                        "endpoint": {

	// CLI: -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
	//
	// DESC: If this is a UDP DNS request to a non-localhost resolver, send it to ztunnel DNS proxy port
	if redirectDNS {
		iptablesBuilder.AppendRule(
			iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
			"!", "-o", "lo",
			"-p", "udp",
			"-m", "udp",
			"--dport", "53",
			"-j", "REDIRECT",

endif
VERSION := $(VERSION_FROM_FILE)-dev
endif

export VERSION

# Base version of Istio image to use
BASE_VERSION ?= master-2024-05-08T18-51-53
ISTIO_BASE_REGISTRY ?= gcr.io/istio-release

export GO111MODULE ?= on
export GOPROXY ?= https://proxy.golang.org
export GOSUMDB ?= sum.golang.org

# If GOPATH is not set by the env, set it to a sane value

     }
    },
    {
     "name": "10.96.0.10_53",
     "active_state": {
      "version_info": "2023-06-20T09:07:41Z/3",
      "listener": {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
       "name": "10.96.0.10_53",
       "address": {
        "socket_address": {
         "address": "10.96.0.10",
         "port_value": 53
        }
       },
       "filter_chains": [