fix comment
factor out code to produce policy rules
correctly implement policy for host firewall
clear mark when entering tapXZY-OUT chain
add $bridge-OUT chain to PVEFW-INPUT