original user’s address (IP_TRANSPARENT) ⑤ Server’s response packet is flowing through the same path (TPROXY + Custom Route) #IstioCon TOA Address Caveats : install toa module in kernel #IstioCon Proxy 244.0.25 Dest: 127.0.0.1 Src：10.244.0.20 ① Setting annotation sidecar.istio.io/interceptionMode: TPROXY, istio will automatically set the original src filter and iptabels rules #IstioCon Preserve TCP listener.proxy_protocol“ in inbound listener. ② Setting annotation sidecar.istio.io/interceptionMode: TPROXY， this will set all the rules as inner cluster #IstioCon Content 1. TCP Original Address Preserve