In the v2 API, we have a fairly general source/destination IP range/port and SNI match criteria used to select the applicable filter chain for a given incoming TCP connection, see https://github.com/lyft/envoy-api/blob/master/api/lds.proto#L46. This issue will track the related implementation work.