tx.Add(&knftables.Set{
		Name:    nodePortIPsSet,
		Type:    ipvX_addr,
		Comment: ptr.To("IPs that accept NodePort traffic"),
	})
	if proxier.nodePortAddresses.MatchAll() {
		tx.Delete(&knftables.Set{
			Name: nodePortIPsSet,
		})
	} else {
		tx.Flush(&knftables.Set{
			Name: nodePortIPsSet,
		})

	}

	out := make([]*route.Route, 0, len(vs.Http))

	catchall := false
	for _, http := range vs.Http {
		if len(http.Match) == 0 {
			if r := lb.translateRoute(virtualService, http, nil, listenPort); r != nil {
				out = append(out, r)
			}
			// This is a catchall route, so we can stop processing the rest of the routes.
			break
		}
		for _, match := range http.Match {

	}
	listenertest.VerifyListener(t, l, listenertest.ListenerTest{
		FilterChains: []listenertest.FilterChainTest{
			{Name: "virtualInbound-blackhole"},
			{Name: "virtualInbound-catchall-http", Type: listenertest.MTLSHTTP},
			{Name: "virtualInbound-catchall-http", Type: listenertest.PlainHTTP},
			{Name: "virtualInbound", Type: listenertest.MTLSTCP},
			{Name: "virtualInbound", Type: listenertest.PlainTCP},

			},
			Disabled: simulation.Result{
				ClusterMatched:     "InboundPassthroughCluster",
				FilterChainMatched: "virtualInbound-catchall-http",
			},
			Permissive: simulation.Result{
				ClusterMatched:     "InboundPassthroughCluster",
				FilterChainMatched: "virtualInbound-catchall-http",
			},
			Strict: simulation.Result{
				// Plaintext to strict fails
				Error: simulation.ErrNoFilterChain,
			},
		},

	t.Helper()
	if l == nil {
		t.Fatalf("nil listener")
	}

	fc := &tcp.TcpProxy{}
	if err := getFilterConfig(xdstest.ExtractFilterChain("virtualOutbound-catchall-tcp", l).Filters[0], fc); err != nil {
		t.Fatalf("failed to get TCP Proxy config: %s", err)
	}
	if fc.AccessLog == nil {
		t.Fatal("expected access log configuration")
	}