)

	if cfg.cfg.TPROXYRedirection {
		// prevent intercept traffic from app ==> app by pod ip
		iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
			iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
			"!", "-d", iptablesconstants.IPVersionSpecific, // ignore traffic to localhost ip, as this rule means to catch traffic to pod ip.
			"-p", iptablesconstants.TCP,
			"-i", "lo",

	}
	return true
}

// PodRedirectionActive reports on whether the pod _has_ actually been configured for traffic redirection.
//
// That is, have we annotated it after successfully sending it to the node proxy and set up iptables rules.
//
// If you just want to know if the pod _should be_ configured for traffic redirection, see PodRedirectionEnabled
func PodRedirectionActive(pod *corev1.Pod) bool {

	return serverConnStats{
		internodeInputBytes:  s.getInternodeInputBytes(),  // Traffic internode received
		internodeOutputBytes: s.getInternodeOutputBytes(), // Traffic internode sent
		s3InputBytes:         s.getS3InputBytes(),         // Traffic S3 received
		s3OutputBytes:        s.getS3OutputBytes(),        // Traffic S3 sent
	}
}

// Prepare new ConnStats structure
func newConnStats() *connStats {

[Istio](https://istio.io/latest/docs/concepts/what-is-istio/) is an open platform for providing a uniform way to [integrate
microservices](https://istio.io/latest/docs/examples/microservices-istio/), manage [traffic flow](https://istio.io/latest/docs/concepts/traffic-management/) across microservices, enforce policies
and aggregate telemetry data. Istio's control plane provides an abstraction
layer over the underlying cluster management platform, such as Kubernetes.

              match:
                description: Specifies the criteria to determine which traffic is
                  passed to WasmPlugin.
                items:
                  properties:
                    mode:
                      description: |-
                        Criteria for selecting traffic by their direction.

                        Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER

- **Focus**:
  1. Configuration of Envoy proxies by Pilot.
  1. Communication between Pilot and Envoy proxies.
  1. Validation of service discovery.
  1. Testing of traffic management policies (e.g., routing, retries, timeouts).
  1. Validation of load balancing configurations.
  1. Specific `istioctl proxy-config` commands being tested: `bootstrap`, `cluster`, `endpoint`, `listener`, `route`, `all`.

### ufw

For hosts with ufw enabled (Debian based distros), you can use `ufw` command to allow traffic to specific ports. Use below command to allow access to port 9000

```sh
ufw allow 9000
```

Below command enables all incoming traffic to ports ranging from 9000 to 9010.

```sh
ufw allow 9000:9010/tcp
```

### firewall-cmd

	filter := istio_envoy_configdump.ClusterFilter{
		FQDN: host.Name(svcHost),
		Port: int(port),
		// Although we want inbound traffic, ask for outbound traffic, as the DR is
		// not associated with the inbound traffic.
		Direction: model.TrafficDirectionOutbound,
	}

	dump, err := cd.GetClusterConfigDump()
	if err != nil {
		return "", err
	}

		if trafficType != "" {
			if !validTrafficTypes.Contains(trafficType) {
				return nil, fmt.Errorf("invalid traffic type: %s. Valid options are: %v", trafficType, sets.SortedList(validTrafficTypes))
			}

			if gw.Labels == nil {
				gw.Labels = map[string]string{}
			}

		if err != nil {
			return fmt.Errorf("parse CIDR: %v", err)
		}

		netlinkRoutes := []*netlink.Route{
			// In routing table ${INBOUND_TPROXY_ROUTE_TABLE}, create a single default rule to route all traffic to
			// the loopback interface.
			// Equiv: "ip route add local 0.0.0.0/0 dev lo table 100"
			{
				Dst:       localhostDst,
				Scope:     netlink.SCOPE_HOST,
				Type:      unix.RTN_LOCAL,