new_chain	filter DFWRS_FORWARD
flush_chain	filter DFWRS_FORWARD
new_chain	filter DFWRS_INPUT
flush_chain	filter DFWRS_INPUT
new_chain	nat DFWRS_PREROUTING
flush_chain	nat DFWRS_PREROUTING
new_chain	nat DFWRS_POSTROUTING
flush_chain	nat DFWRS_POSTROUTING
append	filter DFWRS_INPUT -m state --state INVALID -j DROP
append	filter DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
append_replace	filter INPUT -j DFWRS_INPUT
append	filter DFWRS_FORWARD -m state --state INVALID -j DROP
append	filter DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
append_replace	filter FORWARD -j DFWRS_FORWARD
append_replace	nat PREROUTING -j DFWRS_PREROUTING
append_replace	nat POSTROUTING -j DFWRS_POSTROUTING
append	filter DFWRS_FORWARD -i $input=bridge -o $output=bridge -j REJECT	"$input" == "$output"
append	filter DFWRS_FORWARD -s $src_ip=ip -d $dst_ip=ip -i $input=bridge -o $output=bridge -m state --state RELATED -j ACCEPT	"$input" == "$output"
append	filter DFWRS_FORWARD -j DROP
commit
