s
    protocol: TLS
  resolution: DNS
  location: MESH_EXTERNAL
EOF
</code></pre></li><li><p>Create a service entry and configure a destination rule for the <code>localhost</code> service.
You need this service entry in the next step as a destination for traffic to the external services from
applications inside the mesh to block traffic from inside the mesh. In this example you use Istio as a proxy between
external applications and external services.</p><pre><code class=language-bash data-expandlinks=true d