#
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.
  # The "TPROXY" mode preserves both the source and destination IP

nantan.kyoto.jp nanto.toyama.jp nanyo.yamagata.jp naoshima.kagawa.jp naples.it napoli.it nara.jp nara.nara.jp narashino.chiba.jp narita.chiba.jp naroy.no narusawa.yamanashi.jp naruto.tokushima.jp narviika.no narvik.no nasu.tochigi.jp nasushiobara.tochigi.jp nat.tn natal.br national.museum nationalfirearms.museum nationalheritage.museum nativeamerican.museum natori.miyagi.jp natura natural.bo naturalhistory.museum naturalhistorymuseum.museum naturalsciences.museum naturbruksgymn.se nature.museum naturhistorisches.museum...

              - ALL
              add:
              # CAP_NET_ADMIN is required to allow ipset and route table access
              - NET_ADMIN
              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.