Currently the tcp_proxy network filter can only open connections to hosts belonging to a single cluster specified by name in the configuration.

We propose the addition of an optional list of L3/L4 routing rules pointing to specific clusters by name.
The rules would be examined in-order and the first rule to match would be applied.

A rule would consist of a cluster name and 1 or more match criteria from this set:

• src ip address (with optional subnet mask)
• original destination ip address (with optional subnet mask). This is useful if the connection has been redirected with iptables
• src TCP port
• original destination port (might be different from listener port due to redirect)

If all specified match criteria are satisfied (src/dst ports are equal to the provided number, src/dest IP addresses belong to the range), the connection is opened towards the cluster named in the rule.

Later on we can add probabilistic fall-through similar to http_connection_manager routes.

The "cluster" parameter currently defined at the filter level becomes the default cluster (used if no rules match). If it is not defined (assuming it will become optional) the connection is terminated.

If the feature looks useful and the proposal reasonable, I will start filling in the details of the configuration model and the implementation.