Accessing TCP service in the mesh by external tcp client

1

I am trying to access a tcp service in the mesh from an external client. The service pod is healthy and can be accessed inside the mesh, but when I access from outside the mesh then I got error in the ingress gateway.

`[2020-06-11T14:47:16.485Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 10.244.0.160:31400 10.244.0.1:33529 - -
`

The endpoint is healthy

127.0.0.1:30871 HEALTHY OK inbound|30871|tcp-t3|sample-domain1-admin-server.sample-domain1-ns.svc.cluster.local

and the virtual service

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: sample-domain1-virtualservice
  namespace: sample-domain1-ns
spec:
  hosts:
  - '*'
  gateways:
  - sample-domain1-gateway
  tcp:
  - match:
    - port: 31400
    route:
    - destination:
        host: sample-domain1-admin-server.sample-domain1-ns.svc.cluster.local
        port:
          number: 30871

and there is no security on the service. This is using the standard istioctl install demo profile with 1.6 (same behavior with 1.5.4). If I use the helm install method in 1.5.4, then it works without problem. What am I missing?