<filter name='allow-arp' chain='arp'>
  <rule direction='inout' action='accept'/>
</filter>
