// TCP starts sending keepalive probes
			_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPIDLE, 15)

			// Number of probes.
			// ~ cat /proc/sys/net/ipv4/tcp_keepalive_probes (defaults to 9, we reduce it to 5)
			_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPCNT, 5)

			// Wait time after successful probe in seconds.

iptables -t nat -A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes dst -j SNAT --to-source e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164
ip6tables -t nat -N ISTIO_POSTRT
ip6tables -t nat -A POSTROUTING -j ISTIO_POSTRT

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

      privileged: false
      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4
      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0
      # The period between readiness probes.
      readinessPeriodSeconds: 15
      # Enables or disables a startup probe.

iptables -t nat -N ISTIO_POSTRT
iptables -t nat -A POSTROUTING -j ISTIO_POSTRT

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006
	ProbeIPSet                  = "istio-inpod-probes"

      privileged: false

      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4

      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0

      # The period between readiness probes.
      readinessPeriodSeconds: 15

      # Enables or disables a startup probe.

	HostProbeSNATIP = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IP", DefaultHostProbeSNATIP, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed APIPA IP.
	//