[...] matches: - match: sourceSelector: app:firewall route: - destination: destinationSelector: app:vpn-gateway match: route - destination: destinationSelector: app:firewall