tunnelingEnabled := &networking.DestinationRule{
		Host: "tunnel-proxy.com",
		TrafficPolicy: &networking.TrafficPolicy{
			Tunnel: &networking.TrafficPolicy_TunnelSettings{
				Protocol:   "CONNECT",
				TargetHost: "example.com",
				TargetPort: 8443,
			},
		},
	}
	tunnelingEnabledWithoutProtocol := &networking.DestinationRule{
		Host: "tunnel-proxy.com",
		TrafficPolicy: &networking.TrafficPolicy{

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tunnel-outbound-traffic-to-external-svc-via-external-forward-proxy
spec:
  host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
  subsets:
  - name: external-svc-tcp
    trafficPolicy:
      tunnel:
        targetHost: external.{{ .externalNamespace }}
        targetPort: {{ .externalSvcTcpPort }}
  - name: external-svc-tls
    trafficPolicy:

```mermaid
graph TD;
src[src pod]-->|plaintext port|ztunnel{"ztunnel (L4 policy applied here)"}
ztunnel{ztunnel}-->|TLS|wp{waypoint}
wp-->|mTLS|ztunnel
ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for tunneling outbound traffic via external HTTP forward proxies using HTTP CONNECT or POST methods.

        proxyServer.configureProxyHost(executer, "https")
        module.allowAll()

        then:
        succeeds('listJars')

        and:
        proxyServer.requestCount == (tunnel ? 1 : 2)
    }

    def "can resolve from repo with other proxy scheme configured"() {
        given:
        proxyServer.start()
        setupServer()

        and:
        buildFile << """

	ti.name = fmt.Sprintf("gotest%d", suffix)
	xname, err := exec.LookPath("ip")
	if err != nil {
		return err
	}
	ti.setupCmds = append(ti.setupCmds, &exec.Cmd{
		Path: xname,
		Args: []string{"ip", "tunnel", "add", ti.name, "mode", "gre", "local", ti.local, "remote", ti.remote},
	})
	ti.setupCmds = append(ti.setupCmds, &exec.Cmd{
		Path: xname,
		Args: []string{"ip", "address", "add", ti.local, "peer", ti.remote, "dev", ti.name},

		mergedPolicy.LoadBalancer = subsetPolicy.LoadBalancer
	}
	if subsetPolicy.Tls != nil || hasPortLevel {
		mergedPolicy.Tls = subsetPolicy.Tls
	}

	if subsetPolicy.Tunnel != nil {
		mergedPolicy.Tunnel = subsetPolicy.Tunnel
	}
	if subsetPolicy.ProxyProtocol != nil {
		mergedPolicy.ProxyProtocol = subsetPolicy.ProxyProtocol
	}
	return mergedPolicy
}

	return tunnelHTTPConnect(t.conn, t.proxyAddress, addr)
}

var _ proxier = &grpcProxier{}

type grpcProxier struct {
	tunnel client.Tunnel
}

func (g *grpcProxier) proxy(ctx context.Context, addr string) (net.Conn, error) {
	return g.tunnel.DialContext(ctx, "tcp", addr)
}

type proxyServerConnector interface {
	// connect establishes connection to the proxy server, and returns a

	if !mtlsEnabled {
		meta.TLSMode = ""
	}
	util.AppendLbEndpointMetadata(meta, ep.Metadata)

	tunnel := supportTunnel(b, e)
	if mtlsEnabled && !features.PreferHBONESend {
		tunnel = false
	}
	if b.proxy.Metadata.DisableHBONESend {
		tunnel = false
	}
	if tunnel {
		address, port := e.Address, int(e.EndpointPort)
		// We intentionally do not take into account waypoints here.

// the output streams of a WebSocket connection (e.g. STDIN, STDOUT,
// STDERR, TTY resize, and error streams) to the input streams of a
// SPDY connection.
//
// The stream tunnel proxy tunnels SPDY frames through a WebSocket
// connection, and it is used for the PortForward subprotocol (e.g.
// kubectl port-forward). This proxy implements tunneling by transparently