rule 'FORWARD --logical-in br-client -i ! bat0 -j FFPB_NET_ONLY'