.. _config_listener_filters_original_dst: Original Destination ==================== Linux ----- Original destination listener filter reads the SO_ORIGINAL_DST socket option set when a connection has been redirected by an iptables REDIRECT target, or by an iptables TPROXY target in combination with setting the listener's :ref:`transparent ` option. Windows ------- Original destination listener filter reads the SO_ORIGINAL_DST socket option set when a connection has been redirected by an `HNS `_ policy applied to a container endpoint. For this filter to work the :ref:`traffic_direction ` must be set on the listener. This means that a separate listener is needed to handle inbound and outbound traffic. Redirection is not available for use with all types of network traffic. The types of packets that are supported for redirection are shown in the following list: * TCP/IPv4 * UDP * Raw UDPv4 without the header include option * Raw ICMP For more info see `Using Bind or Connect Redirection `_ .. note:: At the time of writing (February 2021) the OS support for original destination is only available through the `Windows insider program `_. The feature will be fully supported in the upcoming Windows Server release, see `Windows Server Release info `_. Later processing in Envoy sees the restored destination address as the connection's local address, rather than the address at which the listener is listening at. Furthermore, :ref:`an original destination cluster ` may be used to forward HTTP requests or TCP connections to the restored destination address. * :ref:`v3 API reference ` * This filter should be configured with the name *envoy.filters.listener.original_dst*.