iptables -t nat -A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
iptables -t mangle -A ISTIO_DIVERT -j MARK --set-mark 1337
iptables -t mangle -A ISTIO_DIVERT -j ACCEPT
iptables -t mangle -A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006

  * It is critical that this path preserves the Service IP, if the traffic was to a Service.
* All traffic *ingressing* a pod on port 15008 in the mesh is assumed to be HBONE, and should be redirected to the node-local ztunnel on port 15008 (more on this later).
* All other traffic *ingressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15006, regardless of intended original destination port.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: only-hbone
spec:
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: namespace
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008
    protocol: HBONE
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: invalid
  namespace: ns
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 1234

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: rapid
  name: bookinfo-reviews
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 22 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN

ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

{
  "workloads": {
    "network1/10.244.2.54": {
      "workloadIps": [
        "10.244.2.54"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",
        "port": 15008
      },
      "protocol": "HBONE",
      "uid": "Kubernetes//Pod/bookinfo/ratings-v1-6484c4d9bb-mdxm5",
      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",

	VirtualInboundCatchAllHTTPFilterChainName = "virtualInbound-catchall-http"
)

const (

	// HBoneInboundListenPort is the port on which incoming HBone traffic will be captured.
	HBoneInboundListenPort = 15008

    reason: AddressNotUsable
    status: "False"
    type: Programmed
  listeners:
  - attachedRoutes: 0
    conditions:
    - lastTransitionTime: fake
      message: Expected a single listener on port 15008 with protocol "HBONE"
      reason: UnsupportedProtocol
      status: "False"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"