<p>Ingress gateway is located behind AWS ELB(classic) using nodeport and I want to route TCP traffic in Virtual Service based on client ip. </p>

<p>Of course Proxy Protocol of ELB is enabled.</p>

<p>When I use HTTP, it works. The configuration is below. </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app-vservice
  namespace: test
spec:
  hosts:
  - "app-service"
  http:
  - match:
    - headers:
        x-forwarded-for:
          exact: 123.123.123.123
    route:
    - destination:
        host: app-service
        subset: v2
  - route:
    - destination:
        host: app-service
        subset: v1
</code></pre>

<p>But I can't find headers field of TCP route in official documents. </p>

<p>Is it impossible?</p>

<p>Thank you.</p>

<p>According to docs yes there is no field to pass headers in TCPRoute in Istio. Also to answer your question every header manipulation should be done using envoy filters because Istio, built on envoy supports that and also decreases the complexity.</p>

<p>Using envoy and lua filters as stated in Istio docs. It can be achieved. Please follow envoy <a href="https://www.envoyproxy.io/docs/envoy/v1.13.0/api-v2/service/auth/v2/external_auth.proto#envoy-api-msg-service-auth-v2-checkrequest" rel="nofollow noreferrer">docs</a>.</p>

<p>Checkout the Istio <a href="https://discuss.istio.io/t/add-headers-using-virtual-service/2786/4" rel="nofollow noreferrer">Discussion</a> for headers in Virtual Service.</p>

<p>For implementation of the same using <a href="https://www.envoyproxy.io/docs/envoy/v1.13.0/configuration/http/http_filters/lua_filter" rel="nofollow noreferrer">Lua</a>. And a <a href="https://blog.opstree.com/2020/05/27/ip-whitelisting-using-istio-policy-on-kubernetes-microservices/" rel="nofollow noreferrer">blog</a> showing an example how to implement filters on envoy.</p>
