title: TCP Ingress with Istio 0.8 and v1alpha3 Gateway
body: <p>I am attempting to open a TCP connection into an Istio service mesh using the v1alpha3 routing. I can successfully open a connection with the external load balancer. That traffic is making it into the default IngressGateway as expected; I have verified this with <code>tcpdump</code> on the IngressGateway pod.</p>
  
  <p>Unfortunately, the traffic is never forwarded into the service mesh; it seems to die in the IngressGateway.</p>
  
  <p>The following is an example of my configuration:</p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: echo-gateway
  spec:
    selector:
      istio: ingressgateway # use istio default controller
    servers:
    - port:
        number: 31400 
        protocol: TCP
      hosts:
      - "*"
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: echo-gateway
  spec:
    hosts:
    - "*"
    gateways:
    - echo-gateway
    tcp:
    - match:
      - port: 31400
      route:
      - destination:
          host: echo.default.svc.cluster.local
          port:
            number: 6060
  </code></pre>
  
  <p>I have verified that the IngressGateway can reach the Service via <code>netcat</code> on the specified port. Running <code>tcpdump</code> on the Service pod with the envoy indicates that there is never a communication attempt with the pod or proxy.</p>
  
  <p>I've read over the documentation several times and I'm at a loss as how to proceed. This line from the documentation is suspicious to me:</p>
  
  <blockquote>
    <p>While Istio will configure the proxy to listen on these ports, it is the responsibility of the user to ensure that external traffic to these ports are allowed into the mesh.</p>
  </blockquote>
  
  <p>Any thoughts?</p>