[...]
matches:
-  match:
   sourceSelector:
     app:firewall
route:
-  destination:
   destinationSelector:
     app:vpn-gateway
match:
  route
  -  destination:
     destinationSelector:
       app:firewall