// and X-Forwarded-Proto headers are removed from the
	// outbound request before Rewrite is called. See also
	// the ProxyRequest.SetXForwarded method.
	//
	// Unparsable query parameters are removed from the
	// outbound request before Rewrite is called.
	// The Rewrite function may copy the inbound URL's
	// RawQuery to the outbound URL to preserve the original
	// parameter string. Note that this can lead to security

		},
		"Net Adapter Packets Received Errors Query": {
			counter:   packetsReceivedErrorsQuery,
			skipCheck: true,
		},
		"Net Adapter Packets Outbound Discarded Query": {
			counter:   packetsOutboundDiscardedQuery,
			skipCheck: true,
		},
		"Net Adapter Packets Outbound Errors Query": {
			counter:   packetsOutboundErrorsQuery,
			skipCheck: true,
		},
		"Invalid Query": {
			counter:        "foo",

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for tunneling outbound traffic via external HTTP forward proxies using HTTP CONNECT or POST methods.

    name: httplocal
    protocol: HTTP

  location: MESH_INTERNAL
  resolution: STATIC

  endpoints:
  - address: 10.11.0.1
    ports:
      httplocal: 7071

---

# Regular TCP outbound cluster (Default MeshExternal = true, Resolution ClientSideLB)
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: s2
  namespace: none
spec:
  hosts:

	ExcludeInterfaces         = "istio-exclude-interfaces"
	ServiceCidr               = "istio-service-cidr"
	ServiceExcludeCidr        = "istio-service-exclude-cidr"
	OutboundPorts             = "istio-outbound-ports"
	LocalOutboundPortsExclude = "istio-local-outbound-ports-exclude"
	EnvoyPort                 = "envoy-port"
	InboundCapturePort        = "inbound-capture-port"
	InboundTunnelPort         = "inbound-tunnel-port"

releaseNotes:
  - |
    **Added** a new configuration to `ProxyHeaders`, `MetadataExchangeHeaders`. The `IN_MESH` mode ensures `x-envoy-peer-metadata` and `x-envoy-peer-metadata-id`

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statPrefix: tcp.

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: route-outbound-traffic-to-external-app-via-external-forward-proxy
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:
        host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
        subset: external-svc-tcp

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for outbound traffic Proxy Protocol. By specifying proxyProtocol in a DestinationRule.trafficPolicy,