run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
## Allow responses from the scary outside world into the untrusted net, but
-## don't let untrusted things run services. [EXPERIMENTAL]
+## don't let untrusted things run services.
case $forward in
1)
run ip46tables -A FORWARD -j ACCEPT \