nvoy proxy. Istio uses Envoy as the &ldquo;sidecar&rdquo; to intercept service traffic, with the kernel&rsquo;s <code>netfilter</code> packet filter functionality configured by iptables.</p><p>There are shortcomings in using iptables to perform this interception. Since netfilter is a highly versatile tool for filtering packets, several routing rules and data filtering processes are applied before reaching the destination socket. For example, from the network layer to the transport layer, netfilter will be u