"-d", hostProbeSNAT.String(),
		"-p", "tcp",
		"-m", "tcp",
		"-j", "ACCEPT",
	)

	// prevent intercept traffic from app ==> app by pod ip
	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
		"!", "-d", iptablesconstants.IPVersionSpecific, // ignore traffic to localhost ip, as this rule means to catch traffic to pod ip.

  // This field cannot be empty for new Events and it can have at most 128 characters.
  // +optional
  optional string reportingInstance = 5;

  // action is what action was taken/failed regarding to the regarding object. It is machine-readable.
  // This field can have at most 128 characters.
  // +optional
  optional string action = 6;

                  IPv4 addresses.
                format: int32
                minimum: 1
                type: integer
              aggregationLengthV6:
                default: 128
                description: The aggregation-length advertisement option lets you
                  “roll up” the /128s into a larger prefix. Defaults to 128. Works
                  for IPv6 addresses.

ip6tables -t mangle -A ISTIO_PRERT ! -d ::1/128 -p tcp -i lo -j ACCEPT
ip6tables -t mangle -A ISTIO_PRERT -p tcp -m tcp --dport 15008 -m mark ! --mark 0x539/0xfff -j TPROXY --on-port 15008 --tproxy-mark 0x111/0xfff
ip6tables -t mangle -A ISTIO_PRERT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

  // This field cannot be empty for new Events and it can have at most 128 characters.
  optional string reportingInstance = 5;

  // action is what action was taken/failed regarding to the regarding object. It is machine-readable.
  // This field cannot be empty for new Events and it can have at most 128 characters.
  optional string action = 6;

  // reason is why the action was taken. It is human-readable.

  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: "{{.Name}}"
    uid: "{{.UID}}"
  {{- end }}

  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: "{{.Name}}"
    uid: "{{.UID}}"
  {{- end }}

  // +optional
  optional string name = 1;

  // UnsuitableNodes lists nodes that the ResourceClaim cannot be
  // allocated for.
  //
  // The size of this field is limited to 128, the same as for
  // PodSchedulingSpec.PotentialNodes. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional
  repeated string unsuitableNodes = 2;
}

    # already to other services), then pick the next 100.
    python3 - <<EOF
from ipaddress import ip_network, IPv6Network;
from itertools import islice;

net = ip_network('$CIDR')
net_bits = 128 if type(net) == IPv6Network else 32;
net_len = pow(2, net_bits - net.prefixlen)
start, end = int(net_len / 4 * 3), net_len
if net_len > 2000:
  start, end = 1000, 2000

			m = map[string]*matcher.Matcher_OnMatch{}
			for _, rm := range ip.GetRangeMatchers() {
				for _, r := range rm.Ranges {
					cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:
			panic("unhandled")
		}
	}
	outputs := []string{}
	for k, v := range m {