the red path in the above diagram.</p><p>Envoy processes the traffic using the policies issued by the Istio control plane. If allowed, the traffic will be sent to the actual container port of the application container.</p><p>When the application tries to access other services, it will be intercepted by an <code>OUTPUT</code> rule in iptables, and then be forwarded to port 15001 of the sidecar container, where Envoy is listening. This is steps 9-12 on the red path, similar to inbound traffic processing.</p><