I am attempting to open a TCP connection into an Istio service mesh using the v1alpha3 routing. I can successfully open a connection with the external load balancer. That traffic is making it into the default IngressGateway as expected; I have verified this with tcpdump on the IngressGateway pod.

Unfortunately, the traffic is never forwarded into the service mesh; it seems to die in the IngressGateway.

The following is an example of my configuration:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: echo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 31400 
      protocol: TCP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: echo-gateway
spec:
  hosts:
  - "*"
  gateways:
  - echo-gateway
  tcp:
  - match:
    - port: 31400
    route:
    - destination:
        host: echo.default.svc.cluster.local
        port:
          number: 6060

I have verified that the IngressGateway can reach the Service via netcat on the specified port. Running tcpdump on the Service pod with the envoy indicates that there is never a communication attempt with the pod or proxy.

I've read over the documentation several times and I'm at a loss as how to proceed. This line from the documentation is suspicious to me:

While Istio will configure the proxy to listen on these ports, it is the responsibility of the user to ensure that external traffic to these ports are allowed into the mesh.

Any thoughts?