-	*filter
-	:DFWRS_FORWARD - [0:0]
-	:DFWRS_INPUT - [0:0]
-	:FORWARD - [0:0]
-	:INPUT - [0:0]
-	-F DFWRS_FORWARD
-	-F DFWRS_INPUT
-	-A DFWRS_INPUT -m state --state INVALID -j DROP
-	-A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-	-A INPUT -j DFWRS_INPUT
-	-A DFWRS_FORWARD -m state --state INVALID -j DROP
-	-A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-	-A FORWARD -j DFWRS_FORWARD
-	-A DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p tcp --dport 80 -j ACCEPT
-	-A DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p tcp --dport 80 -j ACCEPT
-	-A DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p udp --dport 53 -j ACCEPT
-	-A DFWRS_FORWARD -d $dst_ip=ip -i other -o $output=bridge -p tcp --dport 443 -j ACCEPT
-	-A DFWRS_FORWARD -i docker0 -o eni -j ACCEPT
-	-A DFWRS_INPUT -i docker0 -j ACCEPT
-	COMMIT
-	*nat
-	:DFWRS_POSTROUTING - [0:0]
-	:DFWRS_PREROUTING - [0:0]
-	:POSTROUTING - [0:0]
-	:PREROUTING - [0:0]
-	-F DFWRS_PREROUTING
-	-F DFWRS_POSTROUTING
-	-A PREROUTING -j DFWRS_PREROUTING
-	-A POSTROUTING -j DFWRS_POSTROUTING
-	-A DFWRS_PREROUTING -i eni -p tcp --dport 80 -j DNAT --to-destination ${dst_ip=ip}:80
-	-A DFWRS_PREROUTING -i eni -p tcp --dport 80 -j DNAT --to-destination ${dst_ip=ip}:80
-	-A DFWRS_PREROUTING -i eni -p udp --dport 53 -j DNAT --to-destination ${dst_ip=ip}:53
-	-A DFWRS_PREROUTING -i other -p tcp --dport 443 -j DNAT --to-destination ${dst_ip=ip}:443
-	-A DFWRS_POSTROUTING -o eni -j MASQUERADE
-	COMMIT