iptables -t nat -N ISTIO_IN_REDIRECT
iptables -t nat -N ISTIO_OUTPUT
iptables -t raw -N ISTIO_OUTPUT
iptables -t nat -A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
iptables -t nat -A OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -A ISTIO_OUTPUT -o lo -s 127.0.0.6/32 -j RETURN

  namespace: ambient
spec:
  ports:
  - appProtocol: tcp
    name: status-port
    port: 15021
    protocol: TCP
    targetPort: 15021
  - appProtocol: hbone
    name: mesh
    port: 15008
    protocol: TCP
    targetPort: 15008
  selector:
    gateway.networking.k8s.io/gateway-name: reviews
  sessionAffinity: None
  type: ClusterIP
---
# managed gateway, should not generate warning
apiVersion: v1
kind: Service

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: stable
  name: bookinfo-details
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

iptables -t nat -A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
iptables -t mangle -A ISTIO_DIVERT -j MARK --set-mark 1337
iptables -t mangle -A ISTIO_DIVERT -j ACCEPT
iptables -t mangle -A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006

  * It is critical that this path preserves the Service IP, if the traffic was to a Service.
* All traffic *ingressing* a pod on port 15008 in the mesh is assumed to be HBONE, and should be redirected to the node-local ztunnel on port 15008 (more on this later).
* All other traffic *ingressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15006, regardless of intended original destination port.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: only-hbone
spec:
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: rapid
  name: bookinfo-reviews
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

{
  "workloads": {
    "network1/10.244.2.54": {
      "workloadIps": [
        "10.244.2.54"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",
        "port": 15008
      },
      "protocol": "HBONE",
      "uid": "Kubernetes//Pod/bookinfo/ratings-v1-6484c4d9bb-mdxm5",
      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",

    reason: AddressNotUsable
    status: "False"
    type: Programmed
  listeners:
  - attachedRoutes: 0
    conditions:
    - lastTransitionTime: fake
      message: Expected a single listener on port 15008 with protocol "HBONE"
      reason: UnsupportedProtocol
      status: "False"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"

    kind: Gateway
    name: namespace
    uid: ""
spec:
  ports:
  - appProtocol: tcp
    name: status-port
    port: 15021
    protocol: TCP
  - appProtocol: all
    name: mesh
    port: 15008
    protocol: TCP
  selector:
    gateway.networking.k8s.io/gateway-name: namespace
  type: ClusterIP