[EXPERIMENT] reactive iptable rule template