reactive: Drop unrecognized traffic in loadbalancer

Only allow traffic with src/dst mac addresses that appear in the policy.