<p>We have a issue where connecting to AWS RDS in Istio Service Mesh is results in <code>upstream connect error or disconnect/reset before header</code> . 
Our Egress rule is as below  </p>

<pre><code> apiVersion: config.istio.io/v1alpha2
 kind: EgressRule
 metadata:
     namespace: &lt;our-namespace&gt;
     name: rds-egress-rule-with
 spec:
     destination:
     service: &lt;RDS End point&gt; 
 ports:
     - port: 80
       protocol: http
     - port: 443
       protocol: https
     - port: 3306
       protocol: https 
</code></pre>

<p>The connection to MySQL works fine in a stand alone MySQL in EC2. The connection to AWS RDS works fine without Istio.  The problem only occurs in Istio Service Mesh. </p>

<p>We are using istio in Disabled Mutual TLS Configuration.</p>

<p>The protocol in your <code>EgressRule</code> definition should be <code>tcp</code>. The <code>service</code> should contain the IP address or a range of IP addresses in CIDR notation.</p>
<p>Alternatively, you can use the <code>--includeIPRanges</code> flag of <code>istioctl kube-inject</code>, to specify which IP ranges are handled by Istio. Istio will not interfere with the the not-included IP addresses and will just allow the traffic to pass thru.</p>
<p>References:</p>
<ol>
<li><a href="https://istio.io/latest/blog/2018/egress-tcp/" rel="nofollow noreferrer">https://istio.io/latest/blog/2018/egress-tcp/</a></li>
<li><a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/#direct-access-to-external-services" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/#direct-access-to-external-services</a></li>
</ol>
