insert func(command iptableslog.Command, chain string, table string, position int, params ...string) *builder.IptablesRuleBuilder,
) {
	// Apply outbound IP inclusions.
	if rangeInclude.IsWildcard {
		// Wildcard specified. Redirect all remaining outbound traffic to Envoy.
		appendRule(iptableslog.UndefinedCommand, constants.ISTIOOUTPUT, constants.NAT, "-j", constants.ISTIOREDIRECT)

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.

	dnsProto "istio.io/istio/pkg/dns/proto"
)

// ConfigGenerator represents the interfaces to be implemented by code that generates xDS responses
type ConfigGenerator interface {
	// BuildListeners returns the list of inbound/outbound listeners for the given proxy. This is the LDS output
	// Internally, the computation will be optimized to ensure that listeners are computed only
	// once and shared across multiple invocations of this function.

	AutoOverTCP
)

// A set of pre-allocated variables related to protocol sniffing logic for
// propagating the ALPN to upstreams
var (
	// These are sniffed by the HTTP Inspector in the outbound listener
	// We need to forward these ALPNs to upstream so that the upstream can
	// properly use an HTTP or TCP listener
	plaintextHTTPALPNs = func() []string {
		if features.HTTP10 {

		}
	} else {
		// Note that in the PERMISSIVE mode, we match filter chain on "istio" ALPN,
		// which is used to differentiate between service mesh and legacy traffic.
		//
		// Client sidecar outbound cluster's TLSContext.ALPN must include "istio".
		//
		// Server sidecar filter chain's FilterChainMatch.ApplicationProtocols must
		// include "istio" for the secure traffic, but its TLSContext.ALPN must not

			"client - gateway defined by targetRef",
			[]config.Config{newTelemetry("default", targetRefClient)},
			networking.ListenerClassGateway,
			sidecar,
			nil,
			[]string{"envoy"},
		},
		{
			"client - outbound",
			[]config.Config{newTelemetry("istio-system", client)},
			networking.ListenerClassSidecarOutbound,
			sidecar,
			nil,
			[]string{"envoy"},
		},
		{
			"client - inbound",

```json
{
  "collection": [
    {
      "Metadata": {
        "name": "output-resource-1"
      },
      "Body": {}
    },
    {
      "Metadata": {
        "name": "outout-resource-2"
      },
      "Body": {}
    }
  ]
}
```

To add a new test data fileset:
 1. Create a new, appropriately named folder under dataset.

	n := atomic.NewInt32(0)
	mkv := func(n int32) *discovery.Resource {
		return &discovery.Resource{Resource: &anypb.Any{TypeUrl: fmt.Sprint(n)}}
	}
	k := endpoints.NewCDSEndpointBuilder(
		proxy, nil,
		"outbound||foo.com",
		model.TrafficDirectionOutbound, "", "foo.com", 80,
		&model.Service{Hostname: "foo.com"}, nil)
	work := func(start time.Time, n int32) {
		v := mkv(n)

}

// OutboundTrafficPolicyConfig controls the default behavior of the sidecar for handling outbound traffic from the application.
message OutboundTrafficPolicyConfig {
  // Specifies the sidecar's default behavior when handling outbound traffic from the application.
  enum Mode {
    // Outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntries for the destination port

// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package ssa

// fuseBranchRedirect checks for a CFG in which the outbound branch
// of an If block can be derived from its predecessor If block, in
// some such cases, we can redirect the predecessor If block to the
// corresponding successor block directly. For example:
//
//	p: