<filter name='no-arp-mac-spoofing' chain='arp-mac' priority='-520'>
  <uuid>3b1507da-4c35-4f27-95b0-c3a89c4a0324</uuid>
  <rule action='return' direction='out' priority='350'>
    <arp arpsrcmacaddr='$MAC'/>
  </rule>
  <rule action='drop' direction='out' priority='1000'/>
</filter>

