rule 'FORWARD --logical-in br-client -i ! bat0 -j FFHO_NET_ONLY'