!c.HasWorkloadAddressedWaypointProxy() &&
		!c.ZTunnelCaptured() &&
		!c.DualStack
}

// WaypointClient means the client supports HBONE and does zTunnel redirection.
// Currently, only zTunnel captured sources do this. Eventually this might be enabled
// for ingress and/or sidecars.
func (c Config) WaypointClient() bool {
	return c.ZTunnelCaptured() && !c.IsUncaptured()
}

		reachableWaypoints(from)).
		GetMatches(to)
}

// reachableWaypoints removes waypointed targets when the client doesn't
func reachableWaypoints(from echo.Instance) match.Matcher {
	if from.Config().WaypointClient() {
		return match.Any
	}
	return match.NotWaypoint
}

// reachableHeadlessDestinations filters out headless services that aren't in the same cluster

			// Sidecars lose the original src
			opt.Check = check.And(opt.Check, OriginalSourceCheck(t, src))
		}

		// Non-HBONE clients will attempt to bypass the waypoint
		if !src.Config().WaypointClient() && dst.Config().HasAnyWaypointProxy() && !src.Config().HasSidecar() {
			// TODO currently leads to no L7 processing, in the future it might be denied
			// opt.Check = check.Error()
			opt.Check = tcpValidator
		}