rule IN_ONLY --logical-in br-client -i ! bat0 -j DROP
rule OUT_ONLY --logical-out br-client -o ! bat0 -j DROP