iptables -t nat -A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
iptables -t mangle -A ISTIO_DIVERT -j MARK --set-mark 1337
iptables -t mangle -A ISTIO_DIVERT -j ACCEPT
iptables -t mangle -A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: only-hbone
spec:
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: namespace
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008
    protocol: HBONE
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: invalid
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 1234

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: rapid
  name: bookinfo-reviews
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 22 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN

ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

	VirtualInboundCatchAllHTTPFilterChainName = "virtualInbound-catchall-http"
)

const (

	// HBoneInboundListenPort is the port on which incoming HBone traffic will be captured.
	HBoneInboundListenPort = 15008

    reason: AddressNotUsable
    status: "False"
    type: Programmed
  listeners:
  - attachedRoutes: 0
    conditions:
    - lastTransitionTime: fake
      message: Expected a single listener on port 15008 with protocol "HBONE"
      reason: UnsupportedProtocol
      status: "False"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"

    kind: Gateway
    name: namespace
    uid: ""
spec:
  ports:
  - appProtocol: tcp
    name: status-port
    port: 15021
    protocol: TCP
  - appProtocol: all
    name: mesh
    port: 15008
    protocol: TCP
  selector:
    gateway.networking.k8s.io/gateway-name: namespace
  type: ClusterIP

    kind: Gateway
    name: namespace
    uid: ""
spec:
  ports:
  - appProtocol: tcp
    name: status-port
    port: 15021
    protocol: TCP
  - appProtocol: all
    name: mesh
    port: 15008
    protocol: TCP
  selector:
    gateway.networking.k8s.io/gateway-name: namespace
  type: ClusterIP