it will be intercepted by a <code>PREROUTING</code> rule in iptables, forwarded to port 15006 of the sidecar container, and handed over to Envoy for processing. This is shown as steps 1-4 in the red path in the above diagram.</p><p>Envoy processes the traffic using the policies issued by the Istio control plane. If allowed, the traffic will be sent to the actual container port of the application container.</p><p>When the application tries to access other services, it will be intercepted by an <code>OUTPUT</