Limit traffic to a external service using Istio - istio

Question

I have Kubernetes with Istio installed.
I am trying to limit external traffic to a host (for example checkip.amazonaws.com). This will be applied to all services in a namespace (konta in the example). All the pods already have sidecar proxy injected.
I used the following configuration but with no success.
apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
name: quotahandler
namespace: konta
spec:
compiledAdapter: memquota
params:
quotas:
- name: requestcountquota.instance.konta
maxAmount: 5
validDuration: 60s
rateLimitAlgorithm: ROLLING_WINDOW
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
name: requestcountquota
namespace: konta
spec:
compiledTemplate: quota
params:
dimensions:
#source: "unknown"
source: request.headers["x-forwarded-for"] | "unknown"
#destination:
#destination: destination.labels["app"] | destination.service.name | "unknown"
#destinationVersion: destination.labels["version"] | "unknown"
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
name: request-count
namespace: konta
spec:
rules:
- quotas:
- charge: 1
quota: requestcountquota
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
name: request-count
namespace: konta
spec:
quotaSpecs:
- name: request-count
namespace: konta
services:
- service: '*' # Uncomment this to bind *all* services to request-count
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
name: quota
namespace: konta
spec:
# quota only applies if you are not logged in.
# match: match(request.headers["cookie"], "user=*") == false
match: match(destination.service.host, "checkip.amazonaws.com") == true
actions:
- handler: quotahandler
instances:
- requestcountquota
I am testing with a simple curl pod.
kubectl run -i --tty get-ip-address --image=dwdraju/alpine-curl-jq --restart=Never -n konta
and
curl checkip.amazonaws.com
Obs: My egress traffic are NOT passing through Istio egress-gateway