*filter
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
:INPUT DROP
:OUTPUT ACCEPT
:FORWARD ACCEPT
# -p 1 shmainei Request operation (who-has?)
FOREACH IPID in {VLL_IP_IDS}
-A INPUT -d {VLL_IP({IPID})} -i {VLL_WANIFACE} -j ACCEPT
DONE
#FOREACH VIF in {LAN}
#-A INPUT -d {VLL_IP_1}/{VLL_MASK_1} -i {PHYSNAME({VIF})} -j ACCEPT
#DONE
#FOREACH VIF in {LAN|WAN|VLAN}
#-A INPUT -d {IP({VIF})}/32 -i {PHYSNAME({VIF})} -j ACCEPT
#DONE
#-A INPUT -i {PHYSNAME({VIF})} -j DROP
#DONE
#FOREACH VIF in {LAN}
#FOREACH IPID in {VLL_IP_IDS}
#-A OUTPUT -s {IP({VIF})} -d {VLL_IP({IPID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_GATEWAY}  
#DONE
#DONE
# It is not necessary for VLL_SCOPE_PEER to exist after all
#IF {DECIDE_VLL_SCOPE_PEER}
#-A OUTPUT -s {VLL_FAKEIP} -d {VLL_GATEWAY} -o {VLL_WANIFACE} -j mangle --mangle-ip-s {VLL_IP_1}
#ELSE
#-A OUTPUT -s {VLL_FAKEIP} -d {VLL_IP_1}/{VLL_MASK_1} -o {VLL_WANIFACE} -j mangle --mangle-ip-s {VLL_IP_1}
#FI
-A OUTPUT -s {VLL_FAKEIP} -d {VLL_GATEWAY}/{VLL_MASK_1} -o {VLL_WANIFACE} -j mangle --mangle-ip-s {VLL_IP_1}
ELSE
:INPUT ACCEPT
:OUTPUT ACCEPT
:FORWARD ACCEPT
FI
