add table inet istio-proxy-nat
flush table inet istio-proxy-nat
add chain inet istio-proxy-nat output { type nat hook output priority -100 ; }
add chain inet istio-proxy-nat istio-inbound
add chain inet istio-proxy-nat istio-redirect
add chain inet istio-proxy-nat istio-in-redirect
add chain inet istio-proxy-nat istio-output
add rule inet istio-proxy-nat istio-inbound meta l4proto tcp tcp dport 15008 counter return
add rule inet istio-proxy-nat istio-redirect meta l4proto tcp counter redirect to :15001
add rule inet istio-proxy-nat istio-in-redirect meta l4proto tcp counter redirect to :15006
add rule inet istio-proxy-nat output counter jump istio-output
add rule inet istio-proxy-nat istio-output oifname lo ip saddr 127.0.0.6/32 counter return
add rule inet istio-proxy-nat istio-output oifname lo meta l4proto tcp ip daddr != 127.0.0.1/32 tcp dport != 15008 skuid 1337 counter jump istio-in-redirect
add rule inet istio-proxy-nat istio-output oifname lo skuid != 1337 counter return
add rule inet istio-proxy-nat istio-output skuid 1337 counter return
add rule inet istio-proxy-nat istio-output oifname lo meta l4proto tcp ip daddr != 127.0.0.1/32 tcp dport != 15008 skgid 1337 counter jump istio-in-redirect
add rule inet istio-proxy-nat istio-output oifname lo skgid != 1337 counter return
add rule inet istio-proxy-nat istio-output skgid 1337 counter return
add rule inet istio-proxy-nat istio-output ip daddr 127.0.0.1/32 counter return
add table inet istio-proxy-mangle
flush table inet istio-proxy-mangle
add chain inet istio-proxy-mangle prerouting { type filter hook prerouting priority -150 ; }
add chain inet istio-proxy-mangle output { type route hook output priority -150 ; }
add chain inet istio-proxy-mangle istio-divert
add chain inet istio-proxy-mangle istio-tproxy
add chain inet istio-proxy-mangle istio-inbound
add rule inet istio-proxy-mangle istio-divert counter meta mark set 1337
add rule inet istio-proxy-mangle istio-divert counter accept
add rule inet istio-proxy-mangle istio-tproxy meta l4proto tcp ip daddr != 127.0.0.1/32 tproxy ip to :15006 meta mark set 1337 counter accept
add rule inet istio-proxy-mangle prerouting meta l4proto tcp counter jump istio-inbound
add rule inet istio-proxy-mangle istio-inbound meta l4proto tcp ct state related,established counter jump istio-divert
add rule inet istio-proxy-mangle istio-inbound meta l4proto tcp counter jump istio-tproxy
add rule inet istio-proxy-mangle prerouting meta l4proto tcp mark 1337 counter ct mark set mark
add rule inet istio-proxy-mangle output oifname lo meta l4proto tcp mark 1337 counter return
add rule inet istio-proxy-mangle output oifname lo meta l4proto tcp ip daddr != 127.0.0.1/32 skuid 1337 counter meta mark set 1338
add rule inet istio-proxy-mangle output oifname lo meta l4proto tcp ip daddr != 127.0.0.1/32 skgid 1337 counter meta mark set 1338
add rule inet istio-proxy-mangle output meta l4proto tcp ct mark 1337 counter meta mark set ct mark
insert rule inet istio-proxy-mangle istio-inbound index 0 meta l4proto tcp mark 1337 counter return
insert rule inet istio-proxy-mangle istio-inbound index 1 iifname lo meta l4proto tcp ip saddr 127.0.0.6/32 counter return
insert rule inet istio-proxy-mangle istio-inbound index 2 iifname lo meta l4proto tcp mark != 1338 counter return
