Using iptables rules and use_original_dst causes issues since multiple protocols get combined in a single listener section in Envoy configuration. For example, consider two micro-services "mysql" and "web" that listen on the same port 9000 but use TCP and HTTP. In a third service egress proxy config, we capture packets by redirecting to another listener with iptables and recover the original port with use_original_dst to handle both service traffic in listener on port 9000. We can distinguish between the two services by their virtual IPs: MYSQL_SERVICE_IP:9000 and WEB_SERVICE_IP:9000. However, tcp_proxy and http_connection_manager cannot coexist in together since tcp_proxy always terminates connections and does not fall through.