ipt_create_chain pre_lan_bridge raw
ipt_create_chain out_lan_bridge raw

if [ "$MODE" != "start" ]; then
	ipt -t raw -F pre_lan_bridge
	ipt -t raw -F out_lan_bridge
fi

ipt -t raw -A pre_lan -j pre_lan_bridge
ipt -t raw -A out_lan -j out_lan_bridge

for ip4_tmp in $if_lan_ips4; do
	ipt4 -t raw -A pre_lan_bridge -d $ip4_tmp -j RETURN
	ipt4 -t raw -A out_lan_bridge -s $ip4_tmp -j RETURN
done

for ip6_tmp in $if_lan_ips6; do
	ipt6 -t raw -A pre_lan_bridge -d $ip6_tmp -j RETURN
	ipt6 -t raw -A out_lan_bridge -s $ip6_tmp -j RETURN
done

# all other (bridged) traffic shouldn't be tracked
ipt -t raw -A pre_lan_bridge -j NOTRACK
ipt -t raw -A out_lan_bridge -j NOTRACK