"typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",
                              "prefix_len": 32
                            }
                          ],

                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.104.171.68",
                              "prefix_len": 32
                            }
                          ],

| HOST_PROBE_SNAT_IPV6 | "fd16:9254:7127:1337:ffff:ffff:ffff:ffff" | IPv6 link local ranges are designed to be collision-resistant by default, and so this probably never needs to be overridden |

## Sidecar Mode Implementation Details

      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
      # be allowed by the sidecar
      includeIPRanges: "*"
      excludeIPRanges: ""
      includeOutboundPorts: ""
      excludeOutboundPorts: ""

		switch tc.TypeUrl {
		case IPMatcher:
			ip := protoconv.SilentlyUnmarshalAny[matcher.IPMatcher](tc)
			m = map[string]*matcher.Matcher_OnMatch{}
			for _, rm := range ip.GetRangeMatchers() {
				for _, r := range rm.Ranges {
					cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:

            "cluster": "BlackHoleCluster"
           }
          }
         ],
         "name": "virtualInbound-blackhole"
        },
        {
         "filter_chain_match": {
          "prefix_ranges": [
           {
            "address_prefix": "0.0.0.0",
            "prefix_len": 0
           }
          ],
          "transport_protocol": "tls",
          "application_protocols": [

includeInboundPorts: "*" # istio egress capture allowlist # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16" # would only capture egress traffic on those two IP Ranges, all other outbound traffic would # be allowed by the sidecar includeIPRanges: "*" excludeIPRanges: "" includeOutboundPorts: "" excludeOutboundPorts: "" # Log level for proxy, applies to gateways and sidecars. # Expected values are: trace|debug|i...

            description: IPAddressPoolSpec defines the desired state of IPAddressPool.
            properties:
              addresses:
                description: A list of IP address ranges over which MetalLB has authority.
                  You can list multiple ranges in a single pool, they will all share
                  the same settings. Each range can be either a CIDR prefix, or an
                  explicit start-end range of IPs.

message NodeSpec {
  // PodCIDR represents the pod IP range assigned to the node.
  // +optional
  optional string podCIDR = 1;

  // podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this
  // field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for
  // each of IPv4 and IPv6.
  // +optional

                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",
                              "prefix_len": 32
                            }
                          ],