$ docker run --net cilium --label app=b -d busybox nc -l -p 80
$ cilium endpoint list
ENDPOINT   POLICY (ingress)   POLICY (egress)   IDENTITY   LABELS (source:key[=value])                   IPv6                 IPv4           STATUS   
           ENFORCEMENT        ENFORCEMENT                                                                                                    
16996      Enabled            Disabled          27239      container:app=b                               f00d::a00:0:0:4264   10.0.118.183   ready
$ cilium policy import ./l4-policy.json
$ docker run --net cilium --label app=a -ti busybox sh
/ # wget 10.0.118.183:80
Connecting to 10.0.118.183:80 (10.0.118.183:80)

$ cilium monitor | grep '10.0.118.183:80'
<- endpoint 27280 flow 0xcf4aba39 identity 47997->0 state new ifindex 0: 10.0.111.25:34020 -> 10.0.118.183:80 tcp SYN
xx drop (Policy denied (L3)) flow 0xcf4aba39 to endpoint 16996, identity 47997->27239: 10.0.111.25:34020 -> 10.0.118.183:80 tcp SYN

[
    {
        "endpointSelector": {
            "matchLabels": {
                "any:app": "b"
            }
        },
        "ingress": [
            {
                "toPorts": [
                    {
                        "ports": [
                            {
                                "port": "80",
                                "protocol": "TCP"
                            }
                        ]
                    }
                ]
            }
        ],
        "labels": [
            {
                "key": "io.cilium.k8s-policy-name",
                "value": "l4-rule",
                "source": "unspec"
            }
        ]
    }
]