code> rule in iptables, and then be forwarded to port 15001 of the sidecar container, where Envoy is listening. This is steps 9-12 on the red path, similar to inbound traffic processing.</p><p>Traffic to the application port needs to be forwarded to the sidecar, then sent to the container port from the sidecar port, which is overhead. Moreover, iptables&rsquo; versatility determines that its performance is not always ideal because it inevitably adds delays to the whole datapath with different filtering rule