* It is critical that this path preserves the Service IP, if the traffic was to a Service.
* All traffic *ingressing* a pod on port 15008 in the mesh is assumed to be HBONE, and should be redirected to the node-local ztunnel on port 15008 (more on this later).
* All other traffic *ingressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15006, regardless of intended original destination port.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: only-hbone
spec:
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: namespace
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008
    protocol: HBONE
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: invalid
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 1234

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: rapid
  name: bookinfo-reviews
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

{
  "workloads": {
    "network1/10.244.2.54": {
      "workloadIps": [
        "10.244.2.54"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",
        "port": 15008
      },
      "protocol": "HBONE",
      "uid": "Kubernetes//Pod/bookinfo/ratings-v1-6484c4d9bb-mdxm5",
      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",

	VirtualInboundCatchAllHTTPFilterChainName = "virtualInbound-catchall-http"
)

const (

	// HBoneInboundListenPort is the port on which incoming HBone traffic will be captured.
	HBoneInboundListenPort = 15008

    reason: AddressNotUsable
    status: "False"
    type: Programmed
  listeners:
  - attachedRoutes: 0
    conditions:
    - lastTransitionTime: fake
      message: Expected a single listener on port 15008 with protocol "HBONE"
      reason: UnsupportedProtocol
      status: "False"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"

          "typed_config": {
           "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
           "stat_prefix": "outbound|15008||httpbin-istio-waypoint.ambient.svc.cluster.local",
           "cluster": "outbound|15008||httpbin-istio-waypoint.ambient.svc.cluster.local"
          }
         }
        ]
       },
       "bind_to_port": false
      },

    kind: Gateway
    name: namespace
    uid: ""
spec:
  ports:
  - appProtocol: tcp
    name: status-port
    port: 15021
    protocol: TCP
  - appProtocol: all
    name: mesh
    port: 15008
    protocol: TCP
  selector:
    gateway.networking.k8s.io/gateway-name: namespace
  type: ClusterIP