accept traffic to unmanaged bridge ports
use PVEFW-reject instead of REJECT
add 'dhcp' option (enabled by default)